DuyTa/cve-kgrag-db huggingface dataset:
CVE-2010-0663
The ParamTraits<SkBitmap>::Read function in common/common_param_traits.cc in Google Chrome before 4.0.249.78 does not initialize the memory locations that will hold bitmap data, which might allow remote attackers to obtain potentially sensitive information from process memory by providing insufficient data, related to use of a (1) thumbnail database or (2) HTML canvas.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: chrome
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://code.google.com/p/chromium/issues/detail?id=31307, http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html, http://securitytracker.com/id?1023506
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2010-1344
SQL injection vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the fid parameter in a detail action to index.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: com_ckforms, joomla\!
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstormsecurity.org/1003-exploits/joomlackforms-lfisql.txt, http://secunia.com/advisories/38976, http://www.exploit-db.com/exploits/11785
CWE: CWE-89
CVE-2010-3943
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly link driver objects, which allows local users to gain privileges via a crafted application that triggers linked-list corruption, aka "Win32k Cursor Linking Vulnerability."
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_7, windows_server_2003, windows_vista, windows_xp, windows_2003_server
Related CWEs: CWE-264
References: http://www.securitytracker.com/id?1024880, http://www.us-cert.gov/cas/techalerts/TA10-348A.html, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-098
CWE: CWE-264
CVE-2010-2202
Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-1295, CVE-2010-2207, CVE-2010-2209, CVE-2010-2210, CVE-2010-2211, and CVE-2010-2212.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: windows, acrobat, acrobat_reader, mac_os_x
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://www.adobe.com/support/security/bulletins/apsb10-15.html, http://www.securityfocus.com/bid/41234, http://www.securitytracker.com/id?1024159
CWE: CWE-119
CVE-2010-5111
Multiple buffer overflows in readline.c in Echoping 6.0.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted reply in the (1) TLS_readline or (2) SSL_readline function, related to the EchoPingHttps Smokeping probe.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: echoping
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://security.gentoo.org/glsa/glsa-201406-07.xml, http://sourceforge.net/p/echoping/bugs/55, http://www.openwall.com/lists/oss-security/2013/10/17/1
CWE: CWE-119
CVE-2010-3429
flicvideo.c in libavcodec 0.6 and earlier in FFmpeg, as used in MPlayer and other products, allows remote attackers to execute arbitrary code via a crafted flic file, related to an "arbitrary offset dereference vulnerability."
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: libavcodec, mplayer, ffmpeg
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://git.ffmpeg.org/?p=ffmpeg%3Ba=commit%3Bh=16c592155f117ccd7b86006c45aacc692a81c23b, http://secunia.com/advisories/41626, http://secunia.com/advisories/43323
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2010-4850
Multiple cross-site scripting (XSS) vulnerabilities in Diferior 8.03 allow remote attackers to inject arbitrary web script or HTML via the (1) post_content parameter to post/edit/2/p1.html, related to views/post.php; the (2) slogan parameter to admin/site/2.html, related to views/admin.php; or the (3) subcatname or (4) description parameter to admin/forum/create_sub.html, related to views/admin.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: diferior
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://packetstormsecurity.org/files/view/96207/diferior-xss.txt, http://securityreason.com/securityalert/8398, http://www.exploit-db.com/exploits/15633
CWE: CWE-79
CVE-2010-0038
Recovery Mode in Apple iPhone OS 1.0 through 3.1.2, and iPhone OS for iPod touch 1.1 through 3.1.2, allows physically proximate attackers to bypass device locking, and read or modify arbitrary data, via a USB control message that triggers memory corruption.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: iphone_os
Related CWEs: CWE-399
References: http://lists.apple.com/archives/security-announce/2010/Feb/msg00000.html, http://osvdb.org/62128, http://support.apple.com/kb/HT4013
CWE: CWE-399
CVE-2010-1867
SQL injection vulnerability in the ArticleAttachment::GetAttachmentsByArticleNumber method in javascript/tinymcs/plugins/campsiteattachment/attachments.php in Campsite 3.3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the article_id parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: campsite
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://osvdb.org/64215, http://php-security.org/2010/05/01/mops-2010-002-campsite-tinymce-article-attachment-sql-injection-vulnerability/index.html, http://secunia.com/advisories/39580
CWE: CWE-89
CVE-2010-4692
Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.3(2) allows remote attackers to cause a denial of service (device crash) via a large number of LAN-to-LAN (aka L2L) IPsec sessions, aka Bug ID CSCth36592.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: adaptive_security_appliance_software, asa_5500, 5500_series_adaptive_security_appliance
References: http://secunia.com/advisories/42931, http://www.cisco.com/en/US/docs/security/asa/asa83/release/notes/asarn83.pdf, http://www.securityfocus.com/bid/45768
CVE-2010-4531
Stack-based buffer overflow in the ATRDecodeAtr function in the Answer-to-Reset (ATR) Handler (atrhandler.c) for pcscd in PCSC-Lite 1.5.3, and possibly other 1.5.x and 1.6.x versions, allows physically proximate attackers to cause a denial of service (crash) and possibly execute arbitrary code via a smart card with an ATR message containing a long attribute value.
