Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2010-1070
SQL injection vulnerability in index.php in ImagoScripts Deviant Art Clone allows remote attackers to execute arbitrary SQL commands via the seid parameter in a forums viewcat action.
Affected Products: n/a
References: [{'name': '38096', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38096'}, {'name': '11002', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11002'}, {'name': 'ADV-2010-0031', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0031'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1001-exploits/imagoscriptsdac-sql.txt'}, {'name': 'deviantart-index-sql-injection(55379)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55379'}, {'name': '61482', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/61482'}]
CVE State: PUBLISHED
Explain CVE-2010-1071
SQL injection vulnerability in profil.php in phpMDJ 1.0.3 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '11083', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11083'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1001-exploits/phpmdj103-sql.txt'}, {'name': '33480', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33480'}, {'name': 'phpmdj-profile-sql-injection(55516)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55516'}, {'name': '37698', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37698'}]
CVE State: PUBLISHED
Explain CVE-2010-1072
Cross-site scripting (XSS) vulnerability in search.php in Sniggabo CMS 2.21 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1001-exploits/sniggabocms-xss.txt'}, {'name': 'sniggabocms-search-xss(55472)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55472'}, {'tags': ['x_refsource_MISC'], 'url': 'http://greyhathackers.wordpress.com/2010/01/07/sniggabo-cms-v2-21-xss-vulnerability/'}, {'name': '11049', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11049'}, {'name': '38029', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38029'}]
CVE State: PUBLISHED
Explain CVE-2010-1073
SQL injection vulnerability in the jEmbed-Embed Anything (com_jembed) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a summary action to index.php.
Affected Products: n/a
References: [{'name': '38112', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38112'}, {'name': '11026', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11026'}, {'name': 'ADV-2010-0047', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0047'}, {'name': '61510', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/61510'}, {'name': 'jembed-index-sql-injection(55443)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55443'}]
CVE State: PUBLISHED
Explain CVE-2010-1074
Cross-site scripting (XSS) vulnerability in the Currency Exchange module before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to watchdog logging.
Affected Products: n/a
References: [{'name': '61587', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/61587'}, {'name': '38121', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38121'}, {'name': '37649', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37649'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/676214'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/676216'}, {'name': 'currency-exchange-watchdog-xss(55453)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55453'}, {'name': 'ADV-2010-0063', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0063'}]
CVE State: PUBLISHED
Explain CVE-2010-1075
SQL injection vulnerability in index.php in Entry Level CMS (EL CMS) allows remote attackers to execute arbitrary SQL commands via the subj parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/elcms-sql.txt'}, {'name': '62513', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62513'}, {'name': '38688', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38688'}]
CVE State: PUBLISHED
Explain CVE-2010-1076
Cross-site scripting (XSS) vulnerability in index.php in Entry Level CMS (EL CMS) allows remote attackers to inject arbitrary web script or HTML via the subj parameter, which is not properly handled in a forced SQL error message.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '38688', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38688'}]
CVE State: PUBLISHED
Explain CVE-2010-1077
Directory traversal vulnerability in vbseo.php in Crawlability vBSEO plugin 3.1.0 for vBulletin allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the vbseourl parameter.
Affected Products: n/a
References: [{'name': '11526', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11526'}, {'name': 'vbseo-vbseourl-file-include(56439)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56439'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/vbseo-lfi.txt'}, {'name': 'ADV-2010-0442', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0442'}]
CVE State: PUBLISHED
Explain CVE-2010-1078
SQL injection vulnerability in archive.php in XlentProjects SphereCMS 1.1 alpha allows remote attackers to execute arbitrary SQL commands via encoded null bytes ("%00") in the view parameter, which bypasses a protection mechanism.
