Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2010-1122
Unspecified vulnerability in Mozilla Firefox 3.5.x through 3.5.8 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly have unknown other impact via vectors that might involve compressed data, a different vulnerability than CVE-2010-1028.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=552216'}, {'name': 'oval:org.mitre.oval:def:12448', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12448'}, {'name': 'MDVSA-2010:070', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:070'}]
CVE State: PUBLISHED
Explain CVE-2010-1123
Chip Salzenberg Deliver does not properly associate a lockfile with the user who created the file, which allows local users to cause a denial of service (blockage of incoming e-mail) by creating lockfiles for arbitrary mailboxes.
Affected Products: n/a
References: [{'name': 'deliver-lockfile-dos(57558)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/57558'}, {'name': '20100324 Multiple vulnerabilities in Deliver', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510306/100/0/threaded'}, {'name': '38924', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38924'}]
CVE State: PUBLISHED
Explain CVE-2010-1124
bos.rte.libc 5.3.9.4 on IBM AIX 5.3 does not properly support reading a certain address field after a successful getaddrinfo function call, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors, as demonstrated by IBM DB2 crashes on "systems with databases cataloged with alternate servers using IP addresses."
Affected Products: n/a
References: [{'name': 'IZ66710', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=isg1IZ66710'}, {'name': '38964', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38964'}]
CVE State: PUBLISHED
Explain CVE-2010-1126
The JavaScript implementation in WebKit allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the focus method.
Affected Products: n/a
References: [{'name': '43068', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43068'}, {'name': 'ADV-2011-0212', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0212'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=552255'}, {'name': 'SUSE-SR:2011:002', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html'}, {'name': "20100313 ...because you can't get enough of clickjacking", 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510070/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2010-1127
Microsoft Internet Explorer 6 and 7 does not initialize certain data structures during execution of the createElement method, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code, as demonstrated by setting the (1) outerHTML or (2) value property of an object returned by createElement.
Affected Products: n/a
References: [{'name': '20100126 Microsoft IE 6&7 Crash Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2010-01/0237.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securityreason.com/exploitalert/7731'}, {'name': '20100128 Re: Microsoft IE 6&7 Crash Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2010-01/0278.html'}]
CVE State: PUBLISHED
Explain CVE-2010-1128
The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.
Affected Products: n/a
References: [{'name': 'ADV-2010-0479', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0479'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/releases/5_2_13.php'}, {'name': 'RHSA-2010:0919', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0919.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/ChangeLog-5.php'}, {'name': '38708', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38708'}, {'name': '38430', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38430'}, {'name': '42410', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42410'}, {'name': 'ADV-2010-3081', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/3081'}]
CVE State: PUBLISHED
Explain CVE-2010-1129
The safe_mode implementation in PHP before 5.2.13 does not properly handle directory pathnames that lack a trailing / (slash) character, which allows context-dependent attackers to bypass intended access restrictions via vectors related to use of the tempnam function.
Affected Products: n/a
References: [{'name': 'SSRT100018', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083'}, {'name': 'ADV-2010-0479', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0479'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/releases/5_2_13.php'}, {'name': 'HPSBMA02554', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083'}, {'name': '40551', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/40551'}, {'name': 'APPLE-SA-2010-08-24-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/ChangeLog-5.php'}, {'name': '38708', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38708'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT4312'}, {'name': '1023661', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023661'}, {'name': 'ADV-2010-1796', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1796'}, {'name': '38431', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38431'}]
CVE State: PUBLISHED
Explain CVE-2010-1130
session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/session/session.c?r1=293036&r2=294272'}, {'name': 'ADV-2010-0479', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0479'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/releases/5_2_13.php'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/session/session.c?r1=293036&r2=294272'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/ChangeLog-5.php'}, {'name': '38708', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38708'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/session/session.c?view=log'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/session/session.c?view=log'}, {'name': '1023661', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023661'}, {'name': '20100211 PHP 5.2.12/5.3.1 session.save_path safe_mode and open_basedir bypass', 'tags': ['third-party-advisory', 'x_refsource_SREASONRES'], 'url': 'http://securityreason.com/achievement_securityalert/82'}, {'name': '7008', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/7008'}]
CVE State: PUBLISHED
Explain CVE-2010-1131
JavaScriptCore.dll, as used in Apple Safari 4.0.5 on Windows XP SP3, allows remote attackers to cause a denial of service (application crash) via an HTML document composed of many successive occurrences of the <object> substring.