CVSS v2.0 Score: 4.4 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
Affected Products: pcsc-lite
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607781, http://labs.mwrinfosecurity.com/files/Advisories/mwri_pcsc-atr-handler-buffer-overflow_2010-12-13.pdf, http://lists.alioth.debian.org/pipermail/pcsclite-cvs-commit/2010-November/004923.html
CWE: CWE-119
CVE-2010-2554
The Tracing Feature for Services in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 has incorrect ACLs on its registry keys, which allows local users to gain privileges via vectors involving a named pipe and impersonation, aka "Tracing Registry Key ACL Vulnerability."
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C
Affected Products: windows_7, windows_server_2008, windows_vista
Related CWEs: CWE-264
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-059, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12082, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-059
CWE: CWE-264
CVE-2010-1354
Directory traversal vulnerability in the VJDEO (com_vjdeo) component 1.0 and 1.0.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: joomla\!, com_vjdeo
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://packetstormsecurity.org/1004-exploits/joomlavjdeo-lfi.txt, http://secunia.com/advisories/39296, http://www.exploit-db.com/exploits/12102
CWE: CWE-22
CVE-2010-1426
SQL injection vulnerability in MODx Evolution before 1.0.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors related to WebLogin.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: modxcms
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://jvn.jp/en/jp/JVN19774883/index.html, http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000012.html, http://modxcms.com/forums/index.php/topic%2C47759.msg280304.html#msg280304
CWE: CWE-89
CVE-2010-1899
Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage) via a crafted request, related to asp.dll, aka "IIS Repeated Parameter Request Denial of Service Vulnerability."
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: internet_information_server, internet_information_services
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-065, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7127, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-065
CWE: CWE-119
CVE-2010-4162
Multiple integer overflows in fs/bio.c in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (system crash) via a crafted device ioctl to a SCSI device.
CVSS v2.0 Score: 4.7 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C
Affected Products: opensuse, fedora, linux_enterprise_real_time_extension, linux_kernel, linux_enterprise_desktop
Related CWEs: CWE-190
Related CAPECs: CAPEC-92
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=cb4644cac4a2797afc847e6c92736664d4b0ea34, http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html, http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html
CWE: CWE-190
CVE-2010-4214
The Wells Fargo Mobile application 1.1 for Android stores a username and password, along with account balances, in cleartext, which might allow physically proximate attackers to obtain sensitive information by reading application data.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: android, wells_fargo_mobile
Related CWEs: CWE-310
References: http://news.cnet.com/8301-27080_3-20021874-245.html, http://online.wsj.com/article/SB10001424052748703805704575594581203248658.html, http://viaforensics.com/appwatchdog/wells-fargo-android.html
CWE: CWE-310
CVE-2010-4178
MySQL-GUI-tools (mysql-administrator) leaks passwords into process list after with launch of mysql text console
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: fedora, mysql-gui-tools
Related CWEs: CWE-522
Related CAPECs: CAPEC-560, CAPEC-644, CAPEC-653
MITRE ATT&CK Techniques: T1550.003, T1021.002, T1133
MITRE ATT&CK Tactics: T1110, T1114, T1558
References: http://www.securityfocus.com/bid/97960, https://access.redhat.com/security/cve/cve-2010-4178, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4178
CWE: CWE-522
MITRE ATT&CK techniques: T1550.003, T1021.002, T1133, T1114.002, T1110.004, T1543, T1552.004, T1558.003, T1558, T1021, T1550.002, T1078
MITRE ATT&CK tactics: T1110, T1114, T1558, T1550, T1552, T1021
CVE-2010-0532
Race condition in the installation package in Apple iTunes before 9.1 on Windows allows local users to gain privileges by replacing an unspecified file with a Trojan horse.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: windows_7, windows_vista, windows_xp, itunes
Related CWEs: CWE-362
Related CAPECs: CAPEC-29, CAPEC-26
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html, http://secunia.com/advisories/39135, http://support.apple.com/kb/HT4105
CWE: CWE-362
CVE-2010-4769
Directory traversal vulnerability in the Jimtawl (com_jimtawl) component 1.0.2 Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the task parameter to index.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: com_jimtawl, joomla\!