Affected Products: n/a
References: [{'name': '38309', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38309'}, {'name': 'spherecms-archive-sql-injection(56423)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56423'}, {'name': '20100217 SphereCMS Blind SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509603/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.packetstormsecurity.org/1002-exploits/spherecms-sql.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.bugreport.ir/index_68.htm'}]
CVE State: PUBLISHED
Explain CVE-2010-1079
Cross-site scripting (XSS) vulnerability in Sawmill before 7.2.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '38730', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38730'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sawmill.net/version_history7.html'}, {'name': '38387', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38387'}]
CVE State: PUBLISHED
Explain CVE-2010-1080
Cross-site scripting (XSS) vulnerability in view.php in Pulse CMS 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter.
Affected Products: n/a
References: [{'name': '62475', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62475'}, {'name': 'pulsecms-view-xss(56430)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56430'}, {'name': '38650', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38650'}, {'name': '38356', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38356'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/pulsecms-xss.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-1081
Directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for Core Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
Affected Products: n/a
References: [{'name': '38330', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38330'}, {'name': '38692', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38692'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.corejoomla.com/component/content/article/1-corejoomla-updates/40-community-polls-v153-security-release.html'}, {'name': '62506', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62506'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/joomlacp-lfi.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-1082
Multiple directory traversal vulnerabilities in OI.Blogs 1.0.0, when magic_quotes_gpc is disabled, allow remote attackers to read arbitrary files via directory traversal sequences in the (1) theme parameter to loadStyles.php and the (2) scripts parameter to javascript/loadScripts.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '38726', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38726'}]
CVE State: PUBLISHED
Explain CVE-2010-1084
Linux kernel 2.6.18 through 2.6.33, and possibly other versions, allows remote attackers to cause a denial of service (memory corruption) via a large number of Bluetooth sockets, related to the size of sysfs files in (1) net/bluetooth/l2cap.c, (2) net/bluetooth/rfcomm/core.c, (3) net/bluetooth/rfcomm/sock.c, and (4) net/bluetooth/sco.c.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://security-tracker.debian.org/tracker/CVE-2010-1084'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=576018'}, {'name': 'RHSA-2010:0610', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0610.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=101545f6fef4a0a3ea8daf0b5b880df2c6a92a69'}, {'name': '38898', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38898'}, {'name': '43315', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43315'}, {'name': '[oss-security] 20100323 CVE request: kernel: bluetooth: potential bad memory access with sysfs files', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/03/23/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0003.html'}, {'name': 'DSA-2053', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2010/dsa-2053'}, {'name': '20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/516397/100/0/threaded'}, {'name': '39830', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39830'}]
CVE State: PUBLISHED
Explain CVE-2010-1085
The azx_position_ok function in hda_intel.c in Linux kernel 2.6.33-rc4 and earlier, when running on the AMD780V chip set, allows context-dependent attackers to cause a denial of service (crash) via unknown manipulations that trigger a divide-by-zero error.
Affected Products: n/a
References: [{'name': 'RHSA-2010:0394', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0394.html'}, {'name': '38348', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38348'}, {'name': '39649', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39649'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/css/P8/documents/100090459'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=567168'}, {'name': '43315', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43315'}, {'name': '[linux-kernel] 20100205 PROBLEM: hda-intel divide by zero kernel crash in azx_position_ok()', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lkml.org/lkml/2010/2/5/322'}, {'name': '[oss-security] 20100222 CVE request: kernel: ALSA: hda-intel: Avoid divide by zero crash', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/02/22/2'}, {'name': 'RHSA-2010:0398', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0398.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0003.html'}, {'name': 'oval:org.mitre.oval:def:10027', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10027'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/css/P8/documents/100088287'}, {'name': '20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/516397/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://nctritech.net/bugreport.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-1086
The ULE decapsulation functionality in drivers/media/dvb/dvb-core/dvb_net.c in dvb-core in Linux kernel 2.6.33 and earlier allows attackers to cause a denial of service (infinite loop) via a crafted MPEG2-TS frame, related to an invalid Payload Pointer ULE.
