Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rce that is separate from the distribution of the plugin itself. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2012/dsa-2426 - http://security.gentoo.org/glsa/glsa-201209-23.xml - https://bugzilla.redhat.com/show_bug.cgi?id=666793 - http://www.vupen.com/english/advisories/2011/0016 - http://www.redhat.com/support/errata/RHSA-2011-0839.html - http://www.redhat.com/support/errata/RHSA-2011-0837.html - http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html - http://www.redhat.com/support/errata/RHSA-2011-0838.html - http://openwall.com/lists/oss-security/2011/01/04/7 - http://secunia.com/advisories/44750 - http://secunia.com/
8.html - http://openwall.com/lists/oss-security/2011/01/04/7 - http://secunia.com/advisories/44750 - http://secunia.com/advisories/42771 - http://osvdb.org/70281 - http://secunia.com/advisories/50737 - http://openwall.com/lists/oss-security/2011/01/03/2 - http://secunia.com/advisories/48236 - https://exchange.xforce.ibmcloud.com/vulnerabilities/64581 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608497 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:103
CVE ID: CVE-2010-4542 State: PUBLISHED Published: 2011-01-07T19:00:00 Last Updated: 2024-08-07T03:51:17.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the gfig_read_parameter_gimp_rgb function in plug-ins/gfig/gfig-style.c in the GFIG plugin in GIMP 2.6.11 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long Foreground field in a plugin configuration file. NOTE: it may be uncommon to obtain a GIMP plugin configuration file from an untrusted source that is separate from the distribution of the plugin itself. NOTE: some of these details are obtained from third party i
that is separate from the distribution of the plugin itself. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2012/dsa-2426 - http://security.gentoo.org/glsa/glsa-201209-23.xml - https://bugzilla.redhat.com/show_bug.cgi?id=666793 - http://www.vupen.com/english/advisories/2011/0016 - http://www.redhat.com/support/errata/RHSA-2011-0839.html - http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html - http://www.redhat.com/support/errata/RHSA-2011-0838.html - http://openwall.com/lists/oss-security/2011/01/04/7 - http://secunia.com/advisories/44750 - http://secu
2011-0838.html - http://openwall.com/lists/oss-security/2011/01/04/7 - http://secunia.com/advisories/44750 - http://secunia.com/advisories/42771 - http://secunia.com/advisories/50737 - http://openwall.com/lists/oss-security/2011/01/03/2 - http://secunia.com/advisories/48236 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608497 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:103 - http://osvdb.org/70283
CVE ID: CVE-2010-4543 State: PUBLISHED Published: 2011-01-07T19:00:00 Last Updated: 2024-08-07T03:51:17.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the read_channel_data function in file-psp.c in the Paint Shop Pro (PSP) plugin in GIMP 2.6.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a PSP_COMP_RLE (aka RLE compression) image file that begins a long run count at the end of the image. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2012/dsa-2426 - http://sec
ditional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2012/dsa-2426 - http://security.gentoo.org/glsa/glsa-201209-23.xml - http://osvdb.org/70284 - https://bugzilla.redhat.com/show_bug.cgi?id=666793 - http://www.vupen.com/english/advisories/2011/0016 - http://www.redhat.com/support/errata/RHSA-2011-0839.html - http://www.redhat.com/support/errata/RHSA-2011-0837.html - http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html - http://www.redhat.com/support/errata/RHSA-2011-0838.html - http://openwall.com/lists/oss-security/2011/01/04/7 - http://secunia.com/advisories/44750 - http://secunia.com/advisories/42771 - http://secunia.com/advi
urity/2011/01/04/7 - http://secunia.com/advisories/44750 - http://secunia.com/advisories/42771 - http://secunia.com/advisories/50737 - http://openwall.com/lists/oss-security/2011/01/03/2 - http://secunia.com/advisories/48236 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608497 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:103
CVE ID: CVE-2010-4544 State: PUBLISHED Published: 2010-12-16T19:45:00 Last Updated: 2024-08-07T03:51:17.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the servlet in IBM Lotus Notes Traveler before 8.5.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/3193 - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes - http://www-1.ibm.com/support/docview.wss?uid=swg1LO52324 - https://exchange.xforce.ibmcloud.com/vulnerabilities/63977