Affected Products: n/a
References: [{'name': '38884', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38884'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/data/vulnerabilities/exploits/38884.php'}]
CVE State: PUBLISHED
Explain CVE-2010-1132
The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message.
Affected Products: n/a
References: [{'name': 'ADV-2010-0559', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0559'}, {'name': '20100307 Spamassassin Milter Plugin Remote Root', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html'}, {'name': 'ADV-2010-0683', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0683'}, {'name': '39265', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39265'}, {'name': 'ADV-2010-0837', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0837'}, {'name': '38578', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38578'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=572117'}, {'name': 'DSA-2021', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2010/dsa-2021'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://savannah.nongnu.org/bugs/?29136'}, {'name': '11662', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11662'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/573228'}, {'name': 'FEDORA-2010-5096', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038535.html'}, {'name': '1023691', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023691'}, {'name': '62809', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62809'}, {'name': 'spamassassin-expand-command-execution(56732)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56732'}, {'name': '38956', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38956'}, {'name': '38840', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38840'}, {'name': 'FEDORA-2010-5112', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038777.html'}, {'name': 'FEDORA-2010-5176', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038572.html'}]
CVE State: PUBLISHED
Explain CVE-2010-1133
Multiple SQL injection vulnerabilities in TikiWiki CMS/Groupware 4.x before 4.2 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to (1) tiki-searchindex.php and (2) tiki-searchresults.php.
Affected Products: n/a
References: [{'name': '38608', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38608'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases'}, {'name': '38896', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38896'}, {'name': '62800', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62800'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25435'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25424'}, {'name': 'tikiwiki-unknown-input-sql-injection(56769)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56769'}]
CVE State: PUBLISHED
Explain CVE-2010-1134
SQL injection vulnerability in the _find function in searchlib.php in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to execute arbitrary SQL commands via the $searchDate variable.
Affected Products: n/a
References: [{'name': '38608', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38608'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases'}, {'name': '62800', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62800'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25429'}, {'name': 'tikiwiki-unknown-input-sql-injection(56769)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56769'}, {'name': '38882', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38882'}]
CVE State: PUBLISHED
Explain CVE-2010-1135
The user_logout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse.
Affected Products: n/a
References: [{'name': '38608', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38608'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases'}, {'name': '38896', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38896'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25046'}, {'name': 'tikiwiki-userlogout-unspecified(56770)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56770'}]
CVE State: PUBLISHED
Explain CVE-2010-1136
The Standard Remember method in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to bypass access restrictions related to "persistent login," probably due to the generation of predictable cookies based on the IP address and User agent in userslib.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25196'}, {'name': '38608', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38608'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases'}, {'name': '62801', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62801'}, {'name': 'tikiwiki-standardmethod-unspecified(56771)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56771'}, {'tags': ['x_refsource_MISC'], 'url': 'http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/proposals/3.x/lib/userslib.php?r1=25196&r2=25195&pathrev=25196'}, {'name': '38882', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38882'}]
CVE State: PUBLISHED
Explain CVE-2010-1137
Cross-site scripting (XSS) vulnerability in WebAccess in VMware VirtualCenter 2.0.2 and 2.5 and VMware ESX 3.0.3 and 3.5, and the Server Console in VMware Server 1.0, allows remote attackers to inject arbitrary web script or HTML via the name of a virtual machine.
