Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2010-0211
The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the slap_mods_free function, as demonstrated using the Codenomicon LDAPv3 test suite.
Affected Products: n/a
References: [{'name': '1024221', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1024221'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT4435'}, {'name': 'GLSA-201406-36', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201406-36.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6570'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0001.html'}, {'name': 'ADV-2010-1858', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1858'}, {'name': '40677', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/40677'}, {'name': 'APPLE-SA-2010-11-10-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html'}, {'name': 'ADV-2010-1849', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1849'}, {'name': '41770', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/41770'}, {'name': 'RHSA-2010:0542', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0542.html'}, {'name': '40687', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/40687'}, {'name': '20110105 VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/515545/100/0/threaded'}, {'name': 'SUSE-SR:2010:014', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html'}, {'name': 'RHSA-2010:0543', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0543.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705'}, {'name': '40639', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/40639'}, {'name': '42787', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42787'}, {'name': 'ADV-2011-0025', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0025'}]
CVE State: PUBLISHED
Explain CVE-2010-0212
OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schema_init.c, as demonstrated using the Codenomicon LDAPv3 test suite.
Affected Products: n/a
References: [{'name': '1024221', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1024221'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT4435'}, {'name': 'GLSA-201406-36', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201406-36.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6570'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0001.html'}, {'name': 'ADV-2010-1858', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1858'}, {'name': 'APPLE-SA-2010-11-10-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html'}, {'name': 'ADV-2010-1849', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1849'}, {'name': '41770', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/41770'}, {'name': 'RHSA-2010:0542', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0542.html'}, {'name': '40687', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/40687'}, {'name': '20110105 VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/515545/100/0/threaded'}, {'name': 'SUSE-SR:2010:014', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705'}, {'name': '40639', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/40639'}, {'name': '42787', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42787'}, {'name': 'ADV-2011-0025', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0025'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735'}]
CVE State: PUBLISHED
Explain CVE-2010-0213
BIND 9.7.1 and 9.7.1-P1, when a recursive validating server has a trust anchor that is configured statically or via DNSSEC Lookaside Validation (DLV), allows remote attackers to cause a denial of service (infinite loop) via a query for an RRSIG record whose answer is not in the cache, which causes BIND to repeatedly send RRSIG queries to the authoritative servers.
Affected Products: n/a
References: [{'name': 'SUSE-SR:2010:020', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html'}, {'name': '41730', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/41730'}, {'name': '1024217', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1024217'}, {'name': 'VU#211905', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/211905'}, {'name': '40709', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/40709'}, {'name': 'FEDORA-2010-11344', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044445.html'}, {'name': '40652', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/40652'}, {'name': 'ADV-2010-1884', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1884'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.isc.org/software/bind/advisories/cve-2010-0213'}]
CVE State: PUBLISHED
Explain CVE-2010-0214
The administrative interface on the PolyVision RoomWizard with firmware 3.2.3 places the Sync Connector Active Directory (AD) credentials in a web form that is accessed over HTTP on port 80, which allows remote attackers to obtain sensitive information by reading the HTML source code corresponding to the /admin/sign/DeviceSynch URI.
Affected Products: n/a
References: [{'name': 'VU#870601', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/870601'}, {'name': 'roomwizard-password-security-bypass(64543)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/64543'}, {'name': 'ADV-2011-0059', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0059'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/view/97291/roomwizard-disclose.txt'}, {'name': '20110106 RoomWizard Default Password and Sync Connector Credential Leak [CVE-2010-0214]', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2011/Jan/58'}, {'name': '45699', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/45699'}]
CVE State: PUBLISHED
Explain CVE-2010-0215
ActiveCollab before 2.3.2 allows remote authenticated users to bypass intended access restrictions, and (1) delete an attachment or (2) subscribe to an object, via a crafted URL.
