Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2009-1981
Unspecified vulnerability in the Highly Interactive Client component in Siebel Product Suite 7.5.3, 7.7.2, 7.8.2, 8.0.0.5, and 8.1.0 allows local users to affect confidentiality and integrity via unknown vectors.
Affected Products: n/a
References: [{'name': '35698', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35698'}, {'name': '35776', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35776'}, {'name': 'ADV-2009-1900', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1900'}, {'name': 'oracle-sbs-hic-unspecified(51764)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51764'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html'}, {'name': '1022564', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022564'}, {'name': '55908', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/55908'}]
CVE State: PUBLISHED
Explain CVE-2009-1982
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2 and 12.0.6 allows remote attackers to affect integrity via unknown vectors.
Affected Products: n/a
References: [{'name': '35776', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35776'}, {'name': 'ADV-2009-1900', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1900'}, {'name': '55900', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/55900'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html'}, {'name': '35693', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35693'}, {'name': 'oracle-ebs-af-unspecified(51765)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51765'}, {'name': '1022562', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022562'}]
CVE State: PUBLISHED
Explain CVE-2009-1983
Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows remote attackers to affect integrity via unknown vectors.
Affected Products: n/a
References: [{'name': '35776', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35776'}, {'name': 'ADV-2009-1900', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1900'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html'}, {'name': 'oracle-ebs-istore-unspecified(51766)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51766'}, {'name': '55901', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/55901'}, {'name': '35697', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35697'}, {'name': '1022562', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022562'}]
CVE State: PUBLISHED
Explain CVE-2009-1984
Unspecified vulnerability in the Application Install component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the Patch Administrator.
Affected Products: n/a
References: [{'name': '35776', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35776'}, {'name': '35690', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35690'}, {'name': 'ADV-2009-1900', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1900'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html'}, {'name': 'oracle-ebs-ai-unspecified(51767)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51767'}, {'name': '55899', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/55899'}, {'name': '1022562', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022562'}]
CVE State: PUBLISHED
Explain CVE-2009-1985
Unspecified vulnerability in the Network Authentication component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Affected Products: n/a
References: [{'name': '36745', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/36745'}, {'name': '37027', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37027'}, {'name': '1023057', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023057'}, {'name': 'TA09-294A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-294A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html'}, {'name': '59111', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/59111'}]
CVE State: PUBLISHED
Explain CVE-2009-1986
Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality via unknown vectors.
Affected Products: n/a
References: [{'name': '35776', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35776'}, {'name': '35695', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35695'}, {'name': 'ADV-2009-1900', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1900'}, {'name': '55902', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/55902'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html'}, {'name': 'oracle-ebs-am-unspecified(51768)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51768'}, {'name': '1022562', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022562'}]
CVE State: PUBLISHED
Explain CVE-2009-1987
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools - Enterprise Portal component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.21 allows remote attackers to affect integrity via unknown vectors.
Affected Products: n/a
References: [{'name': '35776', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35776'}, {'name': 'oracle-pse-jdee-pepep-unspecified(51769)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51769'}, {'name': 'ADV-2009-1900', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1900'}, {'name': '35691', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35691'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html'}, {'name': '1022566', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022566'}, {'name': '55909', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/55909'}]
CVE State: PUBLISHED
Explain CVE-2009-1988
Unspecified vulnerability in the PeopleSoft Enterprise HRMS eProfile Manager component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.8 SP1, 8.9 Bundle 19, and 9.0 Bundle 9 allows remote authenticated users to affect confidentiality via unknown vectors.
Affected Products: n/a
References: [{'name': '35696', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35696'}, {'name': '55910', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/55910'}, {'name': '35776', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35776'}, {'name': 'ADV-2009-1900', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1900'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html'}, {'name': '1022566', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022566'}, {'name': 'oracle-pse-jdee-pehem-unspecified(51770)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51770'}]
CVE State: PUBLISHED
Explain CVE-2009-1989
Unspecified vulnerability in the PeopleSoft Enterprise FMS component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.8 SP1, 8.9 Bundle 33, and 9.0 Bundle 24 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
Affected Products: n/a
References: [{'name': '55911', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/55911'}, {'name': '35776', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35776'}, {'name': 'ADV-2009-1900', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1900'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html'}, {'name': '1022566', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022566'}, {'name': 'oracle-pse-jdee-pef-unspecified(51771)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51771'}, {'name': '35694', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35694'}]
CVE State: PUBLISHED
Explain CVE-2009-1990
Unspecified vulnerability in the Business Intelligence Enterprise Edition component in Oracle Application Server 10.1.3.4.1 allows local users to affect confidentiality via unknown vectors.
