Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2010-0603
The SIP implementation on the Cisco PGW 2200 Softswitch with software before 9.7(3)S10 allows remote attackers to cause a denial of service (device crash) via a malformed session attribute, aka Bug ID CSCsk40030.
Affected Products: n/a
References: [{'name': '40121', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/40121'}, {'name': '20100512 Multiple Vulnerabilities in Cisco PGW Softswitch', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c519.shtml'}]
CVE State: PUBLISHED
Explain CVE-2010-0604
Unspecified vulnerability in the SIP implementation on the Cisco PGW 2200 Softswitch with software before 9.7(3)S10 allows remote attackers to cause a denial of service (device crash) via unknown SIP traffic, as demonstrated by "SIP testing," aka Bug ID CSCsk38165.
Affected Products: n/a
References: [{'name': '40122', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/40122'}, {'name': '64686', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/64686'}, {'name': '20100512 Multiple Vulnerabilities in Cisco PGW Softswitch', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c519.shtml'}]
CVE State: PUBLISHED
Explain CVE-2010-0605
SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input parameter.
Affected Products: n/a
References: [{'name': '11380', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11380'}, {'name': '38166', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38166'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/osTicket-1.6-RC5-SQLi.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://osticket.com/forums/project.php?issueid=176'}, {'name': '38515', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38515'}]
CVE State: PUBLISHED
Explain CVE-2010-0606
Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.
Affected Products: n/a
References: [{'name': '38166', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38166'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://osticket.com/forums/project.php?issueid=176'}, {'name': '38515', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38515'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/osTicket-1.6-RC5-ReflectedXSS.pdf'}]
CVE State: PUBLISHED
Explain CVE-2010-0607
Cross-site scripting (XSS) vulnerability in Forms/status_statistics_1 in the Sterlite SAM300 AX Router allows remote attackers to inject arbitrary web script or HTML via the Stat_Radio parameter.
Affected Products: n/a
References: [{'name': '38463', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38463'}, {'name': '62211', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62211'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/sterlite-xss.txt'}, {'name': '20100204 Sterlite SAM300AX ADSL router - Cross Site', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=126531284626756&w=2'}]
CVE State: PUBLISHED
Explain CVE-2010-0608
SQL injection vulnerability in index.php in NovaBoard 1.1.2 allows remote attackers to execute arbitrary SQL commands via the forums[] parameter in a search action.
Affected Products: n/a
References: [{'name': '38368', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38368'}, {'name': '37988', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37988'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1001-exploits/novaboard112-sql.txt'}, {'name': '11278', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11278'}, {'name': '62002', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/62002'}]
CVE State: PUBLISHED
Explain CVE-2010-0609
SQL injection vulnerability in header.php in NovaBoard 1.1.2 allows remote attackers to execute arbitrary SQL commands via the nova_name cookie parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '38368', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38368'}, {'name': '62003', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/62003'}]
CVE State: PUBLISHED
Explain CVE-2010-0610
Multiple SQL injection vulnerabilities in the Photoblog (com_photoblog) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the blog parameter in an images action to index.php.  NOTE: a separate vector for the id parameter to detail.php may also exist.
Affected Products: n/a
References: [{'name': '38136', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38136'}, {'name': 'photoblog-blog-sql-injection(56135)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56135'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/joomlaphotoblog-bsql.txt'}, {'name': '11337', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11337'}]
CVE State: PUBLISHED
Explain CVE-2010-0611
Multiple SQL injection vulnerabilities in adminlogin.php in Baal Systems 3.8 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/baalsystems-sql.txt'}, {'name': 'baalsystems-adminlogin-sql-injection(56147)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56147'}, {'name': '11346', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11346'}, {'name': '38139', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38139'}]
CVE State: PUBLISHED
Explain CVE-2010-0612
Unspecified vulnerability in DocumentManager before 4.0 has unknown impact and attack vectors, related to file rights.