Affected Products: n/a
References: [{'name': 'VU#236703', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/236703'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.activecollab.com/docs/manuals/admin/release-notes/activecollab-2-3-2'}]
CVE State: PUBLISHED
Explain CVE-2010-0216
authenticate_ad_setup_finished.cfm in MediaCAST 8 and earlier allows remote attackers to discover usernames and cleartext passwords by reading the error messages returned for requests that use the UserID parameter.
Affected Products: n/a
References: [{'name': '72079', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/72079'}, {'name': '44182', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44182'}, {'name': '47572', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47572'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.packetninjas.net/storage/advisories/MediaCast-PWDump-FINAL.txt'}, {'name': '8245', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8245'}, {'name': 'mediacast-authenticateadsetup-info-disc(67082)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/67082'}]
CVE State: PUBLISHED
Explain CVE-2010-0217
Zeacom Chat Server before 5.1 uses too short a random string for the JSESSIONID value, which makes it easier for remote attackers to hijack sessions or cause a denial of service (Chat Server crash or Tomcat daemon crash) via a brute-force attack.
Affected Products: n/a
References: [{'name': '20110517 CVE-2010-0217 - Zeacom Chat Server JSESSIONID weak SessionID Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/518037/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.packetninjas.net/storage/advisories/Zeacom-CVE-2010-0217.txt'}, {'name': '8255', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8255'}, {'name': '47910', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47910'}, {'name': 'chat-server-jsessionid-session-hijacking(67540)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/67540'}]
CVE State: PUBLISHED
Explain CVE-2010-0218
ISC BIND 9.7.2 through 9.7.2-P1 uses an incorrect ACL to restrict the ability of Recursion Desired (RD) queries to access the cache, which allows remote attackers to obtain potentially sensitive information via a DNS query.
Affected Products: n/a
References: [{'name': '[bind-announce] 20100928 Security Advisory Regarding Unexpected ACL Behavior in BIND 9.7.2', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.isc.org/pipermail/bind-announce/2010-September/000655.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ftp.isc.org/isc/bind9/9.7.2-P2/RELEASE-NOTES-BIND-9.7.2-P2.html'}, {'name': 'VU#784855', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/784855'}]
CVE State: PUBLISHED
Explain CVE-2010-0219
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
Affected Products: n/a
References: [{'name': '41799', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/41799'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/KB27373'}, {'tags': ['x_refsource_MISC'], 'url': 'http://retrogod.altervista.org/9sg_ca_d2d.html'}, {'name': '70233', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/70233'}, {'name': '15869', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/15869'}, {'tags': ['x_refsource_MISC'], 'url': 'http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf'}, {'name': 'ADV-2010-2673', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/2673'}, {'name': '20101014 R7-0037: SAP BusinessObjects Axis2 Default Admin Password', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/514284/100/0/threaded'}, {'name': 'businessobjects-dswsbobje-security-bypass(62523)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/62523'}, {'name': '42763', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42763'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.rapid7.com/security-center/advisories/R7-0037.jsp'}, {'name': 'VU#989719', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/989719'}, {'name': '1024929', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1024929'}, {'tags': ['x_refsource_MISC'], 'url': 'https://service.sap.com/sap/support/notes/1432881'}]
CVE State: PUBLISHED
Explain CVE-2010-0220
The nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp in Mozilla Firefox before 3.5.7 allows remote attackers to cause a denial of service (application crash) via a crafted web site that triggers memory consumption and an accompanying Low Memory alert dialog, and also triggers attempted removal of an observer from an empty observers array.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://isc.sans.org/diary.html?storyid=7897'}, {'name': 'MDVSA-2010:000', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:000'}, {'name': 'firefox-nsobserverlist-dos(55550)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55550'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.mozilla.org/mozilla-central/rev/51396f6c9f20'}, {'name': 'oval:org.mitre.oval:def:8292', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8292'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.com/en-US/firefox/3.5.7/releasenotes/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=507114'}]