Affected Products: n/a
References: [{'name': '[oss-security] 20100301 CVE request: kernel: dvb-core: ULE decapsulation DoS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/03/01/1'}, {'name': 'RHSA-2010:0394', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0394.html'}, {'name': '39649', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39649'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=569237'}, {'name': 'oval:org.mitre.oval:def:10569', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10569'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/css/P8/documents/100090459'}, {'name': '43315', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43315'}, {'name': 'RHSA-2010:0398', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2010-0398.html'}, {'name': 'SUSE-SA:2010:019', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00007.html'}, {'name': 'SUSE-SA:2010:023', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2010_23_kernel.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0003.html'}, {'name': '39742', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39742'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/css/P8/documents/100088287'}, {'name': 'DSA-2053', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2010/dsa-2053'}, {'name': '20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/516397/100/0/threaded'}, {'name': '39830', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39830'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=29e1fa3565a7951cc415c634eb2b78dbdbee151d'}, {'name': '38479', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38479'}]
CVE State: PUBLISHED
Explain CVE-2010-1087
The nfs_wait_on_request function in fs/nfs/pagelist.c in Linux kernel 2.6.x through 2.6.33-rc5 allows attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an operation that is not interruptible.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:10442', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10442'}, {'name': '39569', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39569'}, {'name': 'SUSE-SA:2010:031', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00006.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=9f557cd8073104b39528794d44e129331ded649f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=567184'}, {'name': '40645', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/40645'}, {'name': '[oss-security] 20100303 CVE request: kernel: NFS: Fix an Oops when truncating a file', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/03/03/1'}, {'name': '43315', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43315'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0003.html'}, {'name': 'DSA-2053', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2010/dsa-2053'}, {'name': '20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/516397/100/0/threaded'}, {'name': '39830', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39830'}, {'name': 'ADV-2010-1857', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1857'}]
CVE State: PUBLISHED
Explain CVE-2010-1088
fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount "symlinks," which allows attackers to have an unknown impact, related to LOOKUP_FOLLOW.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=ac278a9c505092dd82077a2446af8f9fc0d9c095'}, {'name': 'MDVSA-2010:198', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:198'}, {'name': '[oss-security] 20100224 CVE request: kernel: NFS DoS related to "automount" symlinks', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2010/02/24/3'}, {'name': 'MDVSA-2010:088', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:088'}, {'name': '39044', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/39044'}, {'name': '43315', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43315'}, {'name': 'SUSE-SA:2010:019', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00007.html'}, {'name': 'oval:org.mitre.oval:def:10093', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10093'}, {'name': 'SUSE-SA:2010:023', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2010_23_kernel.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0003.html'}, {'name': '39742', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39742'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=567813'}, {'name': 'DSA-2053', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2010/dsa-2053'}, {'name': '20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/516397/100/0/threaded'}, {'name': '39830', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/39830'}]
CVE State: PUBLISHED
Explain CVE-2010-1089
SQL injection vulnerability in vedi_faq.php in PHP Trouble Ticket 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1003-exploits/phptroubleticket-sql.txt'}, {'name': '38763', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38763'}]
CVE State: PUBLISHED
Explain CVE-2010-1090
SQL injection vulnerability in index.php in phpMySite allows remote attackers to execute arbitrary SQL commands via the action parameter.
Affected Products: n/a
References: [{'name': 'ADV-2010-0492', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0492'}, {'name': 'phpmysite-index-sql-injection(56573)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56573'}, {'name': '11588', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11588'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/phpmysite-sqlxss.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-1091
Multiple cross-site scripting (XSS) vulnerabilities in contact.php in phpMySite allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) city, (3) email, (4) state, and (5) message parameters.
Affected Products: n/a
References: [{'name': 'ADV-2010-0492', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0492'}, {'name': 'phpmysite-contact-xss(56574)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56574'}, {'name': '11588', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11588'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1002-exploits/phpmysite-sqlxss.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-1092
Multiple SQL injection vulnerabilities in login.php in ScriptsFeed Business Directory Software allow remote attackers to execute arbitrary SQL commands via the (1) us and (2) ps parameters.
