Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2010-0695
Cross-site scripting (XSS) vulnerability in pages/index.php in BASIC-CMS allows remote attackers to inject arbitrary web script or HTML via the nav_id parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/basiccms-sqlxss.txt'}, {'name': '38235', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38235'}]
CVE State: PUBLISHED
Explain CVE-2010-0696
Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter.
Affected Products: n/a
References: [{'name': '62331', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62331'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomlaworks.gr/content/view/77/34/'}, {'name': '11447', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11447'}, {'name': '38238', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38238'}, {'name': '38587', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38587'}]
CVE State: PUBLISHED
Explain CVE-2010-0697
Cross-site scripting (XSS) vulnerability in the iTweak Upload module 6.x-1.x before 6.x-1.2 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users, with create content and upload file permissions, to inject arbitrary web script or HTML via the file name of an uploaded file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/711074'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/711072'}, {'name': '38292', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38292'}, {'name': '62405', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62405'}, {'name': '38633', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38633'}, {'name': 'itweakupload-filenames-xss(56351)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56351'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/717214'}]
CVE State: PUBLISHED
Explain CVE-2010-0698
SQL injection vulnerability in backoffice/login.asp in Dynamicsoft WSC CMS 2.2 allows remote attackers to execute arbitrary SQL commands via the Password parameter.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '11507', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11507'}, {'name': 'wsccms-login-sql-injection(56406)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56406'}, {'name': '38698', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38698'}, {'name': '38335', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38335'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/wsccms-sql.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-0699
Cross-site scripting (XSS) vulnerability in index.php in VideoSearchScript Pro 3.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
Affected Products: n/a
References: [{'name': '38701', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38701'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/vss-xss.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-0700
Cross-site scripting (XSS) vulnerability in index.php in WampServer 2.0i allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Affected Products: n/a
References: [{'name': '62481', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62481'}, {'tags': ['x_refsource_MISC'], 'url': 'http://zeroscience.mk/en/vulnerabilities/ZSL-2010-4926.php'}, {'tags': ['x_refsource_MISC'], 'url': 'http://zeroscience.mk/codes/wamp_xss.txt'}, {'name': '38357', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38357'}, {'name': '38706', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38706'}, {'name': 'wampserver-index-xss(56417)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56417'}]
CVE State: PUBLISHED
Explain CVE-2010-0701
SQL injection vulnerability in ForceChangePassword.jsp in Newgen Software OmniDocs allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': '11393', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11393'}, {'name': '38304', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38304'}, {'name': '62403', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62403'}, {'name': '38527', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38527'}, {'name': 'omnidocs-forcechangepassword-sql-injection(56237)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56237'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/omnidocs-sql.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-0702
SQL injection vulnerability in cisco/services/PhonecDirectory.php in Fonality Trixbox 2.2.4 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
Affected Products: n/a
References: [{'name': '11508', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11508'}, {'name': 'trixbox-phonedirectory-sql-injection(56407)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56407'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/tribox-sql.txt'}, {'name': '38323', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38323'}]
CVE State: PUBLISHED
Explain CVE-2010-0703
Cross-site scripting (XSS) vulnerability in wa/auth in PortWise SSL VPN 4.6 allows remote attackers to inject arbitrary web script or HTML via the reloadFrame parameter.
Affected Products: n/a
References: [{'name': '38308', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38308'}, {'name': '38627', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38627'}, {'name': '20100217 Cross-Site Scriting on Portwise SSL VPN v4.6', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509584/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/PR09-04.txt'}, {'name': 'portwise-reloadframe-xss(56420)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56420'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-04'}, {'name': '62482', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62482'}]
CVE State: PUBLISHED
Explain CVE-2010-0704
Cross-site scripting (XSS) vulnerability in the Portlet Palette in IBM WebSphere Portal 6.0.1.5 wp6015_008_01 allows remote attackers to inject arbitrary web script or HTML via the search field.
