DuyTa/cve-kgrag-db huggingface dataset:
CVE-2010-5036
SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: eswap
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstormsecurity.org/1006-exploits/iscriptsewap-sqlxss.txt, http://securityreason.com/securityalert/8522, http://www.exploit-db.com/exploits/13740/
CWE: CWE-89
CVE-2010-0779
Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.33, and 7.0 before 7.0.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: websphere_application_server
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www-1.ibm.com/support/docview.wss?uid=swg1PM09250, https://exchange.xforce.ibmcloud.com/vulnerabilities/59647, http://www-1.ibm.com/support/docview.wss?uid=swg1PM09250
CWE: CWE-79
CVE-2010-3797
Cross-site scripting (XSS) vulnerability in Wiki Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: mac_os_x_server
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html, http://support.apple.com/kb/HT4435, http://www.securitytracker.com/id?1024723
CWE: CWE-79
CVE-2010-2242
Red Hat libvirt 0.2.0 through 0.8.2 creates iptables rules with improper mappings of privileged source ports, which allows guest OS users to bypass intended access restrictions by leveraging IP address and source-port values, as demonstrated by copying and deleting an NFS directory tree.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: libvirt
Related CWEs: CWE-264
References: http://libvirt.org/news.html, http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044520.html, http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044579.html
CWE: CWE-264
CVE-2010-4698
Stack-based buffer overflow in the GD extension in PHP before 5.2.15 and 5.3.x before 5.3.4 allows context-dependent attackers to cause a denial of service (application crash) via a large number of anti-aliasing steps in an argument to the imagepstext function.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: php
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://bugs.php.net/53492, http://marc.info/?l=bugtraq&m=133469208622507&w=2, http://seclists.org/fulldisclosure/2010/Dec/180
CWE: CWE-119
CVE-2010-5337
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persistent in 10.1.3 and 10.2.0.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: webclient
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://vuldb.com/?id.142993, https://www.gosecurity.ch/component/content/article/12-services/gosecuritynews/fachartikel/169-gosecurity-advisory-2010120602, https://vuldb.com/?id.142993
CWE: CWE-79
CVE-2010-2487
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: moinmoin
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809, http://hg.moinmo.in/moin/1.7/rev/37306fba2189, http://hg.moinmo.in/moin/1.8/raw-file/1.8.8/docs/CHANGES
CWE: CWE-79
CVE-2010-4261
Off-by-one error in the icon_cb function in pe_icons.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: clamav
Related CWEs: CWE-189
References: http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=master, http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html, http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051905.html
CWE: CWE-189
CVE-2010-1223
Multiple buffer overflows in CA XOsoft r12.0 and r12.5 allow remote attackers to execute arbitrary code via (1) a malformed request to the ws_man/xosoapapi.asmx SOAP endpoint or (2) a long string to the entry_point.aspx service.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: xosoft_content_distribution, xosoft_replication, xosoft_high_availability
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://www.securityfocus.com/archive/1/510564/100/0/threaded, http://www.securityfocus.com/archive/1/510565/100/0/threaded, http://www.securityfocus.com/archive/1/510567/100/0/threaded
CWE: CWE-119
CVE-2010-4094
The Tomcat server in IBM Rational Quality Manager and Rational Test Lab Manager has a default password for the ADMIN account, which makes it easier for remote attackers to execute arbitrary code by leveraging access to the manager role.  NOTE: this might overlap CVE-2009-3548.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: rational_quality_manager, rational_test_lab_manager
Related CWEs: CWE-255
References: http://download4.boulder.ibm.com/sar/CMA/RAA/013m6/0/UpdateLog.txt, http://osvdb.org/69008, http://secunia.com/advisories/41784
CWE: CWE-255
CVE-2010-0693
SQL injection vulnerability in products.php in CommodityRentals Trade Manager Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: trade_manager_script