Affected Products: n/a
References: [{'name': 'scriptsfeed-login-sql-injection(56570)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56570'}, {'name': '38771', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38771'}, {'name': 'ADV-2010-0494', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0494'}, {'name': '11592', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11592'}, {'name': '62626', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62626'}, {'name': '38470', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38470'}]
CVE State: PUBLISHED
Explain CVE-2010-1093
SQL injection vulnerability in rss.php in 1024 CMS 2.1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a vp action.
Affected Products: n/a
References: [{'name': '38476', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38476'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.bugreport.ir/index_69.htm'}, {'name': '38775', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38775'}]
CVE State: PUBLISHED
Explain CVE-2010-1094
SQL injection vulnerability in news.php in DZ EROTIK Auktionshaus V4rgo allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '11582', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/11582'}, {'name': 'v4rgo-news-sql-injection(56581)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56581'}, {'name': '38792', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38792'}, {'name': '62623', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62623'}, {'tags': ['x_refsource_MISC'], 'url': 'http://4004securityproject.wordpress.com/2010/02/26/dz-erotik-auktionshaus-v-4-rgo-news-php-sql-injection/'}]
CVE State: PUBLISHED
Explain CVE-2010-1095
Cross-site scripting (XSS) vulnerability in login_reset_password_page.php in Tracking Requirements & Use Cases (TRUC) 0.11.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'ADV-2010-0491', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0491'}]
CVE State: PUBLISHED
Explain CVE-2010-1096
Multiple SQL injection vulnerabilities in searchmatch.php in ScriptsFeed Dating Software allow remote attackers to execute arbitrary SQL commands via the (1) txtgender and (2) txtlookgender parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '38767', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38767'}, {'name': 'ADV-2010-0493', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0493'}, {'name': '62627', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62627'}]
CVE State: PUBLISHED
Explain CVE-2010-1097
include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain administrative access via a value of 1 for the _SESSION[dede_admin_id] parameter, as demonstrated by a request to uploads/include/dialog/select_soft_post.php.
Affected Products: n/a
References: [{'name': '62622', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/62622'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bbs.wolvez.org/topic/125/'}, {'name': '38469', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38469'}, {'name': '38790', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38790'}]
CVE State: PUBLISHED
Explain CVE-2010-1098
The ANI parser in Microsoft Windows before 7 on the x86 platform, as used in Internet Explorer and other applications, allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted biClrUsed value in the BITMAPINFO header of a .ANI file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://code.google.com/p/skylined/issues/detail?id=3'}, {'name': '38579', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/38579'}, {'tags': ['x_refsource_MISC'], 'url': 'http://skypher.com/index.php/2010/03/08/ani-file-bitmapinfoheader-biclrused-bounds-check-missing/'}, {'name': 'microsoft-windows-ani-dos(56756)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/56756'}]
CVE State: PUBLISHED
Explain CVE-2010-1099
Integer overflow in Apple Safari allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
Affected Products: n/a
References: [{'name': 'safari-tcp-security-bypass(57233)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/57233'}, {'name': '20100323 Safari browser port blocking bypassed by integer overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510283/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2010-1100
Integer overflow in Arora allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
Affected Products: n/a
References: [{'name': '20100323 Safari browser port blocking bypassed by integer overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510283/100/0/threaded'}, {'name': 'arora-tcp-security-bypass(57234)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/57234'}]
CVE State: PUBLISHED
Explain CVE-2010-1101
Integer overflow in Alexander Clauss iCab allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
Affected Products: n/a
References: [{'name': 'icab-tcp-security-bypass(57235)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/57235'}, {'name': '20100323 Safari browser port blocking bypassed by integer overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510283/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2010-1102
Integer overflow in OmniWeb allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
Affected Products: n/a
References: [{'name': 'omniweb-tcp-security-bypass(57236)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/57236'}, {'name': '20100323 Safari browser port blocking bypassed by integer overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510283/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2010-1103
Integer overflow in Stainless allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
Affected Products: n/a
References: [{'name': 'stainless-tcp-security-bypass(57237)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/57237'}, {'name': '20100323 Safari browser port blocking bypassed by integer overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/510283/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2010-1104
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
Affected Products: n/a
References: [{'name': 'ADV-2010-0104', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0104'}, {'name': '37765', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37765'}, {'name': '61655', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/61655'}, {'name': 'zope-standarderrormessage-xss(55599)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55599'}, {'name': '[zope-announce] 20100112 New Zope2 releases available', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://mail.zope.org/pipermail/zope-announce/2010-January/002229.html'}, {'name': '38007', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38007'}]
CVE State: PUBLISHED
Explain CVE-2010-1105
Cross-site scripting (XSS) vulnerability in cgi/index.php in AdvertisementManager 3.1.0 and 3.6 allows remote attackers to inject arbitrary web script or HTML via the usr parameter.