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://secunia.com/advisories/42324, http://www.exploit-db.com/exploits/15585, http://www.securityfocus.com/bid/44992
CWE: CWE-22
CVE-2010-2446
Rbot Reaction plugin allows command execution
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: rbot
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://security-tracker.debian.org/tracker/CVE-2010-2446, https://www.securityfocus.com/archive/1/509719/30/0/threaded, https://security-tracker.debian.org/tracker/CVE-2010-2446
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2010-3276
libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an NSV file.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: vlc_media_player
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://secunia.com/advisories/43826, http://securityreason.com/securityalert/8162, http://securitytracker.com/id?1025250
CWE: CWE-119
CVE-2010-3085
The network-play implementation in Mednafen before 0.8.D might allow remote servers to execute arbitrary code via unspecified vectors, related to "stack manipulation" issues.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mednafen
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://sourceforge.net/news/?group_id=150840&id=287363, http://www.openwall.com/lists/oss-security/2010/09/09/8, http://www.openwall.com/lists/oss-security/2010/09/11/3
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2010-0436
Race condition in backend/ctrl.c in KDM in KDE Software Compilation (SC) 2.2.0 through 4.4.2 allows local users to change the permissions of arbitrary files, and consequently gain privileges, by blocking the removal of a certain directory that contains a control socket, related to improper interaction with ksm.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: kde_sc
Related CWEs: CWE-362
Related CAPECs: CAPEC-29, CAPEC-26
References: ftp://ftp.kde.org/pub/kde/security_patches/kdebase-workspace-4.3.5-CVE-2010-0436.diff, http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039533.html, http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html
CWE: CWE-362
CVE-2010-3515
Unspecified vulnerability in the Solaris component in Oracle Solaris 9 and 10, and OpenSolaris, allows local users to affect availability via unknown vectors related to Kernel/Disk Driver.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:N/I:N/A:C
Affected Products: opensolaris, solaris
References: http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html, http://www.us-cert.gov/cas/techalerts/TA10-287A.html, http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
CVE-2010-1195
Cross-site scripting (XSS) vulnerability in the htmlscrubber component in ikiwiki 2.x before 2.53.5 and 3.x before 3.20100312 allows remote attackers to inject arbitrary web script or HTML via a crafted data:image/svg+xml URI.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: ikiwiki
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://ikiwiki.info/security/#index36h2, http://secunia.com/advisories/38983, http://secunia.com/advisories/39048
CWE: CWE-79
CVE-2010-4940
SQL injection vulnerability in index.php in WAnewsletter 2.1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: wanewsletter
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstormsecurity.org/1009-exploits/wanewsletter-sql.txt, http://securityreason.com/securityalert/8462, http://www.exploit-db.com/exploits/15090
CWE: CWE-89
CVE-2010-2841
Unspecified vulnerability in Cisco Wireless LAN Controller (WLC) software 4.2 before 4.2.209.0; 4.2M before 4.2.207.54M; 5.0, 5.1, and 6.0 before 6.0.196.0; and 5.2 before 5.2.193.11 allows remote authenticated users to cause a denial of service (device reload) via crafted HTTP packets that trigger invalid arguments to the emweb component, aka Bug ID CSCtd16938.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:C
Affected Products: wireless_lan_controller_software
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=21288, http://www.cisco.com/en/US/products/products_security_advisory09186a0080b466e9.shtml, http://tools.cisco.com/security/center/viewAlert.x?alertId=21288
CVE-2010-4049
Opera before 10.63 allows remote attackers to cause a denial of service (application crash) via a Flash movie with a transparent Window Mode (aka wmode) property, which is not properly handled during navigation away from the containing HTML document.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: opera_browser