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://osvdb.org/62294, http://packetstormsecurity.org/1002-exploits/trademanager-sql.txt, http://secunia.com/advisories/38556
CWE: CWE-89
CVE-2010-4661
udisks before 1.0.3 allows a local user to load arbitrary Linux kernel modules.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: enterprise_linux, debian_linux, opensuse, fedora, udisks
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00000.html, https://access.redhat.com/security/cve/cve-2010-4661, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4661
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2010-3529
Unspecified vulnerability in the PeopleSoft Enterprise FMS - Cash Management component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle #38, 9.0 Bundle #31, and 9.1 Bundle #6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS v2.0 Score: 5.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N
Affected Products: peoplesoft_and_jdedwards_product_suite
References: http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html, http://www.us-cert.gov/cas/techalerts/TA10-287A.html, http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
CVE-2010-3285
Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to cause a denial of service via unknown vectors.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: openview_network_node_manager
References: http://marc.info/?l=bugtraq&m=128525454219838&w=2, http://marc.info/?l=bugtraq&m=128525454219838&w=2
CVE-2010-0508
Mail in Apple Mac OS X before 10.6.3 does not disable the filter rules associated with a deleted mail account, which has unspecified impact and attack vectors.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mac_os_x_server, mac_os_x
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html, http://support.apple.com/kb/HT4077, http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE-2010-1436
gfs2 in the Linux kernel 2.6.18, and possibly other versions, does not properly handle when the gfs2_quota struct occupies two separate pages, which allows local users to cause a denial of service (kernel panic) via certain manipulations that cause an out-of-bounds write, as demonstrated by writing from an ext3 file system to a gfs2 file system.
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C
Affected Products: linux_kernel
Related CWEs: CWE-399
References: http://secunia.com/advisories/43315, http://www.openwall.com/lists/oss-security/2010/04/27/1, http://www.openwall.com/lists/oss-security/2010/04/28/1
CWE: CWE-399
CVE-2010-4689
Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.3(2) do not properly preserve ACL behavior after a migration, which allows remote attackers to bypass intended access restrictions via an unspecified type of network traffic that had previously been denied, aka Bug ID CSCte46460.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
Affected Products: adaptive_security_appliance_software, asa_5500, 5500_series_adaptive_security_appliance
Related CWEs: CWE-264
References: http://www.cisco.com/en/US/docs/security/asa/asa83/release/notes/asarn83.pdf, http://www.securityfocus.com/bid/45768, http://www.securitytracker.com/id?1024963
CWE: CWE-264
CVE-2010-1247
Unspecified vulnerability in Microsoft Office Excel 2002 SP3 allows remote attackers to execute arbitrary code via an Excel file with a malformed RTD (0x813) record that triggers heap corruption, aka "Excel Memory Corruption Vulnerability," a different vulnerability than CVE-2010-0823 and CVE-2010-1249.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: excel
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://osvdb.org/65237, http://www.securityfocus.com/archive/1/511754/100/0/threaded, http://www.us-cert.gov/cas/techalerts/TA10-159B.html
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2010-5190
The Active Content Transformation functionality in Blue Coat ProxySG before SGOS 4.3.4.2, 5.x before SGOS 5.4.5.1, 5.5 before SGOS 5.5.4.1, and 6.x before SGOS 6.1.2.1 allows remote attackers to bypass JavaScript detection via HTML entities.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: proxysg_sg810-5, proxysg_sg210-5, proxysg_sg510-10, proxysg_sg9000-10, proxysg_sg510-20
Related CWEs: CWE-264
References: https://kb.bluecoat.com/index?page=content&id=SA48, https://kb.bluecoat.com/index?page=content&id=SA48
CWE: CWE-264
CVE-2010-4865
SQL injection vulnerability in the JE Guestbook (com_jeguestbook) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the d_itemid parameter in an item_detail action to index.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: com_jeguestbook, joomla\!
