Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2010-4395 State: PUBLISHED Published: 2010-12-14T15:00:00 Last Updated: 2024-08-07T03:43:14.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via a crafted conditional component in AAC frame data. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/69854 - http://www.securitytracker.com/id?1024861 - http://www.zerodayinitiative.com/advisories/ZDI-10-267 - http://service.real.com/realplayer/security/12102010_player/en/
CVE ID: CVE-2010-4396 State: PUBLISHED Published: 2010-12-14T15:00:00 Last Updated: 2024-08-07T03:43:14.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-zone scripting vulnerability in the HandleAction method in a certain ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 allows remote attackers to inject arbitrary web script or HTML in the Local Zone by specifying a local file in a NavigateToURL action, as demonstrated by a local skin file. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/69855 - http://www.zerodayinitiative.com/advisories/ZDI-10-275 - http://www
am Container: References: - http://osvdb.org/69855 - http://www.zerodayinitiative.com/advisories/ZDI-10-275 - http://www.securitytracker.com/id?1024861 - http://service.real.com/realplayer/security/12102010_player/en/
CVE ID: CVE-2010-4397 State: PUBLISHED Published: 2010-12-14T15:00:00 Last Updated: 2024-08-07T03:43:14.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the pnen3260.dll module in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via a crafted TIT2 atom in an AAC file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1024861 - http://osvdb.org/69856 - http://service.real.com/realplayer/security/12102010_player/en/ - http://www.zerodayinitiative.com/advisories/ZDI-10-2
- http://service.real.com/realplayer/security/12102010_player/en/ - http://www.zerodayinitiative.com/advisories/ZDI-10-269
CVE ID: CVE-2010-4398 State: PUBLISHED Published: 2010-12-03T20:00:00.000Z Last Updated: 2025-10-22T00:05:50.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
Interaction with Windows Kernel Vulnerability." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://isc.sans.edu/diary.html?storyid=9988 - http://www.securityfocus.com/bid/45045 - http://www.exploit-db.com/exploits/15609/ - http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uac/ - http://support.avaya.com/css/P8/documents/100127248 - http://www.vupen.com/english/advisories/2011/0324 - http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ - http://twitter.com/msftsecresponse/statuses/7590788200402945 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-011 - ht
ponse/statuses/7590788200402945 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-011 - http://www.securitytracker.com/id?1025046 - http://www.kb.cert.org/vuls/id/529673 - http://secunia.com/advisories/42356 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12162
CVE ID: CVE-2010-4399 State: PUBLISHED Published: 2010-12-04T23:00:00Z Last Updated: 2024-09-16T18:08:58.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in languages.inc.php in DynPG CMS 4.1.1 and 4.2.0, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the CHG_DYNPG_SET_LANGUAGE parameter to index.php. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.dynpg.org/cms-freeware_en.php?t=DynPG+Update+4.2.1+Security+Update&read_article=226 - http://www.securityfocus.com/bid/45115 - http://secunia.c
en.php?t=DynPG+Update+4.2.1+Security+Update&read_article=226 - http://www.securityfocus.com/bid/45115 - http://secunia.com/advisories/42380 - http://osvdb.org/69539 - http://packetstormsecurity.org/files/view/96230/dynpg-lfisqldisclose.txt - http://www.htbridge.ch/advisory/lfi_in_dynpg.html - http://www.exploit-db.com/exploits/15646
CVE ID: CVE-2010-4400 State: PUBLISHED Published: 2010-12-04T23:00:00 Last Updated: 2024-08-07T03:43:14.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in _rights.php in DynPG CMS 4.2.0 allows remote attackers to execute arbitrary SQL commands via the giveRights_UserId parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.dynpg.org/cms-freeware_en.php?t=DynPG+Update+4.2.1+Security+Update&read_article=226 - http://www.securityfocus.com/bid/45115 - http://packetstormsecurity.org/files/view/96230/dynpg-lfisqldisclose.txt - http://www.htbridge.ch/advisory/sql_injection_in_dynpg.html - http://osvdb.org/69631 - http://www