Affected Products: n/a
References: [{'name': '59117', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/59117'}, {'name': 'TA09-294A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-294A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html'}, {'name': '1023058', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023058'}, {'name': '37099', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37099'}, {'name': '36749', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/36749'}]
CVE State: PUBLISHED
Explain CVE-2009-1991
Unspecified vulnerability in the Oracle Text component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity, related to CTXSYS.DRVXTABC.  NOTE: the previous information was obtained from the October 2009 CPU.  Oracle has not commented on claims from an established researcher that this is for multiple SQL injection vulnerabilities via the (1) idx_owner or (2) idx_name parameters to the create_tables procedure.
Affected Products: n/a
References: [{'name': '36748', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/36748'}, {'name': '37027', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37027'}, {'name': '1023057', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023057'}, {'name': 'TA09-294A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-294A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html'}, {'name': '59113', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/59113'}]
CVE State: PUBLISHED
Explain CVE-2009-1992
Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Affected Products: n/a
References: [{'name': '37027', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37027'}, {'name': '1023057', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023057'}, {'name': 'TA09-294A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-294A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html'}, {'name': '36742', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/36742'}]
CVE State: PUBLISHED
Explain CVE-2009-1993
Unspecified vulnerability in the Application Express component in Oracle Database 3.0.1 allows remote authenticated users to affect confidentiality and integrity, related to FLOWS_030000.WWV_EXECUTE_IMMEDIATE.
Affected Products: n/a
References: [{'name': '37027', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37027'}, {'name': '1023057', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023057'}, {'name': 'TA09-294A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-294A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html'}, {'name': '36759', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/36759'}]
CVE State: PUBLISHED
Explain CVE-2009-1994
Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 allows remote authenticated users to affect confidentiality, integrity, and availability, related to MDSYS.PRVT_CMT_CBK.
Affected Products: n/a
References: [{'name': '36744', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/36744'}, {'name': '37027', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37027'}, {'name': '1023057', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023057'}, {'name': 'TA09-294A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-294A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1995
Unspecified vulnerability in the Advanced Queuing component in Oracle Database 10.2.0.4 and 11.1.0.7 allows remote authenticated users to affect confidentiality and integrity, related to SYS.DBMS_AQ_INV.
Affected Products: n/a
References: [{'name': '36752', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/36752'}, {'name': '59109', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/59109'}, {'name': '37027', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37027'}, {'name': '1023057', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023057'}, {'name': 'TA09-294A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-294A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1996
Unspecified vulnerability in the Logical Standby component in Oracle Database allows remote authenticated users to affect integrity via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html'}, {'name': 'TA10-012A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-012A.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1997
Unspecified vulnerability in the Authentication component in Oracle Database 10.2.0.3 and 11.1.0.7 allows remote attackers to affect confidentiality via unknown vectors.
Affected Products: n/a
References: [{'name': '37027', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37027'}, {'name': '1023057', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023057'}, {'name': 'TA09-294A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-294A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html'}, {'name': '36751', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/36751'}]
CVE State: PUBLISHED
Explain CVE-2009-1998
Unspecified vulnerability in the Oracle Communications Order and Service Management component in Oracle Industry Applications 2.8.0, 6.2.0, 6.3.0, and 6.3.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
Affected Products: n/a
References: [{'name': 'TA09-294A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-294A.html'}, {'name': '1023060', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023060'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html'}, {'name': '36775', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/36775'}, {'name': '59114', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/59114'}]
CVE State: PUBLISHED
Explain CVE-2009-1999
Unspecified vulnerability in the Business Intelligence Enterprise Edition component in unspecified Oracle Application Server versions allows remote attackers to affect integrity via unknown vectors.
Affected Products: n/a
References: [{'name': '59118', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/59118'}, {'name': 'TA09-294A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-294A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html'}, {'name': '1023058', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023058'}, {'name': '37099', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37099'}, {'name': '36746', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/36746'}]
CVE State: PUBLISHED
Explain CVE-2010-0002
The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename.