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://adv.salvatorefresta.net/JE_Guestbook_1.0_Joomla_Component_Multiple_Remote_Vulnerabilities-30092010.txt, http://osvdb.org/68283, http://secunia.com/advisories/41651
CWE: CWE-89
CVE-2010-2760
Use-after-free vulnerability in the nsTreeSelection function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 might allow remote attackers to execute arbitrary code via vectors involving a XUL tree selection, related to a "dangling pointer vulnerability." NOTE: this issue exists because of an incomplete fix for CVE-2010-2753.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: thunderbird, seamonkey, firefox
Related CWEs: CWE-399
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox, http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html, http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
CWE: CWE-399
CVE-2010-0602
The SIP implementation on the Cisco PGW 2200 Softswitch with software before 9.7(3)S11 allows remote attackers to cause a denial of service (device crash) via a malformed packet, aka Bug ID CSCsk32606.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: pgw_2200_softswitch
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://osvdb.org/64688, http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c519.shtml, http://www.securityfocus.com/bid/40120
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2010-0547
client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: samba
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://git.samba.org/?p=samba.git%3Ba=commit%3Bh=a065c177dfc8f968775593ba00dffafeebb2e054, http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html, http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2010-4179
The installation documentation for Red Hat Enterprise Messaging, Realtime and Grid (MRG) 1.3 recommends that Condor should be configured so that the MRG Management Console (cumin) can submit jobs for users, which creates a trusted channel with insufficient access control that allows local users with the ability to publish to a broker to run jobs as arbitrary users via Condor QMF plug-ins.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: enterprise_mrg
Related CWEs: CWE-264
References: http://secunia.com/advisories/42406, http://www.redhat.com/support/errata/RHSA-2010-0921.html, http://www.redhat.com/support/errata/RHSA-2010-0922.html
CWE: CWE-264
CVE-2010-0459
SQL injection vulnerability in the Mochigames (com_mochigames) component 0.51 and possibly other versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: com_mochigames, joomla\!
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstormsecurity.org/1001-exploits/joomlamochigames-sql.txt, http://www.exploit-db.com/exploits/11243, http://www.securityfocus.com/bid/37931
CWE: CWE-89
CVE-2010-5162
Race condition in G DATA TotalCare 2010 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.  NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute
CVSS v2.0 Score: 6.2 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
Affected Products: totalcare_2010, windows_xp
Related CWEs: CWE-362
Related CAPECs: CAPEC-29, CAPEC-26
References: http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html, http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html, http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/
CWE: CWE-362
CVE-2010-3183
The LookupGetterOrSetter function in js3250.dll in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 does not properly support window.__lookupGetter__ function calls that lack arguments, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference and application crash) via vectors involving a "dangling pointer" and the JS_ValueToId function.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: thunderbird, seamonkey, firefox
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox, http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html, http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
CWE: CWE-119
CVE-2010-0318
The replay functionality for ZFS Intent Log (ZIL) in FreeBSD 7.1, 7.2, and 8.0, when creating files during replay of a setattr transaction, uses 7777 permissions instead of the original permissions, which might allow local users to read or modify unauthorized files in opportunistic circumstances after a system crash or power failure.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: freebsd
Related CWEs: CWE-264
References: http://secunia.com/advisories/38124, http://security.FreeBSD.org/advisories/FreeBSD-SA-10:03.zfs.asc, http://www.securityfocus.com/bid/37657
CWE: CWE-264
CVE-2010-2598
LibTIFF in Red Hat Enterprise Linux (RHEL) 3 on x86_64 platforms, as used in tiff2rgba, attempts to process image data even when the required compression functionality is not configured, which allows remote attackers to cause a denial of service via a crafted TIFF image, related to "downsampled OJPEG input."