Affected Products: n/a
References: [{'name': 'advertisementmanager-index-xss(55754)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55754'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.packetstormsecurity.com/1001-exploits/advertisemanager-xssrfitraversal.txt'}, {'name': '38243', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38243'}, {'name': '40151', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/40151'}, {'name': '61846', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/61846'}]
CVE State: PUBLISHED
Explain CVE-2010-1106
PHP remote file inclusion vulnerability in cgi/index.php in AdvertisementManager 3.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the req parameter.  NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
Affected Products: n/a
References: [{'name': 'advertisementmanager-index-file-include(55756)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55756'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.packetstormsecurity.com/1001-exploits/advertisemanager-xssrfitraversal.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-1107
Cross-site scripting (XSS) vulnerability in the Recent Comments module 5.x through 5.x-1.2 and 6.x through 6.x-1.0 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a "custom block title interface."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/688632'}, {'name': '38281', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38281'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/690734'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/688636'}, {'name': 'recentcomments-title-xss(55770)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55770'}, {'name': '37898', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37898'}]
CVE State: PUBLISHED
Explain CVE-2010-1108
Cross-site scripting (XSS) vulnerability in the Control Panel module 5.x through 5.x-1.5 and 6.x through 6.x-1.2 for Drupal allows remote authenticated users, with "administer blocks" privileges, to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/690718'}, {'name': '37890', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37890'}, {'name': 'controlpanel-unspecified-xss(55769)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55769'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/686428'}, {'name': '38280', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38280'}]
CVE State: PUBLISHED
Explain CVE-2010-1109
Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) v2 parameter in a member view action, (2) v1 parameter in a news action, (3) v1 parameter in an information action, (4) v2 parameter in a team view action, (5) v2 parameter in a club view action, or (6) v2 parameter in a matches view action.
Affected Products: n/a
References: [{'name': 'phpmysport-unspecified-sql-injection(55762)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55762'}, {'name': '34279', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34279'}, {'tags': ['x_refsource_MISC'], 'url': 'http://phpmysport.sourceforge.net/en/forum/bugs/sujet_2851.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1001-exploits/phpmysport-sqlaccess.txt'}, {'name': '37856', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37856'}]
CVE State: PUBLISHED
Explain CVE-2010-1110
Directory traversal vulnerability in index.php in phpMySport 1.4 allows remote attackers to list arbitrary directories via a .. (dot dot) in the current_folder parameter.
Affected Products: n/a
References: [{'name': 'phpmysport-filemanager-dir-traversal(55763)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55763'}, {'tags': ['x_refsource_MISC'], 'url': 'http://phpmysport.sourceforge.net/en/forum/bugs/sujet_2851.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1001-exploits/phpmysport-sqlaccess.txt'}, {'name': '37856', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37856'}]
CVE State: PUBLISHED
Explain CVE-2010-1111
Multiple cross-site scripting (XSS) vulnerabilities in Jokes Complete Website allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to joke.php and the (2) searchingred parameter to results.php.
Affected Products: n/a
References: [{'name': 'jokescompletewebsite-multiple-xss(55761)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55761'}, {'name': '37852', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37852'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.packetstormsecurity.com/1001-exploits/jokescomplete-xss.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-1112
Cross-site scripting (XSS) vulnerability in cat.php in KloNews 2.0 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
Affected Products: n/a
References: [{'name': '38268', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38268'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/1001-exploits/klonews-xss.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-1113
Cross-site scripting (XSS) vulnerability in the forum page in Web Server Creator - Web Portal 0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to index.php.