CVE State: PUBLISHED
Explain CVE-2010-0221
Kingston DataTraveler BlackBox (DTBB), DataTraveler Secure Privacy Edition (DTSP), and DataTraveler Elite Privacy Edition (DTEP) USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the cleartext drive contents via a modified program.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.kingston.com/driveupdate/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syss.de/index.php?id=108&tx_ttnews%5Btt_news%5D=528&cHash=8d16fa63d9'}, {'name': '1023410', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023410'}, {'tags': ['x_refsource_MISC'], 'url': 'http://it.slashdot.org/story/10/01/05/1734242/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://news.zdnet.co.uk/security/0%2C1000000189%2C39963327%2C00.htm'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blogs.zdnet.com/hardware/?p=6655'}, {'name': 'kingston-access-control-sec-bypass(55477)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55477'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syss.de/fileadmin/ressources/040_veroeffentlichungen/dokumente/SySS_knackt_Kingston_USB-Stick.pdf'}, {'name': 'ADV-2010-0080', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0080'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.ironkey.com/usb-flash-drive-flaw-exposed'}]
CVE State: PUBLISHED
Explain CVE-2010-0222
Kingston DataTraveler BlackBox (DTBB), DataTraveler Secure Privacy Edition (DTSP), and DataTraveler Elite Privacy Edition (DTEP) USB flash drives use a fixed 256-bit key for obtaining access to the cleartext drive contents, which makes it easier for physically proximate attackers to read or modify data by determining and providing this key.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.kingston.com/driveupdate/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syss.de/index.php?id=108&tx_ttnews%5Btt_news%5D=528&cHash=8d16fa63d9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://it.slashdot.org/story/10/01/05/1734242/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://news.zdnet.co.uk/security/0%2C1000000189%2C39963327%2C00.htm'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blogs.zdnet.com/hardware/?p=6655'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syss.de/fileadmin/ressources/040_veroeffentlichungen/dokumente/SySS_knackt_Kingston_USB-Stick.pdf'}, {'name': 'ADV-2010-0080', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0080'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.ironkey.com/usb-flash-drive-flaw-exposed'}]
CVE State: PUBLISHED
Explain CVE-2010-0223
Kingston DataTraveler BlackBox (DTBB), DataTraveler Secure Privacy Edition (DTSP), and DataTraveler Elite Privacy Edition (DTEP) USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the cleartext drive contents by providing a key that was captured in a USB data stream at an earlier time.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.kingston.com/driveupdate/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syss.de/index.php?id=108&tx_ttnews%5Btt_news%5D=528&cHash=8d16fa63d9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syss.de/fileadmin/ressources/040_veroeffentlichungen/dokumente/SySS_knackt_Kingston_USB-Stick.pdf'}, {'name': 'ADV-2010-0080', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0080'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.ironkey.com/usb-flash-drive-flaw-exposed'}]
CVE State: PUBLISHED
Explain CVE-2010-0224
SanDisk Cruzer Enterprise USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the cleartext drive contents via a modified program.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.syss.de/index.php?id=108&tx_ttnews%5Btt_news%5D=528&cHash=8d16fa63d9'}, {'name': '1023408', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023408'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.sandisk.com/business-solutions/enterprise/technical-support/security-bulletin-december-2009'}, {'tags': ['x_refsource_MISC'], 'url': 'http://it.slashdot.org/story/10/01/05/1734242/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blogs.zdnet.com/hardware/?p=6655'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syss.de/fileadmin/ressources/040_veroeffentlichungen/dokumente/SySS_knackt_SanDisk_USB-Stick.pdf'}, {'name': 'ADV-2010-0078', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0078'}, {'name': '37677', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37677'}, {'name': 'sandisk-access-control-sec-bypass(55475)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55475'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.ironkey.com/usb-flash-drive-flaw-exposed'}]
CVE State: PUBLISHED
Explain CVE-2010-0225