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://www.opera.com/docs/changelogs/mac/1063/, http://www.opera.com/docs/changelogs/unix/1063/, http://www.opera.com/docs/changelogs/windows/1063/
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2010-2295
page/EventHandler.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 does not properly handle a change of the focused frame during the dispatching of keydown, which allows user-assisted remote attackers to redirect keystrokes via a crafted HTML document, aka rdar problem 7018610.  NOTE: this might overlap CVE-2010-1422.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: chrome
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://code.google.com/p/chromium/issues/detail?id=15766, http://googlechromereleases.blogspot.com/2010/06/stable-channel-update.html, http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2010-1893
Integer overflow in the TCP/IP stack in Microsoft Windows Vista SP1, Windows Server 2008 Gold and R2, and Windows 7 allows local users to gain privileges via a buffer of user-mode data that is copied to kernel mode, aka "Integer Overflow in Windows Networking Vulnerability."
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C
Affected Products: windows_7, windows_server_2008, windows_vista
Related CWEs: CWE-189
References: http://www.us-cert.gov/cas/techalerts/TA10-222A.html, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-058, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12087
CWE: CWE-189
CVE-2010-0077
Unspecified vulnerability in the CRM Technical Foundation (mobile) component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote attackers to affect confidentiality and integrity via unknown vectors.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: e-business_suite
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html, http://www.us-cert.gov/cas/techalerts/TA10-012A.html, http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE-2010-5090
SilverStripe before 2.4.2 allows remote authenticated users to change administrator passwords via vectors related to admin/security.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: silverstripe
Related CWEs: CWE-264
References: http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.2, http://www.openwall.com/lists/oss-security/2012/04/30/1, http://www.openwall.com/lists/oss-security/2012/04/30/3
CWE: CWE-264
CVE-2010-3041
Multiple buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted (1) .wrf or (2) .arf file, related to atas32.dll, a different vulnerability than CVE-2010-3042, CVE-2010-3043, and CVE-2010-3044.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: webex_recording_format_player, webex_advanced_recording_format_player
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://securitytracker.com/id?1025016, http://tools.cisco.com/security/center/viewAlert.x?alertId=22016, http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6913f.shtml
CWE: CWE-119
CVE-2010-3017
Unspecified vulnerability in RSA Access Manager Agent 4.7.1 before 4.7.1.7, when RSA Adaptive Authentication Integration is enabled, allows remote attackers to bypass authentication and obtain sensitive information via unknown vectors.
CVSS v2.0 Score: 5.7 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:M/Au:N/C:C/I:N/A:N
Affected Products: access_manager_agent
References: http://archives.neohapsis.com/archives/bugtraq/2010-09/0057.html, http://archives.neohapsis.com/archives/bugtraq/2010-09/0057.html
CVE-2010-20123
Steinberg MyMP3Player version 3.0 (build 3.0.0.67) is vulnerable to a stack-based buffer overflow when parsing .m3u playlist files. The application fails to properly validate the length of input data within the playlist, allowing a specially crafted file to overwrite critical memory structures and execute arbitrary code. This vulnerability can be exploited locally by convincing a user to open a malicious .m3u file.
Related CWEs: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mymp3player_m3u.rb, https://www.chip.de/downloads/myMP3-Player_13008621.html, https://www.exploit-db.com/exploits/11791
CWE: CWE-121
CVE-2010-0945
SQL injection vulnerability in the HotBrackets Tournament Brackets (com_hotbrackets) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: com_hotbrackets, joomla\!