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: enterprise_linux
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://secunia.com/advisories/40536, http://www.redhat.com/support/errata/RHSA-2010-0520.html, http://www.vupen.com/english/advisories/2010/1761
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2010-3988
Unspecified vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to bypass intended access restrictions and cause a denial of service via unknown vectors.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: insight_control_virtual_machine_management
References: http://marc.info/?l=bugtraq&m=128811259326540&w=2, http://www.securitytracker.com/id?1024641, http://marc.info/?l=bugtraq&m=128811259326540&w=2
CVE-2010-2025
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 allow remote attackers to hijack the authentication of administrators for requests that (1) reset the modem, (2) erase the firmware, (3) change the administrative password, (4) install modified firmware, or (5) change the access level, as demonstrated by a request to goform/_aslvl.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: scientific_atlanta_webstar_dpc2100r2
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0322.html, http://www.securityfocus.com/bid/40346, http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0322.html
CWE: CWE-352
CVE-2010-4149
Directory traversal vulnerability in FreshWebMaster Fresh FTP 5.36, 5.37, and possibly earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: fresh_ftp
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://packetstormsecurity.org/1010-exploits/freshftp-traversal.txt, http://secunia.com/advisories/41798, http://www.htbridge.ch/advisory/directory_traversal_vulnerability_in_freshftp.html
CWE: CWE-22
CVE-2010-2185
Buffer overflow in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, might allow attackers to execute arbitrary code via unspecified vectors.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: flash_player, air
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751, http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html, http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.html
CWE: CWE-119
CVE-2010-0920
Cross-site scripting (XSS) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 allows remote attackers to inject arbitrary web script or HTML via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: lotus_domino, lotus_inotes
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www-01.ibm.com/support/docview.wss?uid=swg27018109, http://www.securityfocus.com/bid/38459, http://www.vupen.com/english/advisories/2010/0496
CWE: CWE-79
CVE-2010-0317
Novell Netware 6.5 SP8 allows remote attackers to cause a denial of service (NULL pointer dereference, memory consumption, ABEND, and crash) via a large number of malformed or AFP requests that are not properly handled by (1) the CIFS functionality in CIFS.nlm Semantic Agent (Build 163 MP) 3.27 or (2) the AFP functionality in AFPTCP.nlm Build 163 SP 3.27.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: netware
Related CWEs: CWE-399
References: http://protekresearch.blogspot.com/2010/01/prl-cifsnlm-memory-consumption-denial.html, http://secunia.com/advisories/38114, http://www.exploit-db.com/exploits/11009
CWE: CWE-399
CVE-2010-3662
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: typo3
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719, https://security-tracker.debian.org/tracker/CVE-2010-3662, https://typo3.org/security/advisory/typo3-sa-2010-012/#SQL_Injection
CWE: CWE-89
CVE-2010-3375
qtparted has insecure library loading which may allow arbitrary code execution
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: qtparted
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598301, https://people.canonical.com/~ubuntu-security/cve/2010/CVE-2010-3375.html, https://security-tracker.debian.org/tracker/CVE-2010-3375
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2010-0729
A certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 4 on the ia64 platform allows local users to use ptrace on an arbitrary process, and consequently gain privileges, via vectors related to a missing ptrace_check_attach call.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: enterprise_linux
Related CWEs: CWE-264
References: http://support.avaya.com/css/P8/documents/100090459, http://www.openwall.com/lists/oss-security/2010/03/12/2, http://www.redhat.com/support/errata/RHSA-2010-0394.html
CWE: CWE-264
CVE-2010-0946
SQL injection vulnerability in the Keep It Simple Stupid (KISS) Software Advertiser (com_ksadvertiser) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showcats action to index.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: com_ksadvertiser, joomla\!
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://explo.it/exploits/11068, http://www.securityfocus.com/bid/37682, https://exchange.xforce.ibmcloud.com/vulnerabilities/55526
CWE: CWE-89
CVE-2010-2982
Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 allows remote attackers to discover a group password via a series of SNMP requests, as demonstrated by an SNMP walk, aka Bug ID CSCtb74037.
CVSS v2.0 Score: 7.1 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:N/A:N
Affected Products: unified_wireless_network_solution_software
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://www.cisco.com/en/US/docs/wireless/controller/release/notes/crn7.0.html, http://www.cisco.com/en/US/docs/wireless/controller/release/notes/crn7.0.html
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2010-1331
SQL injection vulnerability in Heartlogic HL-SiteManager allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: hl-sitemanager
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://jvn.jp/en/jp/JVN60969543/index.html, http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000010.html, http://www.heartlogic.jp/docs/free_cgi/hl-sitemanager.html
CWE: CWE-89
CVE-2010-0265
Buffer overflow in Microsoft Windows Movie Maker 2.1, 2.6, and 6.0, and Microsoft Producer 2003, allows remote attackers to execute arbitrary code via a crafted project (.MSWMM) file, aka "Movie Maker and Producer Buffer Overflow Vulnerability."