g-lfisqldisclose.txt - http://www.htbridge.ch/advisory/sql_injection_in_dynpg.html - http://osvdb.org/69631 - http://www.exploit-db.com/exploits/15646
CVE ID: CVE-2010-4401 State: PUBLISHED Published: 2010-12-04T23:00:00 Last Updated: 2024-08-07T03:43:14.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: languages.inc.php in DynPG CMS 4.2.0 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://www.dynpg.org/cms-freeware_en.php?t=DynPG+Update+4.2.1+Security+Update&read_article=226 - http://packetstormsecurity.org/files/view/96230/dynpg-lfisqldisclose.txt - http://www.htbridge.ch/advisory/path_disclosure_in_dynpg.html - http://www.exploit-db.com/exploits/15646 - http://osvdb.org
p://www.htbridge.ch/advisory/path_disclosure_in_dynpg.html - http://www.exploit-db.com/exploits/15646 - http://osvdb.org/69632
CVE ID: CVE-2010-4402 State: PUBLISHED Published: 2010-12-04T23:00:00 Last Updated: 2024-08-07T03:43:14.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) jabber, (7) about, (8) pass1, and (9) pass2 parameters in a register action. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/4539 - http://packetstormsecurity.org/files/view/96143/registerplus-xss.txt - http://www.securityfoc
/websecurity.com.ua/4539 - http://packetstormsecurity.org/files/view/96143/registerplus-xss.txt - http://www.securityfocus.com/bid/45057 - http://secunia.com/advisories/42360 - http://osvdb.org/69491 - http://www.securityfocus.com/archive/1/514903/100/0/threaded
CVE ID: CVE-2010-4403 State: PUBLISHED Published: 2010-12-04T23:00:00 Last Updated: 2024-08-07T03:43:14.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php and (2) register-plus.php, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/4539 - http://packetstormsecurity.org/files/view/96143/registerplus-xss.txt - http://www.securityfocus.com/archive/1/514903/100/0/threaded
CVE ID: CVE-2010-4404 State: PUBLISHED Published: 2010-12-04T23:00:00Z Last Updated: 2024-09-16T18:55:15.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Yannick Gaultier sh404SEF component before 2.1.8.777 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/42430 - http://twitter.com/jeffchannell/status/8603529560195072 - http://dev.anything-digital.com/Forum/Announcements/9100-Urgent-sh404SEF-security-release-Joomla-1.5/ - http://www.securityfocus.com/bid/45135
CVE ID: CVE-2010-4405 State: PUBLISHED Published: 2010-12-04T23:00:00Z Last Updated: 2024-09-16T19:41:25.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Yannick Gaultier sh404SEF component before 2.1.8.777 for Joomla! allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://dev.anything-digital.com/Forum/Announcements/9100-Urgent-sh404SEF-security-release-Joomla-1.5/ - http://secunia.com/advisories/42430 - http://twitter.com/jeffchannell/status/8603529560195072 - http://www.securityfocus.com/bid/45135
CVE ID: CVE-2010-4406 State: PUBLISHED Published: 2010-12-04T23:00:00 Last Updated: 2024-08-07T03:43:14.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in gallery.php in Brunetton LittlePhpGallery 1.0.2, when magic_quotes_gpc is disabled, allows remote attackers to list, include, and execute arbitrary local files via a ..// (dot dot slash slash) in the repertoire parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/45143 - http://secunia.com/advisories/42444 - http://www.exploit-db.com/exploits/15656 - http://packetstormsecurity.org/files/view/96296/littlephpgallery-lfi.txt - http://osvd
w.exploit-db.com/exploits/15656 - http://packetstormsecurity.org/files/view/96296/littlephpgallery-lfi.txt - http://osvdb.org/69564
CVE ID: CVE-2010-4407 State: PUBLISHED Published: 2010-12-04T23:00:00 Last Updated: 2024-08-07T03:43:14.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in AlGuest 1.1c-patched allow remote attackers to inject arbitrary web script or HTML via the (1) nome (nickname), (2) messaggio (message), and (3) link (homepage) parameters. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/files/view/96297/alguest-xss.txt - http://www.securityfocus.com/bid/45140 - http://www.securityfocus.com/archive/1/514960/100/0/threaded - http://evuln.com/vulns/151/summary.html
CVE ID: CVE-2010-4408 State: PUBLISHED Published: 2010-12-06T20:00:00 Last Updated: 2024-08-07T03:43:14.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a (1) unattended workstation or (2) cross-site request forgery (CSRF) vulnerability, a related issue to CVE-2010-3449. Additional Analyst Notes: - CVE Program Container: References: - http://archiva.apache.org/security.html - http://mail-archives.apache.o