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.exploit-db.com/exploits/10953, http://www.packetstormsecurity.org/0912-exploits/joomlahotbrackets-sql.txt, http://www.securityfocus.com/bid/37439
CWE: CWE-89
CVE-2010-2890
Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-3619, CVE-2010-3621, CVE-2010-3622, CVE-2010-3628, CVE-2010-3632, and CVE-2010-3658.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: acrobat, acrobat_reader
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html, http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html, http://secunia.com/advisories/43025
CWE: CWE-119
CVE-2010-3049
Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot).
CVSS v3.0 Score: 5.5 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C
Affected Products: ios
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/release/notes/ol_14271/caveats_SXI_rebuilds.html, https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/release/notes/ol_14271/caveats_SXI_rebuilds.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2010-1837
CoreText in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font in a PDF document.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: mac_os_x_server, mac_os_x
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html, http://support.apple.com/kb/HT4435, http://www.securityfocus.com/bid/44808
CWE: CWE-119
CVE-2010-1103
Integer overflow in Stainless allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: stainless
Related CWEs: CWE-189
References: http://www.securityfocus.com/archive/1/510283/100/0/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/57237, http://www.securityfocus.com/archive/1/510283/100/0/threaded
CWE: CWE-189
CVE-2010-2719
SQL injection vulnerability in show.php in phpaaCms 0.3.1 UTF-8, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpaacms
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://osvdb.org/65994, http://secunia.com/advisories/40450, http://www.exploit-db.com/exploits/14199
CWE: CWE-89
CVE-2010-5157
Race condition in Comodo Internet Security before 4.1.149672.916 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.
CVSS v2.0 Score: 6.2 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
Affected Products: comodo_internet_security, windows_xp
Related CWEs: CWE-362
Related CAPECs: CAPEC-29, CAPEC-26
References: http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html, http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html, http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/
CWE: CWE-362
CVE-2010-2544
Cross-site scripting (XSS) vulnerability in utilities.php in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: cacti
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://cacti.net/release_notes_0_8_7g.php, http://marc.info/?l=oss-security&m=127978954522586&w=2, http://marc.info/?l=oss-security&m=128017203704299&w=2
CWE: CWE-79
CVE-2010-2097
The (1) iconv_mime_decode, (2) iconv_substr, and (3) iconv_mime_encode functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: php
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html, http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html, http://marc.info/?l=bugtraq&m=133469208622507&w=2
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2010-0216
authenticate_ad_setup_finished.cfm in MediaCAST 8 and earlier allows remote attackers to discover usernames and cleartext passwords by reading the error messages returned for requests that use the UserID parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mediacast
Related CWEs: CWE-310
References: http://secunia.com/advisories/44182, http://securityreason.com/securityalert/8245, http://www.osvdb.org/72079
CWE: CWE-310
CVE-2010-0260
Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted spreadsheet in which "a MDXTUPLE record is broken up into several records," aka "Microsoft Office Excel MDXTUPLE Record Heap Overflow Vulnerability."
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: excel, open_xml_file_format_converter, office, office_sharepoint_server, office_compatibility_pack
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=862, http://www.securitytracker.com/id?1023698, http://www.us-cert.gov/cas/techalerts/TA10-068A.html
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2010-1710
Directory traversal vulnerability in login.php in Siestta 2.0, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the idioma parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: siestta
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://packetstormsecurity.org/1004-exploits/siestta-lfixss.txt, http://secunia.com/advisories/39453, http://www.exploit-db.com/exploits/12260
CWE: CWE-22
CVE-2010-4096
share/ma/keys_for_user in Monkeysphere 0.31 and 0.32 allows local users to execute arbitrary code via unknown manipulations related to the "monkeysphere-authentication keys-for-user" command.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: monkeysphere
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://secunia.com/advisories/42067, http://web.monkeysphere.info/news/CVE-2010-4096/, https://lists.riseup.net/www/arc/monkeysphere/2010-10/msg00066.html
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2010-3310
Multiple integer signedness errors in net/rose/af_rose.c in the Linux kernel before 2.6.36-rc5-next-20100923 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a rose_getname function call, related to the rose_bind and rose_connect functions.