CVE ID: CVE-2010-4545 State: PUBLISHED Published: 2010-12-16T19:45:00Z Last Updated: 2024-09-17T01:36:32.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Lotus Notes Traveler before 8.5.1.2 allows remote authenticated users to cause a denial of service (resource consumption and sync outage) by syncing a large volume of data. Additional Analyst Notes: - CVE Program Container: References: - http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes - http://www-1.ibm.com/support/docview.wss?uid=swg1LO49125
CVE ID: CVE-2010-4546 State: PUBLISHED Published: 2010-12-16T19:45:00Z Last Updated: 2024-09-16T19:01:45.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Lotus Notes Traveler before 8.5.1.2 does not reject an attachment download request for an e-mail message with a Prevent Copy attribute, which allows remote authenticated users to bypass intended access restrictions via this request. Additional Analyst Notes: - CVE Program Container: References: - http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes - http://www-1.ibm.com
cument - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes - http://www-1.ibm.com/support/docview.wss?uid=swg1LO49840
CVE ID: CVE-2010-4547 State: PUBLISHED Published: 2010-12-16T19:45:00Z Last Updated: 2024-09-17T01:41:28.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Lotus Notes Traveler before 8.5.1.3, when a multidomain environment is used, does not properly apply policy documents to mobile users from a different Domino domain than the Traveler server, which allows remote authenticated users to bypass intended access restrictions by using credentials from a different domain. Additional Analyst Notes: - CVE Program Container: References: - http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument - http://www-10.lotus.com/ldd/
d/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes - http://www-1.ibm.com/support/docview.wss?uid=swg1LO49967
CVE ID: CVE-2010-4548 State: PUBLISHED Published: 2010-12-16T19:45:00Z Last Updated: 2024-09-17T02:47:48.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Lotus Notes Traveler before 8.5.1.2 allows remote authenticated users to cause a denial of service (daemon crash) by accepting a meeting invitation with an iNotes client and then accepting this meeting invitation with an iPhone client. Additional Analyst Notes: - CVE Program Container: References: - http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes - http://www-1.ibm.
nDocument - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes - http://www-1.ibm.com/support/docview.wss?uid=swg1LO48594
CVE ID: CVE-2010-4549 State: PUBLISHED Published: 2010-12-16T19:45:00Z Last Updated: 2024-09-16T16:17:42.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Lotus Notes Traveler before 8.5.1.3 on the Nokia s60 device successfully performs a Replace Data operation for a prohibited application, which allows remote authenticated users to bypass intended access restrictions via this operation. Additional Analyst Notes: - CVE Program Container: References: - http://www-1.ibm.com/support/docview.wss?uid=swg1LO53572 - http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lot
.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes
CVE ID: CVE-2010-4550 State: PUBLISHED Published: 2010-12-16T19:45:00Z Last Updated: 2024-09-16T23:46:38.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Lotus Notes Traveler before 8.5.1.3 allows remote attackers to cause a denial of service (sync failure) via a malformed document. Additional Analyst Notes: - CVE Program Container: References: - http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes - http://www-1.ibm.com/support/docview.wss?uid=swg1LO51818
CVE ID: CVE-2010-4551 State: PUBLISHED Published: 2010-12-16T19:45:00Z Last Updated: 2024-09-17T01:31:31.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Lotus Notes Traveler before 8.5.1.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by omitting the Internet ID field in the person document, and then using an Apple device to (1) accept or (2) decline an invitation. Additional Analyst Notes: - CVE Program Container: References: - http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_8
04E906E0DF2DF8525778B005D4466&action=openDocument - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes - http://www-1.ibm.com/support/docview.wss?uid=swg1LO49829
CVE ID: CVE-2010-4552 State: PUBLISHED Published: 2010-12-16T19:45:00Z Last Updated: 2024-09-16T22:20:12.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in IBM Lotus Notes Traveler before 8.5.1.1 allows remote attackers to cause a denial of service (memory consumption and daemon outage) by sending many embedded objects in e-mail messages for iPhone clients. Additional Analyst Notes: - CVE Program Container: References: - http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes - http://www-1.ibm.com/support/docview.w
w-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes - http://www-1.ibm.com/support/docview.wss?uid=swg1LO46561