Affected Products: n/a
References: [{'name': '62032', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/62032'}, {'name': '38441', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38441'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://freshmeat.net/projects/dmanager/releases/311735'}]
CVE State: PUBLISHED
Explain CVE-2010-0613
Directory traversal vulnerability in viewfile.php in ARWScripts Fonts Script allows remote attackers to read arbitrary local files via directory traversal sequences in a base64-encoded f parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '38518', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38518'}, {'name': '38709', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38709'}]
CVE State: PUBLISHED
Explain CVE-2010-0614
SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the (1) question action, and possibly the (2) sub_par or (3) num_quest actions.
Affected Products: n/a
References: [{'name': '62177', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/62177'}, {'name': '38478', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38478'}, {'name': '38116', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38116'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/corelan-10-008-evalmsi.txt'}, {'name': 'evalsmsi-ajax-sql-injection(56152)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56152'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-008-evalmsi-2-1-03-multiple-vulnerabilities/'}, {'name': '20100204 CORELAN-10-008 - Multiple vulnerabilities found in evalmsi 2.1.03', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509370/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2010-0615
Cross-site scripting (XSS) vulnerability in assess.php in evalSMSI 2.1.03 allows remote attackers to inject arbitrary web script or HTML via the reports comment box in a continue_assess action.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '62178', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/62178'}, {'name': 'evalsmsi-comment-xss(56154)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56154'}, {'name': '38478', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38478'}, {'name': '38116', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38116'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/corelan-10-008-evalmsi.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-008-evalmsi-2-1-03-multiple-vulnerabilities/'}, {'name': '20100204 CORELAN-10-008 - Multiple vulnerabilities found in evalmsi 2.1.03', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509370/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2010-0616
evalSMSI 2.1.03 stores passwords in cleartext in the database, which allows attackers with database access to gain privileges.  NOTE: remote attack vectors are possible by leveraging a separate SQL injection vulnerability.
Affected Products: n/a
References: [{'name': '38478', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38478'}, {'name': '38116', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38116'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/corelan-10-008-evalmsi.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-008-evalmsi-2-1-03-multiple-vulnerabilities/'}, {'name': '62180', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/62180'}, {'name': '20100204 CORELAN-10-008 - Multiple vulnerabilities found in evalmsi 2.1.03', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509370/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2010-0617
Cross-site scripting (XSS) vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to inject arbitrary web script or HTML via the return parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '62179', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/62179'}, {'name': '38478', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38478'}, {'name': 'evalsmsi-ajax-xss(56157)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56157'}]
CVE State: PUBLISHED
Explain CVE-2010-0618
The flood-protection feature in the base, IPDS DLE, Forms DLE, Barcode DLE, Prescribe DLE, and Printcryption DLE components on certain Lexmark laser and inkjet printers and MarkNet devices allows remote attackers to cause a denial of service (TCP outage) by making many passive FTP connections and then aborting these connections.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=11&Itemid=11'}, {'name': '38906', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38906'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.lexmark.com/index?page=content&id=TE85&locale=EN&userlocale=EN_US'}, {'name': '39056', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39056'}, {'name': '20100322 {PRL} Lexmark Multiple Laser printer FTP Remote Denial of Services', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510285/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2010-0619
Stack-based buffer overflow in the base, IPDS DLE, Forms DLE, Barcode DLE, Prescribe DLE, and Printcryption DLE components on certain Lexmark laser printers and multi-function printers allows remote attackers to execute arbitrary code or cause a denial of service (device hang) via a long argument to a PJL INQUIRE command.
Affected Products: n/a
References: [{'name': '20100322 {PRL} Lexmark Multiple Laser Printer Remote Stack Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510251/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.lexmark.com/index?page=content&id=TE84&locale=EN&userlocale=EN_US'}, {'name': '38901', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38901'}]
CVE State: PUBLISHED
Explain CVE-2010-0620
Directory traversal vulnerability in the SSL Service in EMC HomeBase Server 6.2.x before 6.2.3 and 6.3.x before 6.3.2 allows remote attackers to overwrite arbitrary files with any content, and consequently execute arbitrary code, via a .. (dot dot) in an unspecified parameter.
Affected Products: n/a
References: [{'name': '38380', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38380'}, {'name': '8230', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8230'}, {'name': '20100224 ESA-2010-003: EMC HomeBase Server Arbitrary File Upload Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509723/100/0/threaded'}, {'name': 'ADV-2010-0458', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0458'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-10-020/'}]
CVE State: PUBLISHED
Explain CVE-2010-0623
The futex_lock_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly manage a certain reference count, which allows local users to cause a denial of service (OOPS) via vectors involving an unmount of an ext3 filesystem.