CVSS v2.0 Score: 1.9 (LOW)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P
Affected Products: linux_kernel, debian_linux, ubuntu_linux
Related CWEs: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=9828e6e6e3f19efcb476c567b9999891d051f52f, http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html, http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00004.html
CWE: CWE-189
CVE-2010-0162
Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly support the application/octet-stream content type as a protection mechanism against execution of web script in certain circumstances involving SVG and the EMBED element, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via an embedded SVG document.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: seamonkey, firefox
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html, http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html, http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html
CWE: CWE-79
CVE-2010-4252
OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: openssl
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://cvs.openssl.org/chngview?cn=20098, http://marc.info/?l=bugtraq&m=129916880600544&w=2, http://marc.info/?l=bugtraq&m=130497251507577&w=2
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2010-2201
Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code via a PDF file with crafted Flash content involving the (1) pushstring (0x2C) operator, (2) debugfile (0xF1) operator, and an "invalid pointer vulnerability" that triggers memory corruption, a different vulnerability than CVE-2010-1285 and CVE-2010-2168.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: windows, acrobat, acrobat_reader, mac_os_x
Related CWEs: CWE-399
References: http://www.adobe.com/support/security/bulletins/apsb10-15.html, http://www.securityfocus.com/archive/1/512098, http://www.securityfocus.com/bid/41237
CWE: CWE-399
CVE-2010-3039
/usr/local/cm/bin/pktCap_protectData in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6, 7, and 8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in a request to the administrative interface, aka Bug IDs CSCti52041 and CSCti74930.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C
Affected Products: unified_communications_manager
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: http://seclists.org/fulldisclosure/2010/Nov/40, http://secunia.com/advisories/42129, http://tools.cisco.com/security/center/viewAlert.x?alertId=21656
CWE: CWE-78
CVE-2010-2789
PHP remote file inclusion vulnerability in MediaWikiParserTest.php in MediaWiki 1.16 beta, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via unspecified vectors.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: mediawiki
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html, http://openwall.com/lists/oss-security/2010/07/29/4, http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2010-1939
Use-after-free vulnerability in Apple Safari 4.0.5 on Windows allows remote attackers to execute arbitrary code by using window.open to create a popup window for a crafted HTML document, and then calling the parent window's close method, which triggers improper handling of a deleted window object.
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: windows, safari
Related CWEs: CWE-399
References: http://h07.w.interia.pl/Safari.rar, http://reviews.cnet.com/8301-13727_7-20004709-263.html, http://secunia.com/advisories/39670
CWE: CWE-399
CVE-2010-4811
Multiple cross-site scripting (XSS) vulnerabilities in ajaxmember.php in 6kbbs 8.0 build 20100901 allow remote attackers to inject arbitrary web script or HTML via the (1) user[msn], (2) user[email], and (3) user[phone] parameters in a modifyDetails action.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: 6kbbs
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://bbs.wolvez.org/viewtopic.php?id=180, http://secunia.com/advisories/42204, https://exchange.xforce.ibmcloud.com/vulnerabilities/63284
CWE: CWE-79
CVE-2010-2933
SQL injection vulnerability in AV Scripts AV Arcade 3 allows remote attackers to execute arbitrary SQL commands via the ava_code cookie to the "main page," related to index.php and the login task.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: av_arcade
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.exploit-db.com/exploits/14494, http://www.securityfocus.com/bid/42023, https://exchange.xforce.ibmcloud.com/vulnerabilities/60799
CWE: CWE-89
CVE-2010-2402
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft and JDEdwards Suite 8.49.27 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS v2.0 Score: 5.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N
Affected Products: peoplesoft_and_jdedwards_product_suite
References: http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html, http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
CVE-2010-4039
Google Chrome before 7.0.517.41 on Linux does not properly set the PATH environment variable, which has unspecified impact and attack vectors.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: linux_kernel, chrome
References: http://code.google.com/p/chromium/issues/detail?id=54132, http://googlechromereleases.blogspot.com/2010/10/stable-channel-update.html, http://secunia.com/advisories/41888
CVE-2010-3519
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft and JDEdwards Suite 8.49.28 and 8.50.12 allows remote authenticated users to affect integrity via unknown vectors.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: peoplesoft_and_jdedwards_product_suite