Affected Products: n/a
References: [{'name': 'MDVSA-2010:004', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:004'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://qa.mandriva.com/show_bug.cgi?id=56882'}]
CVE State: PUBLISHED
Explain CVE-2010-0004
ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2242&r2=2313&pathrev=HEAD'}, {'name': 'FEDORA-2009-13610', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01421.html'}, {'name': '[oss-security] 20100113 Re: CVE Request: viewvc', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/13/5'}, {'name': 'FEDORA-2009-13634', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01464.html'}, {'name': '[oss-security] 20100111 CVE Request: viewvc', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/11/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/trunk/docs/release-notes/1.1.0.html?revision=2222'}, {'name': '[oss-security] 20100114 Re: CVE Request: viewvc', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/14/4'}, {'name': 'SUSE-SA:2010:008', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2300'}]
CVE State: PUBLISHED
Explain CVE-2010-0005
query.py in the query interface in ViewVC before 1.1.3 does not reject configurations that specify an unsupported authorizer for a root, which might allow remote attackers to bypass intended access restrictions via a query.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2242&r2=2313&pathrev=HEAD'}, {'name': 'FEDORA-2009-13610', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01421.html'}, {'name': '[oss-security] 20100113 Re: CVE Request: viewvc', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/13/5'}, {'name': 'FEDORA-2009-13634', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01464.html'}, {'name': '[oss-security] 20100111 CVE Request: viewvc', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/11/2'}, {'name': 'SUSE-SA:2010:008', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2300'}]
CVE State: PUBLISHED
Explain CVE-2010-0006
The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.32.4, when network namespaces are enabled, allows remote attackers to cause a denial of service (NULL pointer dereference) via an invalid IPv6 jumbogram, a related issue to CVE-2007-4567.
Affected Products: n/a
References: [{'name': '37810', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37810'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=300951'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.4'}, {'name': '61876', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/61876'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://security-tracker.debian.org/tracker/CVE-2010-0006'}, {'name': 'FEDORA-2010-0919', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034250.html'}, {'name': '38168', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38168'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=555217'}, {'name': '[linux-netdev] 20100114 [PATCH]: ipv6: skb_dst() can be NULL in ipv6_hop_jumbo().', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=linux-netdev&m=126343325807340&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://cert.fi/en/reports/2010/vulnerability341748.html'}, {'name': '38333', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38333'}, {'name': '[oss-security] 20100114 CVE-2010-0006 - kernel: ipv6: skb_dst() can be NULL in ipv6_hop_jumbo()', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/14/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2570a4f5428bcdb1077622342181755741e7fa60'}, {'name': 'SUSE-SA:2010:010', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.html'}]
CVE State: PUBLISHED
Explain CVE-2010-0008
The sctp_rcv_ootb function in the SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length.
Affected Products: n/a
References: [{'name': '39295', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39295'}, {'name': 'RHSA-2010:0146', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2010-0146.html'}, {'name': 'RHSA-2010:0147', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0147.html'}, {'name': '[oss-security] 20100317 CVE-2010-0008 kernel: sctp remote denial of service', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/03/17/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ece25dfa0991f65c4e1d26beb1c3c45bda4239b8'}, {'name': '43315', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43315'}, {'name': 'oval:org.mitre.oval:def:11160', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11160'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0003.html'}, {'name': 'RHSA-2010:0342', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0342.html'}, {'name': '20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/516397/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=555658'}]
CVE State: PUBLISHED
Explain CVE-2010-0009
Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.
Affected Products: n/a
References: [{'name': '39116', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39116'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=578572'}, {'name': '20100331 [SECURITY] CVE-2008-2370: Apache CouchDB Timing Attack Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510427/100/0/threaded'}, {'name': '39146', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39146'}, {'name': '20100331 [SECURITY] CVE-2008-2370: Apache CouchDB Timing Attack Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2010-03/0267.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://couchdb.apache.org/security.html'}, {'name': '63350', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/63350'}]
CVE State: PUBLISHED
Explain CVE-2010-0011
The eval_js function in uzbl-core.c in Uzbl before 2010.01.05 exposes the run method of the Uzbl object, which allows remote attackers to execute arbitrary commands via JavaScript code.