Affected Products: n/a
References: [{'name': '39037', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39037'}, {'name': 'GLSA-201209-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201209-25.xml'}, {'name': 'oval:org.mitre.oval:def:6863', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6863'}, {'name': '[security-announce] 20100329 VMSA-2010-0005 VMware products address vulnerabilities in WebAccess', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.vmware.com/pipermail/security-announce/2010/000086.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2010-0005.html'}, {'name': '1023769', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023769'}]
CVE State: PUBLISHED
Explain CVE-2010-1138
The virtual networking stack in VMware Workstation 7.0 before 7.0.1 build 227600, VMware Workstation 6.5.x before 6.5.4 build 246459 on Windows, VMware Player 3.0 before 3.0.1 build 227600, VMware Player 2.5.x before 2.5.4 build 246459 on Windows, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware Server 2.x, and VMware Fusion 3.0 before 3.0.1 build 232708 and 2.x before 2.0.7 build 246742 allows remote attackers to obtain sensitive information from memory on the host OS by examining received network packets, related to interaction between the guest OS and the host vmware-vmx process.
Affected Products: n/a
References: [{'name': 'GLSA-201209-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201209-25.xml'}, {'name': '39206', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39206'}, {'name': '[security-announce] 20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.vmware.com/pipermail/security-announce/2010/000090.html'}, {'name': '39203', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39203'}, {'name': '20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html'}, {'name': '1023836', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023836'}, {'name': '39395', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39395'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2010-0007.html'}, {'name': '39215', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39215'}, {'name': '63607', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/63607'}, {'name': '20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html'}]
CVE State: PUBLISHED
Explain CVE-2010-1139
Format string vulnerability in vmrun in VMware VIX API 1.6.x, VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Linux, and VMware Fusion 2.x before 2.0.7 build 246742, allows local users to gain privileges via format string specifiers in process metadata.
Affected Products: n/a
References: [{'name': 'GLSA-201209-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201209-25.xml'}, {'name': '39206', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39206'}, {'name': '[security-announce] 20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.vmware.com/pipermail/security-announce/2010/000090.html'}, {'name': '39407', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39407'}, {'name': '20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2010-0007.html'}, {'name': '63606', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/63606'}, {'name': '39201', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39201'}, {'name': '39215', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39215'}, {'name': '1023835', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023835'}, {'name': '20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html'}]
CVE State: PUBLISHED
Explain CVE-2010-1140
The USB service in VMware Workstation 7.0 before 7.0.1 build 227600 and VMware Player 3.0 before 3.0.1 build 227600 on Windows might allow host OS users to gain privileges by placing a Trojan horse program at an unspecified location on the host OS disk.
Affected Products: n/a
References: [{'name': 'GLSA-201209-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201209-25.xml'}, {'name': '39206', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39206'}, {'name': '[security-announce] 20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.vmware.com/pipermail/security-announce/2010/000090.html'}, {'name': '20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2010-0007.html'}, {'name': '39397', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39397'}, {'name': '1023834', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023834'}, {'name': '20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html'}]
CVE State: PUBLISHED
Explain CVE-2010-1141
VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x before 2.0.2 build 203138; VMware Fusion 2.x before 2.0.6 build 246742; VMware ESXi 3.5 and 4.0; and VMware ESX 2.5.5, 3.0.3, 3.5, and 4.0 does not properly access libraries, which allows user-assisted remote attackers to execute arbitrary code by tricking a Windows guest OS user into clicking on a file that is stored on a network share.