Affected Products: n/a
References: [{'name': 'PM05829', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PM05829'}, {'name': '38574', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38574'}]
CVE State: PUBLISHED
Explain CVE-2010-0705
Aavmker4.sys in avast! 4.8 through 4.8.1368.0 and 5.0 before 5.0.418.0 running on Windows 2000 and XP does not properly validate input to IOCTL 0xb2d60030, which allows local users to cause a denial of service (system crash) or execute arbitrary code to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption.
Affected Products: n/a
References: [{'name': '38363', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38363'}, {'name': '62510', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62510'}, {'name': '38689', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38689'}, {'name': 'ADV-2010-0449', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0449'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://forum.avast.com/index.php?topic=55484.0'}, {'name': '20100223 [TKADV2010-003] avast! 4.8 and 5.0 aavmker4.sys Kernel Memory Corruption', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509710/100/0/threaded'}, {'name': '1023644', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023644'}, {'name': '38677', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38677'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.trapkit.de/advisories/TKADV2010-003.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-0706
Cross-site scripting (XSS) vulnerability in the login/prompt component in Subex Nikira Fraud Management System allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Affected Products: n/a
References: [{'name': '38564', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38564'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.packetstormsecurity.org/1002-exploits/nikara-xss.txt'}, {'name': 'nfms-message-xss(56393)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56393'}, {'name': '38311', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38311'}]
CVE State: PUBLISHED
Explain CVE-2010-0707
Cross-site request forgery (CSRF) vulnerability in add_user.php in Employee Timeclock Software 0.99 allows remote attackers to hijack the authentication of an administrator for requests that create new administrative users.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '38662', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38662'}, {'name': '11516', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11516'}, {'name': 'timeclock-adduser-csrf(56410)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56410'}, {'name': '62478', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62478'}]
CVE State: PUBLISHED
Explain CVE-2010-0708
Multiple unspecified vulnerabilities in (1) ns-slapd and (2) slapd.exe in Sun Directory Server Enterprise Edition 7.0, Sun Java System Directory Server 5.2, and Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 allow remote attackers to cause a denial of service (daemon crash) via a crafted LDAP search request.
Affected Products: n/a
References: [{'name': '1021788', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021788.1-1'}, {'name': '275711', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-275711-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-143884-01-1'}, {'name': 'jsds-nsslapd-slapd-dos(56603)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56603'}]
CVE State: PUBLISHED
Explain CVE-2010-0709
Multiple cross-site request forgery (CSRF) vulnerabilities in Limny 2.0 allow remote attackers to (1) hijack the authentication of users or administrators for requests that change the email address or password via the user action to index.php, and (2) hijack the authentication of the administrator for requests that create a new user via the admin/modules/user/new action to limny/index.php.
Affected Products: n/a
References: [{'name': '11478', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11478'}, {'name': 'limny-admin-csrf(56318)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56318'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.limny.org/'}, {'name': '38616', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38616'}, {'name': '11477', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11477'}, {'name': '62389', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62389'}]
CVE State: PUBLISHED
Explain CVE-2010-0710
SQL injection vulnerability in default.asp in ASPCode CMS 1.5.8, 2.0.0 Build 103, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the newsid parameter when the sec parameter is 26.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '62358', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62358'}, {'name': '38596', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38596'}]
CVE State: PUBLISHED
Explain CVE-2010-0711
Cross-site request forgery (CSRF) vulnerability in default.asp in ASPCode CMS 1.5.8, 2.0.0 Build 103, and possibly other versions, allows remote attackers to hijack the authentication of an administrator for requests that (1) delete users via the delete action in the ma2 parameter or (2) create administrators via the update action in the ma2 parameter.
Affected Products: n/a
References: [{'name': '62357', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62357'}, {'name': '38596', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38596'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/aspcodecms-xssxsrf.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-0712
Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote authenticated users to execute arbitrary SQL commands via the (1) severity, (2) state, (3) filter, (4) offset, and (5) count parameters.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://dev.zenoss.org/trac/changeset/15257'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-001-zenoss-getjsoneventsinfo-sql-injection/'}, {'name': '61804', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/61804'}, {'name': '37802', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37802'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zenoss.com/news/SQL-Injection-and-Cross-Site-Forgery-in-Zenoss-Core-Corrected.html'}, {'name': 'zenoss-getjsoneventsinfo-sql-injection(55670)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55670'}, {'name': '38195', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38195'}]
CVE State: PUBLISHED
Explain CVE-2010-0713
Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss 2.3.3, and other versions before 2.5, allow remote attackers to hijack the authentication of an administrator for (1) requests that reset user passwords via zport/dmd/ZenUsers/admin, and (2) requests that change user commands, which allows for remote execution of system commands via zport/dmd/userCommands/.