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: windows_movie_maker, windows_7, windows_vista, windows_xp, producer
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://www.us-cert.gov/cas/techalerts/TA10-068A.html, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-016, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8595
CWE: CWE-119
CVE-2010-4890
Cross-site scripting (XSS) vulnerability in the Yet Another Calendar (ke_yac) extension before 1.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: typo3, ke_yac
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://typo3.org/extensions/repository/view/ke_yac/1.1.2/, http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/, http://www.securityfocus.com/bid/42945
CWE: CWE-79
CVE-2010-4513
Multiple cross-site scripting (XSS) vulnerabilities in Zimplit CMS 3.0, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter in a load action to zimplit.php and (2) client parameter to English_manual_version_2.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: zimplit_cms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://marc.info/?l=bugtraq&m=129182251500541&w=2, http://packetstormsecurity.org/files/view/96466/zimplit-xss.txt, http://secunia.com/advisories/41629
CWE: CWE-79
CVE-2010-1080
Cross-site scripting (XSS) vulnerability in view.php in Pulse CMS 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: pulse_cms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://osvdb.org/62475, http://packetstormsecurity.org/1002-exploits/pulsecms-xss.txt, http://secunia.com/advisories/38650
CWE: CWE-79
CVE-2010-1012
SQL injection vulnerability in the CleanDB (nf_cleandb) extension 1.0.7 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: typo3, nf_cleandb
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/, http://www.securityfocus.com/bid/38810, http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/
CWE: CWE-89
CVE-2010-2624
Multiple SQL injection vulnerabilities in iScripts EasySnaps 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) comment parameter to add_comments.php, (2) values parameter to tags_details.php, or (3) begin parameter to greetings.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: easysnaps
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/40448, http://www.exploit-db.com/exploits/14162, http://www.salvatorefresta.net/files/adv/iScripts%20EasySnaps%202.0%20Multiple%20SQL%20Injection%20Vulnerabilities-01072010.txt
CWE: CWE-89
CVE-2010-4864
SQL injection vulnerability in the Club Manager (com_clubmanager) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cm_id parameter in an equip presenta action to index.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: joomla\!, com_clubmanager
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstormsecurity.org/1010-exploits/joomlaclubmanager-sql.txt, http://securityreason.com/securityalert/8421, http://www.securityfocus.com/bid/43821
CWE: CWE-89
CVE-2010-3985
Cross-site scripting (XSS) vulnerability in HP Operations Orchestration before 9.0, when Internet Explorer 6.0 is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: operations_orchestration, internet_explorer
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02541822, http://osvdb.org/68906, http://secunia.com/advisories/41983
CWE: CWE-79
CVE-2010-0097
ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta does not properly validate DNSSEC (1) NSEC and (2) NSEC3 records, which allows remote attackers to add the Authenticated Data (AD) flag to a forged NXDOMAIN response for an existing domain.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: bind
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: ftp://ftp.sco.com/pub/unixware7/714/security/p535243_uw7/p535243b.txt, http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html, http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034196.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2010-2470
Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6.1 and 3.7 through 3.7.1, when use_suexec is enabled, uses world-readable permissions within (1) .bzr/ and (2) data/webdot/, which allows local users to obtain potentially sensitive data by reading files in these directories, a different vulnerability than CVE-2010-0180.