Affected Products: n/a
References: [{'name': 'GLSA-201209-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201209-25.xml'}, {'name': '39206', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39206'}, {'name': '[security-announce] 20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.vmware.com/pipermail/security-announce/2010/000090.html'}, {'name': '20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html'}, {'name': '1023833', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023833'}, {'name': '39198', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39198'}, {'name': '1023832', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023832'}, {'name': 'oval:org.mitre.oval:def:7020', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7020'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2010-0007.html'}, {'name': '20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html'}]
CVE State: PUBLISHED
Explain CVE-2010-1142
VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x before 2.0.2 build 203138; VMware Fusion 2.x before 2.0.6 build 246742; VMware ESXi 3.5 and 4.0; and VMware ESX 2.5.5, 3.0.3, 3.5, and 4.0 does not properly load VMware programs, which might allow Windows guest OS users to gain privileges by placing a Trojan horse program at an unspecified location on the guest OS disk.
Affected Products: n/a
References: [{'name': 'GLSA-201209-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201209-25.xml'}, {'name': '39206', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39206'}, {'name': '[security-announce] 20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.vmware.com/pipermail/security-announce/2010/000090.html'}, {'name': '39394', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39394'}, {'name': '20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.acrossecurity.com/aspr/ASPR-2010-04-12-2-PUB.txt'}, {'name': '1023833', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023833'}, {'name': '39198', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39198'}, {'name': '1023832', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023832'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2010-0007.html'}, {'name': '20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html'}]
CVE State: PUBLISHED
Explain CVE-2010-1143
Cross-site scripting (XSS) vulnerability in VMware View (formerly Virtual Desktop Manager or VDM) 3.1.x before 3.1.3 build 252693 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2010-0008.html'}, {'name': 'GLSA-201209-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201209-25.xml'}, {'name': '1023945', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023945'}, {'name': '[security-announce] 20100505 VMSA-2010-0008 VMware View 3.1.3 addresses an important cross-site scripting vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.vmware.com/pipermail/security-announce/2010/000092.html'}, {'name': 'oval:org.mitre.oval:def:16298', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16298'}, {'name': '39949', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39949'}]
CVE State: PUBLISHED
Explain CVE-2010-1146
The Linux kernel 2.6.33.2 and earlier, when a ReiserFS filesystem exists, does not restrict read or write access to the .reiserfs_priv directory, which allows local users to gain privileges by modifying (1) extended attributes or (2) ACLs, as demonstrated by deleting a file under .reiserfs_priv/xattrs/.
Affected Products: n/a
References: [{'name': '39316', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39316'}, {'name': '12130', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/12130'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=568041'}, {'name': '63601', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/63601'}, {'name': '39344', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39344'}, {'name': '[linux-kernel] 20100408 [PATCH #3] reiserfs: Fix permissions on .reiserfs_priv', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=linux-kernel&m=127076012022155&w=2'}, {'name': 'kernel-reiserfs-privilege-escalation(57782)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/57782'}]
CVE State: PUBLISHED
Explain CVE-2010-1147
Stack-based buffer overflow in Open Direct Connect Hub (aka Open DC Hub or OpenDCHub) 0.8.1 allows remote authenticated users to execute arbitrary code via a long MyINFO message.
Affected Products: n/a
References: [{'name': 'FEDORA-2010-6415', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-April/040380.html'}, {'name': 'ADV-2010-1044', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1044'}, {'name': '[oss-security] 20100403 CVE Request -- OpenDCHub v0.8.1 -- Stack overflow by handling a specially-crafted MyINFO message', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2010/04/03/1'}, {'name': 'FEDORA-2010-6478', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-April/040360.html'}, {'name': '39664', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39664'}, {'name': '20100331 OpenDcHub 0.8.1 Remote Code Execution Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510428'}, {'name': '[oss-security] 20100406 Re: CVE Request -- OpenDCHub v0.8.1 -- Stack overflow by handling a specially-crafted MyINFO message', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=127051570728944&w=2'}, {'name': 'ADV-2010-1023', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1023'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.indahax.com/exploits/opendchub-0-8-1-remote-code-execution-exploit#more-600'}, {'name': '39129', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39129'}, {'name': 'FEDORA-2010-6426', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-April/040421.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=576308'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=579206'}]
CVE State: PUBLISHED
Explain CVE-2010-1148
The cifs_create function in fs/cifs/dir.c in the Linux kernel 2.6.33.2 and earlier allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a NULL nameidata (aka nd) field in a POSIX file-creation request to a server that supports UNIX extensions.