References: http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html, http://www.us-cert.gov/cas/techalerts/TA10-287A.html, http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
CVE-2010-3060
Unspecified vulnerability in the message-protocol implementation in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.x.x before 5.5.7, and 6.1.0.0, allows remote attackers to cause a denial of service (daemon outage) via unknown vectors.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: tivoli_storage_manager_fastback
References: http://secunia.com/advisories/41044, http://www-01.ibm.com/support/docview.wss?uid=swg1IC69883, http://www-01.ibm.com/support/docview.wss?uid=swg21443820
CVE-2010-1687
Stack-based buffer overflow in lpd.exe in Mocha W32 LPD 1.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted "recieve jobs" request.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: mocha_w32_lpd
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://secunia.com/advisories/39394, http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-023-mocha-lpd-remote-buffer-overflow/, http://www.corelan.be:8800/wp-content/forum-file-uploads/mr_me/mochalpd.py_.txt
CWE: CWE-119
CVE-2010-0326
Cross-site scripting (XSS) vulnerability in the Developer log (devlog) extension 2.9.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: devlog, typo3
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/38164, http://typo3.org/extensions/repository/view/devlog/2.9.2/, http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CWE: CWE-79
CVE-2010-4242
The hci_uart_tty_open function in the HCI UART driver (drivers/bluetooth/hci_ldisc.c) in the Linux kernel 2.6.36, and possibly other versions, does not verify whether the tty has a write operation, which allows local users to cause a denial of service (NULL pointer dereference) via vectors related to the Bluetooth driver.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:N/I:N/A:C
Affected Products: linux_kernel
References: http://git.kernel.org/linus/c19483cc5e56ac5e22dd19cf25ba210ab1537773, http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.html, http://secunia.com/advisories/42789
CVE-2010-3511
Unspecified vulnerability in Oracle OpenSolaris allows local users to affect integrity and availability via unknown vectors related to Tooltalk.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:P
Affected Products: opensolaris
References: http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html, http://www.us-cert.gov/cas/techalerts/TA10-287A.html, http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
CVE-2010-1521
SQL injection vulnerability in include/classes/tzn_user.php in TaskFreak! Original multi user before 0.6.4 allows remote attackers to execute arbitrary SQL commands via the password parameter to login.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: taskfreak\!
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://osvdb.org/65847, http://secunia.com/advisories/40025, http://secunia.com/secunia_research/2010-79/
CWE: CWE-89
CVE-2010-1592
sandra.sys 15.18.1.1 and earlier in the Sandra Device Driver in SiSoftware Sandra 16.10.2010.1 and earlier allows local users to gain privileges or cause a denial of service (system crash) via unspecified vectors involving "Model-Specific Registers."
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: sandra
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://osvdb.org/61947, http://secunia.com/advisories/38212, http://www.ntinternals.org/ntiadv0808/ntiadv0808.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2010-3983
CmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain privileges via vectors involving the Program Job Server and the Program Login property.
CVSS v2.0 Score: 9.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Affected Products: businessobjects
Related CWEs: CWE-264
References: http://osvdb.org/68682, http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf, http://osvdb.org/68682
CWE: CWE-264
CVE-2010-1750
Use-after-free vulnerability in Apple Safari before 5.0 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to improper window management.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: windows_7, windows_vista, windows_xp, safari
Related CWEs: CWE-399
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html, http://secunia.com/advisories/40105, http://securitytracker.com/id?1024067
CWE: CWE-399
CVE-2010-1229
The sandbox infrastructure in Google Chrome before 4.1.249.1036 does not properly use pointers, which has unspecified impact and attack vectors.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: chrome
Related CWEs: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=28804, http://code.google.com/p/chromium/issues/detail?id=31880, http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.html
CWE: CWE-399
CVE-2010-3277
The installer in VMware Workstation 7.x before 7.1.2 build 301548 and VMware Player 3.x before 3.1.2 build 301548 renders an index.htm file if present in the installation directory, which might allow local users to trigger unintended interpretation of web script or HTML by creating this file.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: player, workstation
Related CWEs: CWE-264
References: http://lists.vmware.com/pipermail/security-announce/2010/000105.html, http://secunia.com/advisories/41574, http://securitytracker.com/id?1024481
CWE: CWE-264