Affected Products: n/a
References: [{'name': '[uzbl-dev] 20100102 Fw: Uzbl: security issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.uzbl.org/pipermail/uzbl-dev-uzbl.org/2010-January/000586.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://github.com/Dieterbe/uzbl/commit/1958b52d41cba96956dc1995660de49525ed1047'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://github.com/Dieterbe/uzbl/downloads'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.uzbl.org/news.php?id=22'}, {'name': 'uzbl-evaljs-command-execution(56612)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56612'}, {'name': '[oss-security] 20100106 CVE request - uzbl remote code execution', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/06/1'}, {'name': '[oss-security] 20100106 Re: CVE request - uzbl remote code execution', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/06/3'}]
CVE State: PUBLISHED
Explain CVE-2010-0012
Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a pathname within a .torrent file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.transmissionbt.com/wiki/Changes#version-1.77'}, {'name': '[oss-security] 20100106 Re: CVE Request: Transmission', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/06/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/bugs/500625'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://security.debian.org/pool/updates/main/t/transmission/transmission_1.22-1+lenny2.diff.gz'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.transmissionbt.com/changeset/9829/'}, {'name': '38005', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38005'}, {'name': 'ADV-2010-0071', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0071'}, {'name': 'DSA-1967', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2010/dsa-1967'}, {'name': 'transmission-name-directory-traversal(55454)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55454'}, {'name': '[oss-security] 20100106 CVE Request: Transmission', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/06/2'}, {'name': '37993', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37993'}, {'name': 'SUSE-SA:2010:008', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html'}, {'name': '[debian-devel-changes] 20100105 Accepted transmission 1.77-1 (source all amd64)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.mail-archive.com/debian-devel-changes%40lists.debian.org/msg264483.html'}]
CVE State: PUBLISHED
Explain CVE-2010-0014
System Security Services Daemon (SSSD) before 1.0.1, when the krb5 auth_provider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting ticket (TGT); and might allow remote attackers to bypass intended access restrictions via vectors involving an arbitrary password in conjunction with a valid TGT.
Affected Products: n/a
References: [{'name': '38160', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38160'}, {'name': '37747', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37747'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/sssd/wiki/Releases/Notes-1.0.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=553233'}]
CVE State: PUBLISHED
Explain CVE-2010-0015
nis/nss_nis/nis-pwd.c in the GNU C Library (aka glibc or libc6) 2.7 and Embedded GLIBC (EGLIBC) 2.10.2 adds information from the passwd.adjunct.byname map to entries in the passwd map, which allows remote attackers to obtain the encrypted passwords of NIS accounts by calling the getpwnam function.
Affected Products: n/a
References: [{'name': 'MDVSA-2010:111', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:111'}, {'name': '[oss-security] 20100109 Re: CVE id request: GNU libc: NIS shadow password leakage', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/08/2'}, {'name': '[oss-security] 20100107 CVE id request: GNU libc: NIS shadow password leakage', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/07/3'}, {'name': '[oss-security] 20100111 Re: CVE id request: GNU libc: NIS shadow password leakage', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/11/6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560333'}, {'name': '[oss-security] 20100108 Re: CVE id request: GNU libc: NIS shadow password leakage', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/01/08/1'}, {'name': 'SUSE-SA:2010:052', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'https://lists.opensuse.org/opensuse-security-announce/2010-10/msg00007.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.debian.org/viewsvn/pkg-glibc/glibc-package/trunk/debian/patches/any/submitted-nis-shadow.diff?revision=4062&view=markup'}, {'name': 'MDVSA-2010:112', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:112'}, {'name': '[oss-security] 20100111 Re: CVE id request: GNU libc: NIS shadow password leakage', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=126320570505651&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sourceware.org/bugzilla/show_bug.cgi?id=11134'}, {'name': '[oss-security] 20100111 Re: CVE id request: GNU libc: NIS shadow password leakage', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=126320356003425&w=2'}]
CVE State: PUBLISHED
Explain CVE-2010-0016
The SMB client implementation in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly validate response fields, which allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code via a crafted response, aka "SMB Client Pool Corruption Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:8278', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8278'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}, {'name': 'MS10-006', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-006'}]
CVE State: PUBLISHED
Explain CVE-2010-0017
Race condition in the SMB client implementation in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code, and in the SMB client implementation in Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 allows local users to gain privileges, via a crafted SMB Negotiate response, aka "SMB Client Race Condition Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:8298', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8298'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}, {'name': 'MS10-006', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-006'}]
CVE State: PUBLISHED
Explain CVE-2010-0018
Integer overflow in the Embedded OpenType (EOT) Font Engine (t2embed.dll) in Microsoft Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code via compressed data that represents a crafted EOT font, aka "Microtype Express Compressed Fonts Integer Flaw in the LZCOMP Decompressor Vulnerability."