CVE ID: CVE-2010-4553 State: PUBLISHED Published: 2010-12-16T19:45:00Z Last Updated: 2024-09-17T00:10:36.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unspecified Domino API in IBM Lotus Notes Traveler before 8.5.1.1 does not properly handle MIME types, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument - http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes - http://www-1.ibm.com/support/docview.wss?uid=swg1LO4
/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes - http://www-1.ibm.com/support/docview.wss?uid=swg1LO45478
CVE ID: CVE-2010-4554 State: PUBLISHED Published: 2011-07-14T23:00:00 Last Updated: 2024-08-07T03:51:17.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: functions/page_header.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2011/dsa-2291 - https://exchange.xforce.ibmcloud.com/vulnerabilities/68512 - http://support.apple.com/kb/HT5130 - http://www.squirrelmail.org/security/issue/2011-07-12 - https://bugzilla.redhat.com
http://support.apple.com/kb/HT5130 - http://www.squirrelmail.org/security/issue/2011-07-12 - https://bugzilla.redhat.com/show_bug.cgi?id=720693 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:123 - http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html - http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/page_header.php?view=patch&r1=14117&r2=14116&pathrev=14117 - http://rhn.redhat.com/errata/RHSA-2012-0103.html
CVE ID: CVE-2010-4555 State: PUBLISHED Published: 2011-07-14T23:00:00 Last Updated: 2024-08-07T03:51:17.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) drop-down selection lists, (2) the > (greater than) character in the SquirrelSpell spellchecking plugin, and (3) errors associated with the Index Order (aka options_order) page. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2011/dsa-2291 - http://support.apple.com/kb/HT5130 - https://exchange.xforce.ibmclo
es: - http://www.debian.org/security/2011/dsa-2291 - http://support.apple.com/kb/HT5130 - https://exchange.xforce.ibmcloud.com/vulnerabilities/68510 - https://exchange.xforce.ibmcloud.com/vulnerabilities/68511 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:123 - http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html - http://www.squirrelmail.org/security/issue/2011-07-11 - http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119 - https://bugzilla.redhat.com/show_bug.cgi?id=720694 - http://rhn.redhat.com/errata/RHSA-2012-0103.html
CVE ID: CVE-2010-4556 State: PUBLISHED Published: 2010-12-17T18:00:00 Last Updated: 2024-08-07T03:51:17.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the SapThemeRepository ActiveX control (sapwdpcd.dll) in SAP NetWeaver Business Client allows remote attackers to execute arbitrary code via the (1) Load and (2) LoadTheme methods. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-10-290/ - http://www.vupen.com/english/advisories/2010/3239 - http://www.securitytracker.com/id?1024890 - https://service.sap.com/sap/support/notes/1519966 - http://www.securityfocus.com/bid/45396 - https://
r.com/id?1024890 - https://service.sap.com/sap/support/notes/1519966 - http://www.securityfocus.com/bid/45396 - https://exchange.xforce.ibmcloud.com/vulnerabilities/64061 - http://secunia.com/advisories/35796
CVE ID: CVE-2010-4557 State: PUBLISHED Published: 2010-12-17T18:00:00Z Last Updated: 2024-09-16T22:45:48.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the lm_tcp service in Invensys Wonderware InBatch 8.1 and 9.0, as used in Invensys Foxboro I/A Series Batch 8.1 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted request to port 9001. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.org/adv/inbatch_1-adv.txt - http://iom.invensys.com/EN/Pages/IOM_CyberSecurityUpdates.aspx - http://www.exploit-db.com/exploits/15707 - http://iom.invensys.com
invensys.com/EN/Pages/IOM_CyberSecurityUpdates.aspx - http://www.exploit-db.com/exploits/15707 - http://iom.invensys.com/EN/pdfLibrary/SecurityAlert_Invensys_SecurityAlert-LFSEC00000051_12-10.pdf - http://secunia.com/advisories/42528 - http://www.vupen.com/english/advisories/2010/3244 - http://www.us-cert.gov/control_systems/pdf/ICSA-10-348-01.pdf - http://www.kb.cert.org/vuls/id/647928
CVE ID: CVE-2010-4558 State: PUBLISHED Published: 2010-12-17T18:00:00Z Last Updated: 2024-09-17T02:11:36.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpMyFAQ 2.6.11 and 2.6.12, as distributed between December 4th and December 15th 2010, contains an externally introduced modification (Trojan Horse) in the getTopTen method in inc/Faq.php, which allows remote attackers to execute arbitrary PHP code. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/45442 - http://www.vupen.com/english/advisories/2010/3254 - http://secunia.com/advisories/42622 - http://www.phpmyfaq.de/advisory_2010-12-15.php
CVE ID: CVE-2010-4559 State: REJECTED Published: 2012-02-05T11:00:00Z Last Updated: 2024-09-16T23:46:08.267Z Description: No description available.