CVSS v2.0 Score: 1.9 (LOW)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N
Affected Products: bugzilla
Related CWEs: CWE-264
References: https://bugzilla.mozilla.org/show_bug.cgi?id=561797, https://bugzilla.mozilla.org/show_bug.cgi?id=561797
CWE: CWE-264
CVE-2010-1132
The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: spamassassin_milter_plugin
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html, http://bugs.debian.org/573228, http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038535.html
CWE: CWE-78
CVE-2010-2705
Unspecified vulnerability on the HP ProCurve 1800-24G switch with software PB.03.02 and earlier, and the ProCurve 1800-8G switch with software PA.03.02 and earlier, when SNMP is enabled, allows remote attackers to obtain sensitive information via unknown vectors.
CVSS v2.0 Score: 6.1 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:L/Au:N/C:C/I:N/A:N
Affected Products: procurve_switch_software, procurve_switch_1800-8g, procurve_switch_1800-24g
References: http://secunia.com/advisories/40867, https://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02436028, http://secunia.com/advisories/40867
CVE-2010-2366
Cross-site scripting (XSS) vulnerability in futomi CGI Cafe Access Analyzer CGI Professional, and Standard 4.0.2 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: access_analyzer_cgi
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://jvn.jp/en/jp/JVN35605523/index.html, http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000035.html, http://www.futomi.com/library/info/2010/20100910.html
CWE: CWE-79
CVE-2010-4622
Directory traversal vulnerability in WebSEAL in IBM Tivoli Access Manager for e-business 6.1.1 before 6.1.1-TIV-AWS-FP0001 on AIX allows remote attackers to read arbitrary files via a %uff0e%uff0e (encoded dot dot) in a URI.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: tivoli_access_manager_for_e-business, aix
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://secunia.com/advisories/42727, http://securitytracker.com/id?1024927, http://www-01.ibm.com/support/docview.wss?uid=swg24028829
CWE: CWE-22
CVE-2010-3305
Cross-site request forgery (CSRF) vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: pixelpost
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://access.redhat.com/security/cve/cve-2010-3305, https://security-tracker.debian.org/tracker/CVE-2010-3305, https://www.exploit-db.com/exploits/15014
CWE: CWE-352
CVE-2010-1213
The importScripts Web Worker method in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not verify that content is valid JavaScript code, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted HTML document.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: thunderbird, seamonkey, firefox
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://www.mozilla.org/security/announce/2010/mfsa2010-42.html, https://bugzilla.mozilla.org/show_bug.cgi?id=568148, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11835
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2010-1739
SQL injection vulnerability in the Newsfeeds (com_newsfeeds) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the feedid parameter in a categories action to index.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: joomla\!, com_newsfeeds
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstormsecurity.org/1004-exploits/joomlanewsfeeds-sql.txt, http://www.exploit-db.com/exploits/12465, http://www.securityfocus.com/bid/39834
CWE: CWE-89
CVE-2010-3206
Multiple PHP remote file inclusion vulnerabilities in DiY-CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lang parameter to modules/guestbook/blocks/control.block.php, (2) main_module parameter to index.php, and (3) getFile parameter to includes/general.functions.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: diy-cms
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://packetstormsecurity.org/1008-exploits/diycms-rfi.txt, http://www.exploit-db.com/exploits/14822, https://exchange.xforce.ibmcloud.com/vulnerabilities/61454
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2010-5078
SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain version information via a direct request to (1) apphire/silverstripe_version or (2) cms/silverstripe_version.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: silverstripe
Related CWEs: CWE-264
References: http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10, http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4, http://open.silverstripe.org/ticket/5031
CWE: CWE-264
CVE-2010-1665
Google Chrome before 4.1.249.1064 does not properly handle fonts, which allows remote attackers to cause a denial of service (memory corruption) and possibly have unspecified other impact via unknown vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: chrome
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://code.google.com/p/chromium/issues/detail?id=42294, http://googlechromereleases.blogspot.com/2010/04/stable-update-bug-and-security-fixes.html, http://secunia.com/advisories/39651