Affected Products: n/a
References: [{'name': '37843', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37843'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-002-zenoss-multiple-admin-csrf/'}, {'name': '61805', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/61805'}, {'name': '20100116 Zenoss Multiple Admin CSRF', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/508982/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zenoss.com/news/SQL-Injection-and-Cross-Site-Forgery-in-Zenoss-Core-Corrected.html'}, {'name': '38195', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38195'}]
CVE State: PUBLISHED
Explain CVE-2010-0714
Cross-site scripting (XSS) vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0, 8.0.0.2, 8.1, 8.1.1, and 8.1.1.1 for WebSphere Portal; allows remote attackers to inject arbitrary web script or HTML via the query string.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.hacktics.com/content/advisories/AdvIBM20100224.html'}, {'name': 'ibm-login-xss(56508)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56508'}, {'name': '1023660', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023660'}, {'name': '20100225 Hacktics Advisory Feb10: XSS in IBM WebSphere Portal & Lotus WCM', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509744/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21421469'}, {'name': 'PM03233', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg1PM03233'}, {'name': '38412', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38412'}]
CVE State: PUBLISHED
Explain CVE-2010-0715
Open redirect vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0, 8.0.0.2, 8.1, 8.1.1, and 8.1.1.1 for WebSphere Portal; allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the query string.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.hacktics.com/content/advisories/AdvIBM20100224.html'}, {'name': 'ibm-login-phishing(56602)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56602'}, {'name': '20100225 Hacktics Advisory Feb10: XSS in IBM WebSphere Portal & Lotus WCM', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509744/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21421469'}]
CVE State: PUBLISHED
Explain CVE-2010-0716
_layouts/Upload.aspx in the Documents module in Microsoft SharePoint before 2010 uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading TXT files, a related issue to CVE-2008-5026. NOTE: the vendor disputes the significance of this issue, because cross-domain isolation can be implemented when needed.
Affected Products: n/a
References: [{'name': 'sharepoint-aspx-xss(56597)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56597'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hacktics.com/content/advisories/AdvMS20100222.html'}, {'name': '20100222 Hacktics Advisory Feb10: Persistent XSS in Microsoft SharePoint Portal', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509683/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2010-0717
The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.
Affected Products: n/a
References: [{'name': 'moinmoin-cfgpackagepages-unspecified(56595)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56595'}, {'name': '[oss-security] 20100215 CVE Request -- MoinMoin -- 1.8.7', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/02/15/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.moinmo.in/moin/1.8/raw-file/1.8.7/docs/CHANGES'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://moinmo.in/MoinMoinRelease1.8'}, {'name': 'DSA-2014', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2010/dsa-2014'}, {'name': '38903', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38903'}, {'name': 'ADV-2010-0600', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0600'}]
CVE State: PUBLISHED
Explain CVE-2010-0718
Buffer overflow in Microsoft Windows Media Player 9 and 11.0.5721.5145 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted .mpg file.
Affected Products: n/a
References: [{'name': '11531', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11531'}, {'name': 'win-mediaplayer-mpg-bo(56435)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56435'}]
CVE State: PUBLISHED
Explain CVE-2010-0719
An unspecified API in Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, and Windows 7 does not validate arguments, which allows local users to cause a denial of service (system crash) via a crafted application.