st Notes: - CVE Program Container: References: - http://archiva.apache.org/security.html - http://mail-archives.apache.org/mod_mbox/archiva-users/201011.mbox/ajax/%3CAANLkTimXejHAuXdoUKLN=GkNty1_XnRCbv0YA0T2cS_2%40mail.gmail.com%3E - http://www.securityfocus.com/archive/1/514937/100/0/threaded
CVE ID: CVE-2010-4409 State: PUBLISHED Published: 2010-12-06T20:00:00 Last Updated: 2024-08-07T03:43:14.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument. Additional Analyst Notes: - CVE Program Container: References: - http://svn.php.net/viewvc?view=revision&revision=305571 - http://www.vupen.com/english/advisories/2011/0077 - http://secunia.com/advisories/47674 - http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html - http://secunia.c
advisories/47674 - http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html - http://secunia.com/advisories/42812 - http://www.mandriva.com/security/advisories?name=MDVSA-2010:255 - http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html - http://www.ubuntu.com/usn/USN-1042-1 - http://www.vupen.com/english/advisories/2011/0021 - http://www.php.net/ChangeLog-5.php - http://lists.opensuse.org/opensuse-updates/2012-01/msg00035.html - http://www.securityfocus.com/archive/1/515142/100/0/threaded - http://www.mandriva.com/security/advisories?name=MDVSA-2010:254 - http://www.exploit-db.com/exploits/15722 - http://lists.fedoraproject.org/pipermail/package-a
ries?name=MDVSA-2010:254 - http://www.exploit-db.com/exploits/15722 - http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html - http://www.vupen.com/english/advisories/2011/0020 - http://svn.php.net/viewvc/php/php-src/trunk/ext/intl/formatter/formatter_attr.c?r1=305571&r2=305570&pathrev=305571 - http://www.securityfocus.com/bid/45119 - http://support.apple.com/kb/HT4581 - http://www.kb.cert.org/vuls/id/479900
CVE ID: CVE-2010-4410 State: PUBLISHED Published: 2010-12-06T20:00:00 Last Updated: 2024-08-07T03:43:14.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172. Additional Analyst Notes: - CVE Program Container: References: - http://perl5.git.perl.org/perl.git/blobdiff/a0b94c2432b1d8c20653453a0f6970cb10f59aec..84601d
am Container: References: - http://perl5.git.perl.org/perl.git/blobdiff/a0b94c2432b1d8c20653453a0f6970cb10f59aec..84601d63a7e34958da47dad1e61e27cb3bd467d1:/cpan/CGI/lib/CGI.pm - http://www.redhat.com/support/errata/RHSA-2011-1797.html - http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053591.html - http://secunia.com/advisories/43068 - http://openwall.com/lists/oss-security/2010/12/01/2 - http://openwall.com/lists/oss-security/2010/12/01/3 - http://www.vupen.com/english/advisories/2011/0212 - http://www.mandriva.com/security/advisories?name=MDVSA-2010:252 - http://www.securityfocus.com/bid/44199 - http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.htm
252 - http://www.securityfocus.com/bid/44199 - http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html - https://bugzilla.redhat.com/show_bug.cgi?id=658970 - http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html - http://perl5.git.perl.org/perl.git/commit/84601d63a7e34958da47dad1e61e27cb3bd467d1 - http://www.vupen.com/english/advisories/2010/3230 - http://www.vupen.com/english/advisories/2011/0249 - http://www.securityfocus.com/bid/45145 - http://www.nntp.perl.org/group/perl.perl5.changes/2010/11/msg28043.html - http://www.mandriva.com/security/advisories?name=MDVSA-2010:237 - http://openwall.com/lists/oss-security/2010/12/01/1 - http://cpansearch.perl
m/security/advisories?name=MDVSA-2010:237 - http://openwall.com/lists/oss-security/2010/12/01/1 - http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes - http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053576.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 - http://secunia.com/advisories/43147 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
CVE ID: CVE-2010-4411 State: PUBLISHED Published: 2010-12-06T20:00:00 Last Updated: 2024-08-07T03:43:14.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unknown vectors. NOTE: this issue exists because of an incomplete fix for CVE-2010-2761. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/43068 - http://secunia.com/advisories/43165 - http://openwall.com/lists/oss-security/2010/12/01/3 - http://www.vupen.com/english/advisories/2011/0212 - https://bugzilla.mozilla.org/show_bug.