CWE: CWE-119
CVE-2010-2835
Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5), 7.0 before 7.0(2a)su3, 7.1su before 7.1(3b)su2, 7.1 before 7.1(5), and 8.0 before 8.0(1) allow remote attackers to cause a denial of service (device reload or voice-services outage) via a SIP REFER request with an invalid Refer-To header, aka Bug IDs CSCta20040 and CSCta31358.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: ios_xe, ios, unified_communications_manager
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a30f.shtml, http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a313.shtml, http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a30f.shtml
CVE-2010-2466
The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not properly prevent downloading of database backups, which allows remote attackers to obtain sensitive information via requests for full_*.dar files with predictable filenames.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: netbox, emerge_50, emerge_5000, eaccess
Related CWEs: CWE-264
References: http://blip.tv/file/3414004, http://www.darkreading.com/blog/archives/2010/04/attacking_door.html, http://www.kb.cert.org/vuls/id/228737
CWE: CWE-264
CVE-2010-2589
Integer overflow in the dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code via unspecified vectors.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: shockwave_player
Related CWEs: CWE-189
References: http://www.adobe.com/support/security/bulletins/apsb11-01.html, http://www.securityfocus.com/bid/46329, http://www.securitytracker.com/id?1025056
CWE: CWE-189
CVE-2010-2230
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: moodle
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://cvs.moodle.org/moodle/lib/weblib.php?r1=1.812.2.114&r2=1.812.2.115, http://cvs.moodle.org/moodle/lib/weblib.php?r1=1.970.2.171&r2=1.970.2.172, http://docs.moodle.org/en/Moodle_1.8.13_release_notes
CWE: CWE-79
CVE-2010-5050
Cross-site scripting (XSS) vulnerability in jsp/admin/tools/remote_share.jsp in ManageEngine ADManager Plus 4.4.0 allows remote attackers to inject arbitrary web script or HTML via the computerName parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: manageengine_admanager_plus
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://osvdb.org/64857, http://secunia.com/advisories/39901, http://www.securityfocus.com/bid/40355
CWE: CWE-79
CVE-2010-0045
Apple Safari before 4.0.5 on Windows does not properly validate external URL schemes, which allows remote attackers to open local files and execute arbitrary code via a crafted HTML document.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: windows, safari
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html, http://support.apple.com/kb/HT4070, http://www.securityfocus.com/bid/38671
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2010-4694
Buffer overflow in gif2png.c in gif2png 2.5.3 and earlier might allow context-dependent attackers to cause a denial of service (application crash) or have unspecified other impact via a GIF file that contains many images, leading to long extensions such as .p100 for PNG output files, as demonstrated by a CGI program that launches gif2png, a different vulnerability than CVE-2009-5018.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: gif2png
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550978, http://bugs.gentoo.org/show_bug.cgi?id=346501, http://cvs.fedoraproject.org/viewvc/rpms/gif2png/devel/gif2png-overflow.patch?revision=HEAD&root=extras&view=markup
CWE: CWE-119
CVE-2010-3532
Unspecified vulnerability in the PeopleSoft Enterprise CRM - Order Capture component in Oracle PeopleSoft and JDEdwards Suite 9.0 Bundle #28 and 9.1 Bundle #4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS v2.0 Score: 5.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N
Affected Products: peoplesoft_and_jdedwards_product_suite
References: http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html, http://www.us-cert.gov/cas/techalerts/TA10-287A.html, http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
CVE-2010-0469
SQL injection vulnerability in Files2Links F2L 3000 appliance 4.0.0, and possibly other versions and models, allows remote attackers to execute arbitrary SQL commands via unspecified parameters to the login page.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: f2l_3000_appliance
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0499.html, http://osvdb.org/61976, http://packetstormsecurity.org/1001-advisories/DDIVRT-2009-27.txt
CWE: CWE-89
CVE-2010-1654
Multiple SQL injection vulnerabilities in system_member_login.php in Infocus Real Estate Enterprise Edition allow remote attackers to execute arbitrary SQL commands via the (1) username (aka login) and (2) password parameters.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: infocus_real_estate
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstormsecurity.org/1004-exploits/ireee-sql.txt, http://secunia.com/advisories/39625, http://www.exploit-db.com/exploits/12415
CWE: CWE-89