SanDisk Cruzer Enterprise USB flash drives use a fixed 256-bit key for obtaining access to the cleartext drive contents, which makes it easier for physically proximate attackers to read or modify data by determining and providing this key.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.syss.de/index.php?id=108&tx_ttnews%5Btt_news%5D=528&cHash=8d16fa63d9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.sandisk.com/business-solutions/enterprise/technical-support/security-bulletin-december-2009'}, {'tags': ['x_refsource_MISC'], 'url': 'http://it.slashdot.org/story/10/01/05/1734242/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blogs.zdnet.com/hardware/?p=6655'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syss.de/fileadmin/ressources/040_veroeffentlichungen/dokumente/SySS_knackt_SanDisk_USB-Stick.pdf'}, {'name': 'ADV-2010-0078', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0078'}, {'name': '37677', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37677'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.ironkey.com/usb-flash-drive-flaw-exposed'}]
CVE State: PUBLISHED
Explain CVE-2010-0226
SanDisk Cruzer Enterprise USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the cleartext drive contents by providing a key that was captured in a USB data stream at an earlier time.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.syss.de/index.php?id=108&tx_ttnews%5Btt_news%5D=528&cHash=8d16fa63d9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.sandisk.com/business-solutions/enterprise/technical-support/security-bulletin-december-2009'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syss.de/fileadmin/ressources/040_veroeffentlichungen/dokumente/SySS_knackt_SanDisk_USB-Stick.pdf'}, {'name': 'ADV-2010-0078', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0078'}, {'name': '37677', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37677'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.ironkey.com/usb-flash-drive-flaw-exposed'}]
CVE State: PUBLISHED
Explain CVE-2010-0227
Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the cleartext drive contents via a modified program.
Affected Products: n/a
References: [{'name': '1023409', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023409'}, {'tags': ['x_refsource_MISC'], 'url': 'http://it.slashdot.org/story/10/01/05/1734242/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.verbatim.com/security/security-update.cfm'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blogs.zdnet.com/hardware/?p=6655'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.ironkey.com/usb-flash-drive-flaw-exposed'}]
CVE State: PUBLISHED
Explain CVE-2010-0228
Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives use a fixed 256-bit key for obtaining access to the cleartext drive contents, which makes it easier for physically proximate attackers to read or modify data by determining and providing this key.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://it.slashdot.org/story/10/01/05/1734242/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.verbatim.com/security/security-update.cfm'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blogs.zdnet.com/hardware/?p=6655'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.ironkey.com/usb-flash-drive-flaw-exposed'}]
CVE State: PUBLISHED
Explain CVE-2010-0229
Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the cleartext drive contents by providing a key that was captured in a USB data stream at an earlier time.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.verbatim.com/security/security-update.cfm'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.ironkey.com/usb-flash-drive-flaw-exposed'}]
CVE State: PUBLISHED
Explain CVE-2010-0230
SUSE Linux Enterprise 10 SP3 (SLE10-SP3) and openSUSE 11.2 configures postfix to listen on all network interfaces, which might allow remote attackers to bypass intended access restrictions.
Affected Products: n/a
References: [{'name': 'SUSE-SR:2010:001', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html'}, {'name': 'SUSE-SA:2010:011', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00004.html'}]
CVE State: PUBLISHED
Explain CVE-2010-0231
The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not use a sufficient source of entropy, which allows remote attackers to obtain access to files and other SMB resources via a large number of authentication requests, related to server-generated challenges, certain "duplicate values," and spoofing of an authentication token, aka "SMB NTLM Authentication Lack of Entropy Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:7751', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7751'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}, {'name': 'MS10-012', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-012'}]
CVE State: PUBLISHED
Explain CVE-2010-0232
The kernel in Microsoft Windows NT 3.1 through Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges by crafting a VDM_TIB data structure in the Thread Environment Block (TEB), and then calling the NtVdmControl function to start the Windows Virtual DOS Machine (aka NTVDM) subsystem, leading to improperly handled exceptions involving the #GP trap handler (nt!KiTrap0D), aka "Windows Kernel Exception Handler Vulnerability."