Affected Products: n/a
References: [{'name': 'USN-914-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-914-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.33-rc7'}, {'name': 'ADV-2010-0638', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0638'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugzilla.kernel.org/show_bug.cgi?id=14256'}, {'name': 'MDVSA-2010:088', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:088'}, {'name': '38922', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38922'}, {'name': 'SUSE-SA:2010:018', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00006.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5ecb01cfdf96c5f465192bdb2a4fd4a61a24c6cc'}, {'name': '[oss-security] 20100211 Re: CVE request - kernel: futex: Handle user space corruption gracefully', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/02/11/2'}]
CVE State: PUBLISHED
Explain CVE-2010-0625
Stack-based buffer overflow in NWFTPD.nlm before 5.10.01 in the FTP server in Novell NetWare 5.1 through 6.5 SP8 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long (1) MKD, (2) RMD, (3) RNFR, or (4) DELE command.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1'}, {'name': 'ADV-2010-0742', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0742'}, {'name': '20100405 ZDI-10-062: Novell Netware NWFTPD RMD/RNFR/DELE Argument Parsing Remote Code Execution Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510557/100/0/threaded'}, {'name': '39151', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39151'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-10-062'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=569496'}, {'name': '20100329 {PRL} Novell Netware FTP Remote Stack Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510353/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=12&Itemid=12'}, {'name': '39041', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39041'}, {'name': '1023768', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023768'}]
CVE State: PUBLISHED
Explain CVE-2010-0628
The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in the SPNEGO GSS-API functionality in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2 and 1.8 before 1.8.1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid packet that triggers incorrect preparation of an error token.
Affected Products: n/a
References: [{'name': 'USN-916-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-916-1'}, {'name': '20100323 MITKRB5-SA-2010-002 denial of service in SPNEGO [CVE-2010-0628 VU#839413]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510281/100/0/threaded'}, {'name': '38904', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38904'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=566258'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt'}, {'name': '39023', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39023'}, {'name': 'VU#839413', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/839413'}]
CVE State: PUBLISHED
Explain CVE-2010-0629
Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of service (daemon crash) via a request from a kadmin client that sends an invalid API version number.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://krbdev.mit.edu/rt/Ticket/Display.html?id=5998'}, {'name': 'DSA-2031', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2010/dsa-2031'}, {'name': 'ADV-2010-0876', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0876'}, {'name': '39247', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39247'}, {'name': '1023821', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023821'}, {'name': '39324', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39324'}, {'name': '39367', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39367'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt'}, {'name': 'SUSE-SR:2010:009', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html'}, {'name': '39290', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39290'}, {'name': 'FEDORA-2010-6108', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038556.html'}, {'name': 'RHSA-2010:0343', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0343.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567052'}, {'name': 'USN-924-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-924-1'}, {'name': 'oval:org.mitre.oval:def:9489', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9489'}, {'name': '39264', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39264'}, {'name': 'MDVSA-2010:071', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:071'}, {'name': '20100406 MITKRB5-SA-2010-003 [CVE-2010-0629] denial of service in kadmind in older krb5 releases', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510566/100/0/threaded'}, {'name': '39315', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39315'}]
CVE State: PUBLISHED
Explain CVE-2010-0630
SQL injection vulnerability in viewjokes.php in Evernew Free Joke Script 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/evernewfjs-sql.txt'}, {'name': '11306', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11306'}, {'name': '38020', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38020'}, {'name': 'freejokescript-viewjokes-sql-injection(56043)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56043'}, {'name': '35434', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35434'}]
CVE State: PUBLISHED
Explain CVE-2010-0631
Multiple SQL injection vulnerabilities in index.php in Eicra Car Rental-Script, when the plugin_id parameter is 4, allow remote attackers to execute arbitrary SQL commands via the (1) users (username) and (2) passwords parameters.
Affected Products: n/a
References: [{'name': '38389', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38389'}, {'name': '11323', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11323'}]
CVE State: PUBLISHED
Explain CVE-2010-0632
SQL injection vulnerability in the Parkview Consultants SimpleFAQ (com_simplefaq) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a display action to index.php.