Affected Products: n/a
References: [{'name': '[oss-security] 20100405 Re: CVE request: kernel: cifs: cifs_create() NULL pointer dereference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2010/04/06/2'}, {'name': '[linux-cifs-client] 20100402 [patch] skip posix open if nameidata is null', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.samba.org/archive/linux-cifs-client/2010-April/005746.html'}, {'name': 'linux-kernel-cifscreate-dos(57561)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/57561'}, {'name': '[linux-cifs-client] 20100404 [patch] skip posix open if nameidata is null', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.samba.org/archive/linux-cifs-client/2010-April/005757.html'}, {'name': '39186', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39186'}, {'tags': ['x_refsource_MISC'], 'url': 'http://xorl.wordpress.com/2010/04/05/linux-kernel-unix-extensions-cifs-null-pointer-dereference/'}, {'name': '39344', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39344'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=579445'}, {'name': '[oss-security] 20100405 Re: CVE request: kernel: cifs: cifs_create() NULL pointer dereference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=127045779122119&w=2'}, {'name': '[linux-cifs-client] 20100402 [patch] skip posix open if nameidata is null', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.samba.org/archive/linux-cifs-client/2010-April/005742.html'}, {'name': '[linux-cifs-client] 20100402 [patch] skip posix open if nameidata is null', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.samba.org/archive/linux-cifs-client/2010-April/005741.html'}, {'name': '[oss-security] 20100405 CVE request: kernel: cifs: cifs_create() NULL pointer dereference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=127045754521927&w=2'}]
CVE State: PUBLISHED
Explain CVE-2010-1149
probers/udisks-dm-export.c in udisks before 1.0.1 exports UDISKS_DM_TARGETS_PARAMS information to udev even for a crypt UDISKS_DM_TARGETS_TYPE, which allows local users to discover encryption keys by (1) running a certain udevadm command or (2) reading a certain file under /dev/.udev/db/.
Affected Products: n/a
References: [{'name': 'FEDORA-2010-6296', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039060.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=594261'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/bugs/556651'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.freedesktop.org/show_bug.cgi?id=27494'}, {'name': '39332', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39332'}, {'name': '39265', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39265'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=580005'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=576687'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/udisks/commit/?id=0fcc7cb3b66f23fac53ae08647aa0007a2bd56c4'}]
CVE State: PUBLISHED
Explain CVE-2010-1150
MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a "login CSRF" issue.
Affected Products: n/a
References: [{'name': 'ADV-2010-1055', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1055'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_0beta2/phase3/RELEASE-NOTES'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_15_3/phase3/RELEASE-NOTES'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.0beta2.patch.gz'}, {'name': '[oss-security] 20100407 Re: CVE Request: MediaWiki 1.15.3 -- Login CSRF', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/04/08/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.3.patch.gz'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.wikimedia.org/show_bug.cgi?id=23076'}, {'name': '[mediawiki-announce] 20100407 MediaWiki security update: 1.15.3 and 1.16.0beta2', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html'}, {'name': '[oss-security] 20100406 CVE Request: MediaWiki 1.15.3 -- Login CSRF', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=580418'}, {'name': 'DSA-2041', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2010/dsa-2041'}]
CVE State: PUBLISHED
Explain CVE-2010-1151
Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possibly modify data, via vectors related to improper interaction with an external helper application for validation of credentials.