Affected Products: n/a
References: [{'name': '[dailydave] 20100119 We hold these axioms to be self evident', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.immunitysec.com/pipermail/dailydave/2010-January/006000.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lock.cmpxchg8b.com/c0af0967d904cef2ad4db766a00bc6af/KiTrap0D.zip'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.technet.com/msrc/archive/2010/01/20/security-advisory-979682-released.aspx'}, {'name': 'MS10-015', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-015'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.microsoft.com/technet/security/advisory/979682.mspx'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}, {'name': '1023471', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023471'}, {'name': '20100119 Microsoft Windows NT #GP Trap Handler Allows Users to Switch Kernel Stack', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2010/Jan/341'}, {'name': 'ADV-2010-0179', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0179'}, {'name': '37864', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37864'}, {'name': '38265', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38265'}, {'name': '20100119 Microsoft Windows NT #GP Trap Handler Allows Users to Switch Kernel Stack', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509106/100/0/threaded'}, {'name': 'ms-win-gptrap-privilege-escalation(55742)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55742'}, {'name': 'oval:org.mitre.oval:def:8344', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8344'}]
CVE State: PUBLISHED
Explain CVE-2010-0233
Double free vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows local users to gain privileges via a crafted application, aka "Windows Kernel Double Free Vulnerability."
Affected Products: n/a
References: [{'name': 'MS10-015', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-015'}, {'name': 'oval:org.mitre.oval:def:8392', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8392'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}]
CVE State: PUBLISHED
Explain CVE-2010-0234
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 does not properly validate a registry-key argument to an unspecified system call, which allows local users to cause a denial of service (reboot) via a crafted application, aka "Windows Kernel Null Pointer Vulnerability."
Affected Products: n/a
References: [{'name': '39374', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39374'}, {'name': 'oval:org.mitre.oval:def:6814', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6814'}, {'name': 'MS10-021', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-021'}, {'name': 'TA10-103A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-103A.html'}, {'name': '39373', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39373'}, {'name': '1023850', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023850'}]
CVE State: PUBLISHED
Explain CVE-2010-0235
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Vista Gold does not perform the expected validation before creating a symbolic link, which allows local users to cause a denial of service (reboot) via a crafted application, aka "Windows Kernel Symbolic Link Value Vulnerability."
Affected Products: n/a
References: [{'name': 'MS10-021', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-021'}, {'name': 'oval:org.mitre.oval:def:7509', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7509'}, {'name': 'TA10-103A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-103A.html'}, {'name': '39373', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39373'}, {'name': '1023850', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023850'}]
CVE State: PUBLISHED
Explain CVE-2010-0236
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Vista Gold does not properly allocate memory for the destination key associated with a symbolic-link registry key, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Allocation Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:7113', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7113'}, {'name': 'MS10-021', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-021'}, {'name': 'TA10-103A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-103A.html'}, {'name': '39373', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39373'}, {'name': '1023850', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023850'}]
CVE State: PUBLISHED
Explain CVE-2010-0237
The kernel in Microsoft Windows 2000 SP4 and XP SP2 and SP3 allows local users to gain privileges by creating a symbolic link from an untrusted registry hive to a trusted registry hive, aka "Windows Kernel Symbolic Link Creation Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:7130', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7130'}, {'name': 'MS10-021', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-021'}, {'name': 'TA10-103A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-103A.html'}, {'name': '39373', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39373'}, {'name': '1023850', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023850'}]
CVE State: PUBLISHED
Explain CVE-2010-0238
Unspecified vulnerability in registry-key validation in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Vista Gold allows local users to cause a denial of service (reboot) via a crafted application, aka "Windows Kernel Registry Key Vulnerability."