Affected Products: n/a
References: [{'name': 'ms-win-api-dos(56591)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56591'}, {'name': '1023656', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023656'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.scmagazineus.com/malta-researchers-find-windows-bug-that-crashes-pcs/article/164439/'}, {'name': '62660', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62660'}]
CVE State: PUBLISHED
Explain CVE-2010-0720
SQL injection vulnerability in news.php in Erotik Auktionshaus allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/erotik-sql.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://4004securityproject.wordpress.com/2009/10/21/erotik-auktionshaus-sql-injection-news-php/'}, {'name': '62369', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/62369'}, {'name': '38614', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38614'}, {'name': 'erotikauktionshaus-news-sql-injection(56330)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56330'}, {'name': '11489', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11489'}]
CVE State: PUBLISHED
Explain CVE-2010-0721
SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '11488', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11488'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/auktionshausgelb-sql.txt'}, {'name': 'auktionshausgelb-news-sql-injection(56332)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56332'}]
CVE State: PUBLISHED
Explain CVE-2010-0722
SQL injection vulnerability in news.php in Php Auktion Pro allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': 'phpauktionpro-news-sql-injection(56478)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56478'}, {'tags': ['x_refsource_MISC'], 'url': 'http://4004securityproject.wordpress.com/2010/02/22/php-auktion-pro-sql-injection-news-php/'}, {'name': '38371', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38371'}, {'name': '11547', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11547'}, {'name': '38679', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38679'}]
CVE State: PUBLISHED
Explain CVE-2010-0723
SQL injection vulnerability in news.php in Ero Auktion 2.0 and 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/eroauktion2010-sql.txt'}, {'name': '11521', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11521'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/eroauktion20-sql.txt'}, {'name': 'eroauktion-news-sql-injection(56446)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56446'}, {'tags': ['x_refsource_MISC'], 'url': 'http://4004securityproject.wordpress.com/2010/02/21/ero-auktion-2010-sql-injection-news-php/'}, {'name': '11522', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11522'}, {'name': '38666', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38666'}, {'tags': ['x_refsource_MISC'], 'url': 'http://4004securityproject.wordpress.com/2010/02/21/ero-auktion-v-2-0-sql-injection-news-php/'}]
CVE State: PUBLISHED
Explain CVE-2010-0724
SQL injection vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': 'ADV-2010-0443', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0443'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/arabcart-sqlxss.txt'}, {'name': '11524', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11524'}, {'name': '38426', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38426'}]
CVE State: PUBLISHED
Explain CVE-2010-0725
Cross-site scripting (XSS) vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Affected Products: n/a
References: [{'name': 'ADV-2010-0443', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0443'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/arabcart-sqlxss.txt'}, {'name': '11524', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11524'}, {'name': '38426', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38426'}]
CVE State: PUBLISHED
Explain CVE-2010-0726
Cross-site scripting (XSS) vulnerability in the tb-send.rb (TrackBack transmission) plugin in tDiary 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly related to the (1) plugin_tb_url and (2) plugin_tb_excerpt parameters.
Affected Products: n/a
References: [{'name': '62562', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62562'}, {'name': 'JVN#73331060', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN73331060/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://tdiary.svn.sourceforge.net/viewvc/tdiary/branches/Stable-2_2/plugin/tb-send.rb?r1=3238&r2=3573'}, {'name': '38742', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38742'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.tdiary.org/20100225.html'}, {'name': '38413', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38413'}, {'name': 'JVNDB-2010-000005', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2010-000005'}]
CVE State: PUBLISHED
Explain CVE-2010-0727
The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this file's permissions.
Affected Products: n/a
References: [{'name': 'RHSA-2010:0330', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0330.html'}, {'name': '[oss-security] 20100312 CVE-2010-0727 kernel: gfs/gfs2 locking code DoS flaw', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/03/12/1'}, {'name': 'RHSA-2010:0380', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0380.html'}, {'name': '[linux-kernel] 20100311 [PATCH 3/3] GFS2: Skip check for mandatory locks when unlocking', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lkml.org/lkml/2010/3/11/269'}, {'name': 'oval:org.mitre.oval:def:11392', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11392'}, {'name': '1023809', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023809'}, {'name': 'MDVSA-2010:066', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:066'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v2.6/next/patch-v2.6.34-rc1-next-20100312.bz2'}, {'name': 'DSA-2053', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2010/dsa-2053'}, {'name': 'RHSA-2010:0521', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0521.html'}, {'name': '39830', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39830'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=570863'}]
CVE State: PUBLISHED
Explain CVE-2010-0728
smbd in Samba 3.3.11, 3.4.6, and 3.5.0, when libcap support is enabled, runs with the CAP_DAC_OVERRIDE capability, which allows remote authenticated users to bypass intended file permissions via standard filesystem operations with any client.