Affected Products: n/a
References: [{'name': '11294', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11294'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1001-exploits/joomlasimplefaq-sql.txt'}, {'name': 'simplefaq-catid-sql-injection(56028)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56028'}, {'name': '38015', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38015'}]
CVE State: PUBLISHED
Explain CVE-2010-0633
Unspecified vulnerability in Citrix XenServer 5.0 Update 3 and earlier, and 5.5, allows local users to bypass authentication and execute unspecified Xen API (XAPI) calls via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.citrix.com/article/CTX123456'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.citrix.com/article/CTX123193'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.citrix.com/article/CTX123460'}, {'name': '38431', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38431'}, {'name': 'ADV-2010-0290', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0290'}, {'name': '1023530', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023530'}, {'name': '38052', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38052'}]
CVE State: PUBLISHED
Explain CVE-2010-0634
Unspecified vulnerability in Fast Lexical Analyzer Generator (flex) before 2.5.35 has unknown impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://freshmeat.net/projects/flex/releases/311661'}, {'name': '62029', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62029'}]
CVE State: PUBLISHED
Explain CVE-2010-0635
SQL injection vulnerability in the plgSearchEventsearch::onSearch method in eventsearch.php in the JEvents Search plugin 1.5 through 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '38050', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38050'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.jevents.net/forum/viewtopic.php?f=17&t=3910#p15526'}, {'name': '38404', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38404'}]
CVE State: PUBLISHED
Explain CVE-2010-0636
Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to inject arbitrary web script or HTML via the (1) tab parameter to users.php and the PATH_INFO to (2) day.php, (3) month.php, and (4) week.php.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://webcalendar.cvs.sourceforge.net/viewvc/webcalendar/webcalendar/ChangeLog?pathrev=REL_1_2'}, {'name': '38222', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38222'}, {'name': '38053', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38053'}, {'tags': ['x_refsource_MISC'], 'url': 'http://holisticinfosec.org/content/view/133/45/'}]
CVE State: PUBLISHED
Explain CVE-2010-0637
Multiple cross-site request forgery (CSRF) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to hijack the authentication of administrators for requests that (1) delete an event or (2) ban an IP address from posting via unknown vectors.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://webcalendar.cvs.sourceforge.net/viewvc/webcalendar/webcalendar/ChangeLog?pathrev=REL_1_2'}, {'name': '38222', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38222'}, {'tags': ['x_refsource_MISC'], 'url': 'http://holisticinfosec.org/content/view/133/45/'}]
CVE State: PUBLISHED
Explain CVE-2010-0638
Cross-site request forgery (CSRF) vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '38222', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38222'}]
CVE State: PUBLISHED
Explain CVE-2010-0639
The htcpHandleTstRequest function in htcp.c in Squid 2.x before 2.6.STABLE24 and 2.7 before 2.7.STABLE8, and htcp.cc in 3.0 before 3.0.STABLE24, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets to the HTCP port.
Affected Products: n/a
References: [{'name': 'FEDORA-2010-2434', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037159.html'}, {'name': '62297', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62297'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squid-cache.org/Advisories/SQUID-2010_2.txt'}, {'name': 'ADV-2010-0371', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0371'}, {'name': 'FEDORA-2010-3064', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035961.html'}, {'name': 'ADV-2010-0603', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0603'}, {'name': '38812', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38812'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.squid-cache.org/Versions/v3/3.0/changesets/3.0-ADV-2010_2.patch'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.squid-cache.org/show_bug.cgi?id=2858'}, {'name': '38212', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38212'}, {'name': '1023587', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023587'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.squid-cache.org/Versions/v2/2.7/changesets/12600.patch'}]
CVE State: PUBLISHED
Explain CVE-2010-0640
Cross-site scripting (XSS) vulnerability in CA eHealth Performance Manager 6.0.x through 6.2.x, when malicious HTML detection is disabled, allows remote attackers to inject arbitrary web script or HTML via a crafted request.