Affected Products: n/a
References: [{'name': 'MS10-021', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-021'}, {'name': 'TA10-103A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-103A.html'}, {'name': 'oval:org.mitre.oval:def:6793', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6793'}, {'name': '39373', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39373'}, {'name': '1023850', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023850'}]
CVE State: PUBLISHED
Explain CVE-2010-0239
The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when IPv6 is enabled, does not properly perform bounds checking on ICMPv6 Router Advertisement packets, which allows remote attackers to execute arbitrary code via crafted packets, aka "ICMPv6 Router Advertisement Vulnerability."
Affected Products: n/a
References: [{'name': 'MS10-009', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-009'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}, {'name': 'oval:org.mitre.oval:def:8478', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8478'}]
CVE State: PUBLISHED
Explain CVE-2010-0240
The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when a custom network driver is used, does not properly handle local fragmentation of Encapsulating Security Payload (ESP) over UDP packets, which allows remote attackers to execute arbitrary code via crafted packets, aka "Header MDL Fragmentation Vulnerability."
Affected Products: n/a
References: [{'name': 'MS10-009', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-009'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}, {'name': 'oval:org.mitre.oval:def:8400', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8400'}]
CVE State: PUBLISHED
Explain CVE-2010-0241
The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when IPv6 is enabled, does not properly perform bounds checking on ICMPv6 Route Information packets, which allows remote attackers to execute arbitrary code via crafted packets, aka "ICMPv6 Route Information Vulnerability."
Affected Products: n/a
References: [{'name': 'MS10-009', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-009'}, {'name': 'oval:org.mitre.oval:def:8516', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8516'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}]
CVE State: PUBLISHED
Explain CVE-2010-0242
The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 allows remote attackers to cause a denial of service (system hang) via crafted packets with malformed TCP selective acknowledgement (SACK) values, aka "TCP/IP Selective Acknowledgement Vulnerability."
Affected Products: n/a
References: [{'name': 'MS10-009', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-009'}, {'name': 'oval:org.mitre.oval:def:8449', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8449'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}]
CVE State: PUBLISHED
Explain CVE-2010-0243
Buffer overflow in MSO.DLL in Microsoft Office XP SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted Office document, aka "MSO.DLL Buffer Overflow."
Affected Products: n/a
References: [{'name': 'MS10-003', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-003'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}, {'name': 'oval:org.mitre.oval:def:8399', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8399'}]
CVE State: PUBLISHED
Explain CVE-2010-0244
Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-2530 and CVE-2009-2531.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:8186', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8186'}, {'name': 'MS10-002', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002'}, {'name': 'ie-deleted-obj-code-exec(55774)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55774'}]
CVE State: PUBLISHED
Explain CVE-2010-0245
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-3671, CVE-2009-3674, and CVE-2010-0246.
Affected Products: n/a
References: [{'name': 'ie-uninitialized-memory-code-exec(55775)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55775'}, {'name': 'oval:org.mitre.oval:def:8491', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8491'}, {'name': 'MS10-002', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002'}]
CVE State: PUBLISHED
Explain CVE-2010-0246
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-3671, CVE-2009-3674, and CVE-2010-0245.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:8378', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8378'}, {'name': 'ie-deleted-object-code-exec(55776)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55776'}, {'name': 'MS10-002', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002'}]
CVE State: PUBLISHED
Explain CVE-2010-0247
Microsoft Internet Explorer 5.01 SP4, 6, and 6 SP1 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:8506', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8506'}, {'name': 'ie-uninitialized-obj-code-exec(55777)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55777'}, {'name': 'MS10-002', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002'}]
CVE State: PUBLISHED
Explain CVE-2010-0248
Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Object Memory Corruption Vulnerability."
Affected Products: n/a
References: [{'name': 'ie-object-memory-code-exec(55778)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55778'}, {'name': 'oval:org.mitre.oval:def:8267', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8267'}, {'name': 'MS10-002', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002'}]
CVE State: PUBLISHED