Affected Products: n/a
References: [{'name': 'MS10-001', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-001'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blogs.technet.com/srd/archive/2010/01/12/ms10-001-font-file-decompression-vulnerability.aspx'}, {'name': '1023432', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1023432'}, {'name': '35457', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35457'}, {'name': 'oval:org.mitre.oval:def:8324', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8324'}, {'name': 'TA10-012B', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-012B.html'}, {'name': 'ADV-2010-0095', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0095'}, {'name': '37671', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37671'}, {'name': '61651', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/61651'}]
CVE State: PUBLISHED
Explain CVE-2010-0019
Microsoft Silverlight 3 before 3.0.50611.0 on Windows, and before 3.0.41130.0 on Mac OS X, does not properly handle pointers, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and framework outage) via a crafted web site, aka "Microsoft Silverlight Memory Corruption Vulnerability."
Affected Products: n/a
References: [{'name': 'TA10-222A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-222A.html'}, {'name': 'MS10-060', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-060'}]
CVE State: PUBLISHED
Explain CVE-2010-0020
The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate request fields, which allows remote authenticated users to execute arbitrary code via a malformed request, aka "SMB Pathname Overflow Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:8438', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8438'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}, {'name': 'MS10-012', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-012'}]
CVE State: PUBLISHED
Explain CVE-2010-0021
Multiple race conditions in the SMB implementation in the Server service in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allow remote attackers to cause a denial of service (system hang) via a crafted (1) SMBv1 or (2) SMBv2 Negotiate packet, aka "SMB Memory Corruption Vulnerability."
Affected Products: n/a
References: [{'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}, {'name': 'MS10-012', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-012'}, {'name': 'oval:org.mitre.oval:def:8524', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8524'}]
CVE State: PUBLISHED
Explain CVE-2010-0022
The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate the share and servername fields in SMB packets, which allows remote attackers to cause a denial of service (system hang) via a crafted packet, aka "SMB Null Pointer Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:8314', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8314'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}, {'name': 'MS10-012', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-012'}]
CVE State: PUBLISHED
Explain CVE-2010-0023
The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly kill processes after a logout, which allows local users to obtain sensitive information or gain privileges via a crafted application that continues to execute throughout the logout of one user and the login session of the next user, aka "CSRSS Local Privilege Elevation Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:8304', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8304'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}, {'name': 'MS10-011', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-011'}, {'name': '38509', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38509'}]
CVE State: PUBLISHED
Explain CVE-2010-0024
The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2003 SP2, does not properly parse MX records, which allows remote DNS servers to cause a denial of service (service outage) via a crafted response to a DNS MX record query, aka "SMTP Server MX Record Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:7067', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7067'}, {'name': 'MS10-024', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-024'}, {'name': 'TA10-103A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-103A.html'}]
CVE State: PUBLISHED
Explain CVE-2010-0025
The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2000 SP3, does not properly allocate memory for SMTP command replies, which allows remote attackers to read fragments of e-mail messages by sending a series of invalid commands and then sending a STARTTLS command, aka "SMTP Memory Allocation Vulnerability."
Affected Products: n/a
References: [{'name': '39253', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39253'}, {'name': 'MS10-024', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-024'}, {'name': 'oval:org.mitre.oval:def:12175', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12175'}, {'name': 'TA10-103A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-103A.html'}]
CVE State: PUBLISHED
Explain CVE-2010-0026
The Hyper-V server implementation in Microsoft Windows Server 2008 Gold, SP2, and R2 on the x64 platform allows guest OS users to cause a denial of service (host OS hang) via a crafted application that executes a malformed series of machine instructions, aka "Hyper-V Instruction Set Validation Vulnerability."
Affected Products: n/a
References: [{'name': 'MS10-010', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-010'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}, {'name': 'oval:org.mitre.oval:def:8006', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8006'}]
CVE State: PUBLISHED
Explain CVE-2010-0027
The URL validation functionality in Microsoft Internet Explorer 5.01, 6, 6 SP1, 7 and 8, and the ShellExecute API function in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, does not properly process input parameters, which allows remote attackers to execute arbitrary local programs via a crafted URL, aka "URL Validation Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:8464', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8464'}, {'name': 'MS10-007', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-007'}, {'name': 'TA10-040A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA10-040A.html'}, {'name': '20100209 ZDI-10-016: Microsoft Windows ShellExecute Improper Sanitization Code Execution Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509470/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-10-016/'}, {'name': 'MS10-002', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002'}, {'name': 'ie-url-code-execution(55773)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55773'}]
CVE State: PUBLISHED