Affected Products: n/a
References: [{'name': '[samba-announce] 20100308 Security problem with Samba on Linux - affects 3.5.0, 3.4.6 and 3.3.11', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.samba.org/archive/samba-announce/2010/000211.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.samba.org/samba/security/CVE-2010-0728'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.samba.org/samba/history/samba-3.4.7.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.samba.org/show_bug.cgi?id=7222'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.samba.org/samba/history/samba-3.3.12.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.samba.org/samba/history/samba-3.5.1.html'}]
CVE State: PUBLISHED
Explain CVE-2010-0729
A certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 4 on the ia64 platform allows local users to use ptrace on an arbitrary process, and consequently gain privileges, via vectors related to a missing ptrace_check_attach call.
Affected Products: n/a
References: [{'name': '[oss-security] 20100312 CVE-2010-0729 kernel: ia64: ptrace: peek_or_poke requests miss ptrace_check_attach()', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/03/12/2'}, {'name': '38702', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38702'}, {'name': 'RHSA-2010:0394', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0394.html'}, {'name': 'oval:org.mitre.oval:def:8687', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8687'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=572007'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/css/P8/documents/100090459'}]
CVE State: PUBLISHED
Explain CVE-2010-0730
The MMIO instruction decoder in the Xen hypervisor in the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows guest OS users to cause a denial of service (32-bit guest OS crash) via vectors that trigger an unspecified instruction emulation.
Affected Products: n/a
References: [{'name': '[oss-security] 20100507 CVE-2010-0730 xen: emulator instruction decoding inconsistency', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/05/07/1'}, {'name': '39979', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39979'}, {'name': 'oval:org.mitre.oval:def:11430', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11430'}, {'name': '39649', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39649'}, {'name': '43315', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43315'}, {'name': 'RHSA-2010:0398', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0398.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0003.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/css/P8/documents/100088287'}, {'name': '20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/516397/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=572971'}]
CVE State: PUBLISHED
Explain CVE-2010-0731
The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number.
Affected Products: n/a
References: [{'name': 'RHSA-2010:0167', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0167.html'}, {'name': '39127', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39127'}, {'name': 'MDVSA-2010:089', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:089'}, {'name': '38959', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38959'}, {'name': 'ADV-2010-0713', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0713'}, {'name': 'oval:org.mitre.oval:def:9759', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9759'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=573028'}, {'name': 'SUSE-SR:2010:014', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html'}, {'name': 'ADV-2010-1054', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1054'}]
CVE State: PUBLISHED
Explain CVE-2010-0732
gdk/gdkwindow.c in GTK+ before 2.18.5, as used in gnome-screensaver before 2.28.1, performs implicit paints on windows of type GDK_WINDOW_FOREIGN, which triggers an X error in certain circumstances and consequently allows physically proximate attackers to bypass screen locking and access an unattended workstation by pressing the Enter key many times.
Affected Products: n/a
References: [{'name': '39317', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39317'}, {'name': '[oss-security] 20100212 CVE Request: gnome-screensaver termination by pressing "Enter"', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/02/12/1'}, {'name': '[oss-security] 20100316 Re: Re: CVE Request: gnome-screensaver termination by pressing "Enter"', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/03/16/9'}, {'name': '38211', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38211'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=565527'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gnome.org/browse/gnome-screensaver/commit/?id=ab08cc93f2dc6223c8c00bfa1ca4f2d89069dbe0'}, {'name': 'SUSE-SR:2010:008', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ftp.gnome.org/pub/gnome/sources/gtk+/2.18/gtk+-2.18.5.news'}, {'name': 'MDVSA-2010:109', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:109'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gnome.org/browse/gnome-screensaver/commit/?h=gnome-2-28&id=98f8a22412cf388217fd5b88915eadd274d68520'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.edge.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/446395'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.gnome.org/show_bug.cgi?id=598476'}, {'name': '[oss-security] 20100305 Re: CVE Request: gnome-screensaver termination by pressing "Enter"', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/03/05/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gnome.org/browse/gtk+/commit/?id=0748cf563d0d0d03001a62589f13be16a8ec06c1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.heise.de/newsticker/meldung/Gnome-Bildschirmsperre-in-OpenSuse-Linux-wirkungslos-2-Update-928580.html'}]
CVE State: PUBLISHED
Explain CVE-2010-0733
Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with many LEFT JOIN clauses, related to certain hashtable size calculations.