Affected Products: n/a
References: [{'name': '37841', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37841'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.packetstormsecurity.com/1001-exploits/webservercreator-traversalxssrfi.txt'}, {'name': 'webservercreator-index-xss(55726)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55726'}]
CVE State: PUBLISHED
Explain CVE-2010-1114
Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pg parameter to index.php and the (2) path parameter to news/form.php.
Affected Products: n/a
References: [{'name': '37841', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37841'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.packetstormsecurity.com/1001-exploits/webservercreator-traversalxssrfi.txt'}, {'name': 'webservercreator-index-file-include(55727)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55727'}]
CVE State: PUBLISHED
Explain CVE-2010-1115
Directory traversal vulnerability in news/include/customize.php in Web Server Creator - Web Portal 0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the l parameter.
Affected Products: n/a
References: [{'name': '37841', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37841'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.packetstormsecurity.com/1001-exploits/webservercreator-traversalxssrfi.txt'}, {'name': 'webservercreator-customize-dir-traversal(55725)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55725'}]
CVE State: PUBLISHED
Explain CVE-2010-1116
LookMer Music Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for dbmdb/LookMerSarkiMDB.mdb.
Affected Products: n/a
References: [{'name': '38247', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38247'}, {'name': '61845', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/61845'}, {'name': 'lookmermusicportal-mdb-info-disclosure(55751)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/55751'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.packetstormsecurity.com/1001-exploits/lookmer-disclose.txt'}]
CVE State: PUBLISHED
Explain CVE-2010-1117
Heap-based buffer overflow in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to discover the base address of a Windows .dll file, and possibly have unspecified other impact, via unknown vectors, as demonstrated by Peter Vreugdenhil during a Pwn2Own competition at CanSecWest 2010.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/thezdi/statuses/11003801960'}, {'tags': ['x_refsource_MISC'], 'url': 'http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-InternetExplorer8.pdf'}, {'name': 'ie-base-address-bo(57196)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/57196'}, {'tags': ['x_refsource_MISC'], 'url': 'http://news.cnet.com/8301-27080_3-20001126-245.html'}]
CVE State: PUBLISHED
Explain CVE-2010-1118
Unspecified vulnerability in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a use-after-free issue, as demonstrated by Peter Vreugdenhil during a Pwn2Own competition at CanSecWest 2010.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/thezdi/statuses/11003801960'}, {'name': 'ie-unspecified-code-exec(57197)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/57197'}, {'tags': ['x_refsource_MISC'], 'url': 'http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-InternetExplorer8.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://news.cnet.com/8301-27080_3-20001126-245.html'}]
CVE State: PUBLISHED
Explain CVE-2010-1119
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or read the SMS database or other data, via vectors related to "attribute manipulation," as demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT4220'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT4225'}, {'name': 'APPLE-SA-2010-06-07-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html'}, {'name': '40196', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/40196'}, {'name': '40105', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/40105'}, {'name': 'ADV-2010-1373', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1373'}, {'name': 'APPLE-SA-2010-06-16-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://news.cnet.com/8301-27080_3-20001126-245.html'}, {'name': 'ADV-2010-1512', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/1512'}, {'name': '40620', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/40620'}, {'name': 'oval:org.mitre.oval:def:7037', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7037'}, {'name': '8128', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8128'}, {'name': '1024067', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1024067'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT4196'}, {'name': 'APPLE-SA-2010-06-21-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/thezdi/statuses/11001080021'}]
CVE State: PUBLISHED
Explain CVE-2010-1120
Unspecified vulnerability in Safari 4 on Apple Mac OS X 10.6 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by Charlie Miller during a Pwn2Own competition at CanSecWest 2010.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/thezdi/statuses/11002504493'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010'}, {'tags': ['x_refsource_MISC'], 'url': 'http://news.cnet.com/8301-27080_3-20001126-245.html'}]
CVE State: PUBLISHED