s/oss-security/2010/12/01/3 - http://www.vupen.com/english/advisories/2011/0212 - https://bugzilla.mozilla.org/show_bug.cgi?id=591165 - http://www.bugzilla.org/security/3.2.9/ - http://www.mandriva.com/security/advisories?name=MDVSA-2011:008 - http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html - http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html - http://www.vupen.com/english/advisories/2011/0271 - http://secunia.com/advisories/43033 - http://www.vupen.com/english/advisories/2011/0207 - http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html - http://lists.fedoraproject.org/pipermail/package-announce/2011-February/05
use-security-announce/2011-01/msg00006.html - http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html - http://www.vupen.com/english/advisories/2011/0106
CVE ID: CVE-2010-4412 State: PUBLISHED Published: 2010-12-07T01:00:00Z Last Updated: 2024-09-16T23:25:52.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in pfSense 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via (1) the id parameter in an olsrd.xml action to pkg_edit.php, (2) the xml parameter to pkg.php, or the if parameter to (3) status_graph.php or (4) interfaces.php, a different vulnerability than CVE-2008-1182 and CVE-2010-4246. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2010/11/22/18 - http://openwall.com/lists/oss-security/2010/11/
er: References: - http://openwall.com/lists/oss-security/2010/11/22/18 - http://openwall.com/lists/oss-security/2010/11/24/7 - http://openwall.com/lists/oss-security/2010/12/06/7 - http://seclists.org/fulldisclosure/2010/Nov/43
CVE ID: CVE-2010-4413 State: PUBLISHED Published: 2011-01-19T15:00:00 Last Updated: 2024-08-07T03:43:14.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Scheduler Agent component in Oracle Database Server 11.1.0.7 and 11.2.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2011/0139 - http://www.securitytracker.com/id?1024972 - http://www.securityfocus.com/bid/45845 - http://secunia.com/advisories/42895 - https://exchange.xforce.ibmcloud.com/vulnerabilities/64759 - http://www.ora
5845 - http://secunia.com/advisories/42895 - https://exchange.xforce.ibmcloud.com/vulnerabilities/64759 - http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
CVE ID: CVE-2010-4414 State: PUBLISHED Published: 2011-01-19T15:00:00 Last Updated: 2024-08-07T03:43:14.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Oracle VM VirtualBox 4.0 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Extensions. Additional Analyst Notes: - CVE Program Container: References: - http://security.gentoo.org/glsa/glsa-201204-01.xml - http://secunia.com/advisories/48755 - http://www.vupen.com/english/advisories/2011/0152 - http://secunia.com/advisories/42985 - http://www.securityfocus.com/bid/45876 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.
85 - http://www.securityfocus.com/bid/45876 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12576 - https://exchange.xforce.ibmcloud.com/vulnerabilities/64810 - http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
CVE ID: CVE-2010-4415 State: PUBLISHED Published: 2011-01-19T15:00:00 Last Updated: 2024-08-07T03:43:14.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Oracle Solaris 8, 9, and 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to libc. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/64803 - http://secunia.com/advisories/42984 - http://www.securityfocus.com/bid/45904 - http://www.securitytracker.com/id?1024975 - http://www.vupen.com/english/advisories/2011/0151 - http://www.oracle.com/technetwork/topics/security/cpujan2011-19
75 - http://www.vupen.com/english/advisories/2011/0151 - http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
CVE ID: CVE-2010-4416 State: PUBLISHED Published: 2011-01-19T15:00:00 Last Updated: 2024-08-07T03:43:14.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Oracle GoldenGate Veridata component in Oracle Fusion Middleware 3.0.0.4 allows remote attackers to affect availability via unknown vectors related to Server. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party researcher that this is a buffer overflow via a crafted XML soap request and a value that does not contain the expected 0x20 terminator character. Additional Analyst Notes: - CVE Program Container: Referenc
hat does not contain the expected 0x20 terminator character. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2011/0143 - https://exchange.xforce.ibmcloud.com/vulnerabilities/64775 - http://www.securitytracker.com/id?1024981 - http://www.zerodayinitiative.com/advisories/ZDI-11-019/ - http://www.securityfocus.com/bid/45868 - http://secunia.com/advisories/42979 - http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
CVE ID: CVE-2010-4417 State: PUBLISHED Published: 2011-01-19T15:00:00 Last Updated: 2024-08-07T03:43:14.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Services for Beehive component in Oracle Fusion Middleware 2.0.1.0, 2.0.1.1, 2.0.1.2, 2.0.1.2.1, and 2.0.1.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that voice-servlet/prompt-qa/Index.jspf does not properly handle null (%00) bytes in the evaluation parameter that is used in a filename, which
t-qa/Index.jspf does not properly handle null (%00) bytes in the evaluation parameter that is used in a filename, which allows attackers to create a file with an executable extension and execute arbitrary JSP code. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2011/0143 - https://www.exploit-db.com/exploits/38859/ - http://www.zerodayinitiative.com/advisories/ZDI-11-020/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/64772 - http://www.securitytracker.com/id?1024981 - http://secunia.com/advisories/42978 - http://www.securityfocus.com/bid/45854 - http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html