Affected Products: n/a
References: [{'name': 'ADV-2010-0908', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0908'}, {'name': '39538', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39538'}, {'name': 'MDVSA-2010:081', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:081'}, {'name': 'FEDORA-2010-6359', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041340.html'}, {'name': '39823', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39823'}, {'name': 'FEDORA-2010-6323', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041326.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=578168'}, {'name': 'ADV-2010-1148', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1148'}]
CVE State: PUBLISHED
Explain CVE-2010-1152
memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excessive memory allocation.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '[oss-security] 20100408 Re: CVE request -- memcached', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=127075341110616&w=2'}, {'name': '39306', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39306'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://github.com/memcached/memcached/commit/d9cd01ede97f4145af9781d448c62a3318952719'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.sun.com/security/entry/input_validation_vulnerability_in_memcached'}, {'name': '[oss-security] 20100408 CVE request -- memcached', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=127074597129559&w=2'}, {'name': 'SUSE-SR:2010:013', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html'}, {'name': 'ADV-2011-0442', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0442'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://github.com/memcached/memcached/commit/75cc83685e103bc8ba380a57468c8f04413033f9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/memcached/issues/detail?id=102'}, {'name': '[oss-security] 20100408 Re: CVE request -- memcached', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=127075808518733&w=2'}, {'name': '1023839', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023839'}, {'name': 'SUSE-SR:2010:012', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html'}]
CVE State: PUBLISHED
Explain CVE-2010-1153
PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code via a URL in an input field associated with the className variable.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-008/'}, {'name': '[oss-security] 20100410 CVE request: typo3 remote command execution', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=127092306209177&w=2'}, {'name': '[oss-security] 20100412 Re: CVE request: typo3 remote command execution', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/04/12/1'}]
CVE State: PUBLISHED
Explain CVE-2010-1155
Irssi before 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate.
Affected Products: n/a
References: [{'name': '[oss-security] 20100412 Re: CVE request: irssi 0.8.15', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=127110132019166&w=2'}, {'name': '[oss-security] 20100413 Re: CVE request: irssi 0.8.15', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=127116251220784&w=2'}, {'name': 'ADV-2010-0856', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0856'}, {'name': 'ADV-2010-1110', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1110'}, {'name': 'irssi-hostname-mitm(57790)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/57790'}, {'name': 'ADV-2010-1107', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1107'}, {'name': 'ADV-2010-0987', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0987'}, {'name': 'SUSE-SR:2010:011', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html'}, {'name': '[oss-security] 20100413 Re: CVE request: irssi 0.8.15', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=127119240204394&w=2'}, {'name': '39620', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39620'}, {'name': '39365', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39365'}, {'name': 'USN-929-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-929-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://irssi.org/news'}, {'name': '[oss-security] 20100411 CVE request: irssi 0.8.15', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=127098845125270&w=2'}, {'name': 'SSA:2010-116-01', 'tags': ['vendor-advisory', 'x_refsource_SLACKWARE'], 'url': 'http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.497301'}, {'name': 'FEDORA-2010-6629', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041054.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://github.com/ensc/irssi-proxy/commit/85bbc05b21678e80423815d2ef1dfe26208491ab'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://irssi.org/news/ChangeLog'}, {'name': '39797', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39797'}]
CVE State: PUBLISHED
Explain CVE-2010-1158
Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=313565'}, {'name': '[oss-security] 20100414 Re: CVE Request -- perl v5.8.* -- stack overflow by processing certain regex (Gentoo BTS#313565 / RH BZ#580605)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/04/14/3'}, {'name': '[oss-security] 20100408 CVE Request -- perl v5.8.* -- stack overflow by processing certain regex (Gentoo BTS#313565 / RH BZ#580605)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/04/08/9'}, {'name': '55314', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55314'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=580605'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://perldoc.perl.org/perl5100delta.html'}]
CVE State: PUBLISHED
Explain CVE-2010-1159
Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) large length value in an EAPOL packet or (2) long EAPOL packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://pyrit.googlecode.com/svn/tags/opt/aircrackng_exploit.py'}, {'name': 'GLSA-201310-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201310-06.xml'}, {'name': '39150', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39150'}, {'name': '55053', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55053'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.aircrack-ng.org/trunk/ChangeLog'}]
CVE State: PUBLISHED