Affected Products: n/a
References: [{'name': '[pgsql-bugs] 20091028 BUG #5145: Complex query with lots of LEFT JOIN causes segfault', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.postgresql.org/pgsql-bugs/2009-10/msg00277.php'}, {'name': 'RHSA-2010:0427', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0427.html'}, {'name': 'RHSA-2010:0428', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0428.html'}, {'name': 'oval:org.mitre.oval:def:10691', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10691'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.postgresql.org/gitweb?p=postgresql.git%3Ba=commit%3Bh=64b057e6823655fb6c5d1f24a28f236b94dd6c54'}, {'name': '39820', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39820'}, {'name': '38619', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38619'}, {'name': '[oss-security] 20100316 Re: CVE Request: postgresql integer overflow in hash table size calculation', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/03/16/10'}, {'name': 'SUSE-SR:2010:014', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html'}, {'name': '[pgsql-bugs] 20091030 Re: BUG #5145: Complex query with lots of LEFT JOIN causes segfault', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.postgresql.org/pgsql-bugs/2009-10/msg00310.php'}, {'name': '[pgsql-bugs] 20091029 Re: BUG #5145: Complex query with lots of LEFT JOIN causes segfault', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.postgresql.org/pgsql-bugs/2009-10/msg00289.php'}, {'name': '[oss-security] 20100309 CVE Request: postgresql integer overflow in hash table size calculation', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/03/09/2'}, {'name': '[pgsql-bugs] 20091029 Re: BUG #5145: Complex query with lots of LEFT JOIN causes segfault', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.postgresql.org/pgsql-bugs/2009-10/msg00287.php'}, {'name': 'RHSA-2010:0429', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0429.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=546621'}, {'name': 'ADV-2010-1197', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1197'}]
CVE State: PUBLISHED
Explain CVE-2010-0736
Cross-site scripting (XSS) vulnerability in the view_queryform function in lib/viewvc.py in ViewVC before 1.0.10, and 1.1.x before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via "user-provided input."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2326'}, {'name': '[oss-security] 20100316 Re: CVE Request: ViewVC 1.1.4 / 1.0.10 -- XSS via user-provided query form input', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/03/16/14'}, {'name': '[oss-security] 20100310 CVE Request: ViewVC 1.1.4 / 1.0.10 -- XSS via user-provided query form input', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/03/10/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2313&r2=2342&pathrev=HEAD'}]
CVE State: PUBLISHED
Explain CVE-2010-0737
A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions, which allows JBoss ON users to perform management tasks and configuration changes with the privileges of the administrator user.
Affected Products: JBoss
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-0737'}]
CVE State: PUBLISHED
Explain CVE-2010-0738
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Affected Products: n/a
References: [{'name': 'RHSA-2010:0379', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2010-0379.html'}, {'name': 'RHSA-2010:0378', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2010-0378.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=574105'}, {'name': 'RHSA-2010:0376', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2010-0376.html'}, {'name': '8408', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8408'}, {'name': 'RHSA-2010:0377', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2010-0377.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35'}, {'name': 'ADV-2010-0992', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0992'}, {'name': 'HPSBMU02714', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=132129312609324&w=2'}, {'name': 'jboss-jmxconsole-security-bypass(58147)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/58147'}, {'name': 'SSRT100244', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=132129312609324&w=2'}, {'name': '39710', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39710'}, {'name': '39563', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39563'}, {'name': '1023918', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023918'}]
CVE State: PUBLISHED