Affected Products: n/a
References: [{'name': '38376', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38376'}, {'name': '20100223 CA20100223-01: Security Notice for CA eHealth Performance Manager', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2010/Feb/415'}, {'name': '20100223 CA20100223-01: Security Notice for CA eHealth Performance Manager', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509714/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2010-0641
Cross-site scripting (XSS) vulnerability in webline/html/admin/wcs/LoginPage.jhtml in Cisco Collaboration Server (CCS) 5 allows remote attackers to inject arbitrary web script or HTML via the dest parameter.
Affected Products: n/a
References: [{'name': '38201', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38201'}, {'name': '11403', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11403'}, {'name': 'ccs-loginpage-xss(56220)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56220'}]
CVE State: PUBLISHED
Explain CVE-2010-0642
Cisco Collaboration Server (CCS) 5 allows remote attackers to read the source code of JHTML files via URL encoded characters in the filename extension, as demonstrated by (1) changing .jhtml to %2Ejhtml, (2) changing .jhtml to .jhtm%6C, (3) appending %00 after .jhtml, and (4) appending %c0%80 after .jhtml, related to the (a) doc/docindex.jhtml, (b) browserId/wizardForm.jhtml, (c) webline/html/forms/callback.jhtml, (d) webline/html/forms/callbackICM.jhtml, (e) webline/html/agent/AgentFrame.jhtml, (f) webline/html/agent/default/badlogin.jhtml, (g) callme/callForm.jhtml, (h) webline/html/multichatui/nowDefunctWindow.jhtml, (i) browserId/wizard.jhtml, (j) admin/CiscoAdmin.jhtml, (k) msccallme/mscCallForm.jhtml, and (l) webline/html/admin/wcs/LoginPage.jhtml components.
Affected Products: n/a
References: [{'name': 'ccs-files-information-disclosure(56221)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56221'}, {'name': '11403', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11403'}, {'name': '38202', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38202'}]
CVE State: PUBLISHED
Explain CVE-2010-0643
Google Chrome before 4.0.249.89 attempts to make direct connections to web sites when all configured proxy servers are unavailable, which allows remote HTTP servers to obtain potentially sensitive information about the identity of a client user via standard HTTP logging, as demonstrated by a proxy server that was configured for the purpose of anonymity.
Affected Products: n/a
References: [{'name': 'googlechrome-fallback-info-disc(56212)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56212'}, {'name': '38177', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38177'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/chromium/issues/detail?id=12303'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs'}, {'name': '1023583', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023583'}, {'name': 'ADV-2010-0361', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0361'}, {'name': '62315', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/62315'}, {'name': 'oval:org.mitre.oval:def:14500', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14500'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html'}, {'name': '38545', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38545'}]
CVE State: PUBLISHED
Explain CVE-2010-0644
Google Chrome before 4.0.249.89, when a SOCKS 5 proxy server is configured, sends DNS queries directly, which allows remote DNS servers to obtain potentially sensitive information about the identity of a client user via request logging, as demonstrated by a proxy server that was configured for the purpose of anonymity.
Affected Products: n/a
References: [{'name': '38177', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38177'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/chromium/issues/detail?id=29914'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs'}, {'name': '1023583', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023583'}, {'name': 'ADV-2010-0361', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0361'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html'}, {'name': 'oval:org.mitre.oval:def:13926', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13926'}, {'name': '38545', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38545'}]
CVE State: PUBLISHED
Explain CVE-2010-0645
Multiple integer overflows in factory.cc in Google V8 before r3560, as used in Google Chrome before 4.0.249.89, allow remote attackers to execute arbitrary code in the Chrome sandbox via crafted use of JavaScript arrays.
Affected Products: n/a
References: [{'name': 'googlechrome-v8engine-code-exec(56213)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56213'}, {'name': '38177', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38177'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/v8/source/detail?r=3560'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs'}, {'name': '1023583', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023583'}, {'name': 'ADV-2010-0361', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0361'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/chromium/issues/detail?id=31009'}, {'name': '62316', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/62316'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html'}, {'name': 'oval:org.mitre.oval:def:14508', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14508'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://codereview.chromium.org/525064'}, {'name': '38545', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38545'}]
CVE State: PUBLISHED
Explain CVE-2010-0646
Multiple integer signedness errors in factory.cc in Google V8 before r3560, as used in Google Chrome before 4.0.249.89, allow remote attackers to execute arbitrary code in the Chrome sandbox via crafted use of JavaScript arrays.