CVE ID: CVE-2010-4560 State: REJECTED Published: 2012-02-05T11:00:00Z Last Updated: 2024-09-17T01:40:48.143Z Description: No description available.
CVE ID: CVE-2010-4562 State: PUBLISHED Published: 2012-02-02T17:00:00Z Last Updated: 2024-09-17T03:12:24.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Windows 2008, 7, Vista, 2003, 2000, and XP, when using IPv6, allows remote attackers to determine whether a host is sniffing the network by sending an ICMPv6 Echo Request to a multicast address and determining whether an Echo Reply is sent, as demonstrated by thcping. NOTE: due to a typo, some sources map CVE-2010-4562 to a ProFTPd mod_sql vulnerability, but that issue is covered by CVE-2010-4652. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2011/Apr/254 - http:
Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2011/Apr/254 - http://seclists.org/dailydave/2011/q2/25
CVE ID: CVE-2010-4563 State: PUBLISHED Published: 2012-02-02T17:00:00Z Last Updated: 2024-09-16T21:02:43.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel, when using IPv6, allows remote attackers to determine whether a host is sniffing the network by sending an ICMPv6 Echo Request to a multicast address and determining whether an Echo Reply is sent, as demonstrated by thcping. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2011/Apr/254 - http://seclists.org/dailydave/2011/q2/25
CVE ID: CVE-2010-4565 State: PUBLISHED Published: 2010-12-29T17:27:00 Last Updated: 2024-08-07T03:51:17.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bcm_connect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel 2.6.36 and earlier creates a publicly accessible file with a filename containing a kernel memory address, which allows local users to obtain potentially sensitive information about kernel memory use by listing this filename. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2010/12/20/2 - http://www.spinics.net/lists/netdev/msg145796.
iner: References: - http://openwall.com/lists/oss-security/2010/12/20/2 - http://www.spinics.net/lists/netdev/msg145796.html - http://www.spinics.net/lists/netdev/msg146270.html - http://openwall.com/lists/oss-security/2010/12/21/1 - http://openwall.com/lists/oss-security/2010/11/04/4 - https://bugzilla.redhat.com/show_bug.cgi?id=664544 - http://www.spinics.net/lists/netdev/msg146468.html - http://www.spinics.net/lists/netdev/msg145791.html - http://www.securityfocus.com/bid/44661 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:029 - http://openwall.com/lists/oss-security/2010/11/03/3
CVE ID: CVE-2010-4566 State: PUBLISHED Published: 2011-01-14T22:00:00 Last Updated: 2024-08-07T03:51:17.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and earlier, and the NTLM authentication component in Access Gateway Standard and Advanced Editions before Access Gateway 5.0, allows attackers to execute arbitrary commands via shell metacharacters in the password field. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1024893 - http://www.vsecurity.com/resources/advisory/20101221-1 - http://support.citrix.com/a
ww.securitytracker.com/id?1024893 - http://www.vsecurity.com/resources/advisory/20101221-1 - http://support.citrix.com/article/CTX127613 - http://securityreason.com/securityalert/8119 - http://www.osvdb.org/70099 - http://www.exploit-db.com/exploits/16916
CVE ID: CVE-2010-4567 State: PUBLISHED Published: 2011-01-28T15:00:00 Last Updated: 2024-08-07T03:51:17.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly handle whitespace preceding a (1) javascript: or (2) data: URI, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the URL (aka bug_file_loc) field. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/45982 - https://bugzilla.mozilla.org/show_bug.cgi?id=619588 - http://secunia.com/advisories/43165 - http://www.bugzilla.org/security/3.2.9/ - http://
lla.org/show_bug.cgi?id=619588 - http://secunia.com/advisories/43165 - http://www.bugzilla.org/security/3.2.9/ - http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html - http://www.vupen.com/english/advisories/2011/0271 - http://secunia.com/advisories/43033 - http://www.vupen.com/english/advisories/2011/0207 - http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html - http://www.debian.org/security/2011/dsa-2322 - http://osvdb.org/70699 - https://exchange.xforce.ibmcloud.com/vulnerabilities/65004
CVE ID: CVE-2010-4568 State: PUBLISHED Published: 2011-01-28T15:00:00 Last Updated: 2024-08-07T03:51:17.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/45982 - http://secunia.com/advisories/43165 - http://osvdb.org/70700 - http