Affected Products: n/a
References: [{'name': 'googlechrome-v8engine-code-exec(56213)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56213'}, {'name': 'oval:org.mitre.oval:def:14222', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14222'}, {'name': '38177', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38177'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/v8/source/detail?r=3560'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs'}, {'name': '1023583', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023583'}, {'name': 'ADV-2010-0361', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0361'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/chromium/issues/detail?id=31009'}, {'name': '62316', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/62316'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://codereview.chromium.org/525064'}, {'name': '38545', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38545'}]
CVE State: PUBLISHED
Explain CVE-2010-0647
WebKit before r53525, as used in Google Chrome before 4.0.249.89, allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed RUBY element, as demonstrated by a <ruby>><table><rt> sequence.
Affected Products: n/a
References: [{'name': 'MDVSA-2011:039', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:039'}, {'name': 'oval:org.mitre.oval:def:14094', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14094'}, {'name': '38177', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38177'}, {'name': '62317', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/62317'}, {'name': 'ADV-2010-2722', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/2722'}, {'name': '43068', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43068'}, {'name': 'USN-1006-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1006-1'}, {'name': '41856', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/41856'}, {'name': 'ADV-2011-0212', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0212'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs'}, {'name': 'googlechrome-ruby-tags-code-exec(56214)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56214'}, {'name': '1023583', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023583'}, {'name': 'ADV-2010-0361', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0361'}, {'name': 'SUSE-SR:2011:002', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.webkit.org/show_bug.cgi?id=33266'}, {'name': 'ADV-2011-0552', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0552'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.webkit.org/changeset/53525'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/chromium/issues/detail?id=31692'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html'}, {'name': '38545', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38545'}]
CVE State: PUBLISHED
Explain CVE-2010-0648
Mozilla Firefox, possibly before 3.6, allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value, related to an IFRAME element.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://code.google.com/p/chromium/issues/detail?id=32309'}, {'tags': ['x_refsource_MISC'], 'url': 'http://nomoreroot.blogspot.com/2010/01/little-bug-in-safari-and-google-chrome.html'}, {'name': 'oval:org.mitre.oval:def:12665', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12665'}, {'name': 'FEDORA-2010-8360', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html'}, {'name': 'FEDORA-2010-8379', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041432.html'}, {'name': 'FEDORA-2010-8423', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041436.html'}]
CVE State: PUBLISHED
Explain CVE-2010-0649
Integer overflow in the CrossCallParamsEx::CreateFromBuffer function in sandbox/src/crosscall_server.cc in Google Chrome before 4.0.249.89 allows attackers to leverage renderer access to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a malformed message, related to deserializing of sandbox messages.
Affected Products: n/a
References: [{'name': '38177', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38177'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/chromium/issues/detail?id=32915'}, {'name': '62320', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/62320'}, {'name': 'oval:org.mitre.oval:def:14256', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14256'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs'}, {'name': 'googlechrome-sandbox-code-exec(56217)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56217'}, {'name': '1023583', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023583'}, {'name': 'ADV-2010-0361', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0361'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html'}, {'name': '38545', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38545'}]
CVE State: PUBLISHED
Explain CVE-2010-0650
WebKit, as used in Google Chrome before 4.0.249.78 and Apple Safari, allows remote attackers to bypass intended restrictions on popup windows via crafted use of a mouse click event.
Affected Products: n/a
References: [{'name': 'MDVSA-2011:039', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:039'}, {'name': '38373', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38373'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html'}, {'name': 'ADV-2010-2722', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/2722'}, {'name': '43068', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43068'}, {'name': 'USN-1006-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1006-1'}, {'name': '41856', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/41856'}, {'name': 'ADV-2011-0212', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0212'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/chromium/issues/detail?id=3275'}, {'name': 'oval:org.mitre.oval:def:13791', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13791'}, {'name': '1023506', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023506'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs'}, {'name': 'SUSE-SR:2011:002', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.webkit.org/show_bug.cgi?id=21501'}, {'name': 'ADV-2011-0552', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0552'}]
CVE State: PUBLISHED