Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2010-4736 State: PUBLISHED Published: 2011-02-16T01:00:00 Last Updated: 2024-08-07T03:55:34.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in ECO.asp in GateSoft DocuSafe 4.1.0 and 4.1.2 allows remote attackers to execute arbitrary SQL commands via the ECO_ID parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/15686 - http://packetstormsecurity.org/files/view/96398/gatesafedocusafe-sql.txt - http://www.securityfocus.com/bid/45182 - http://securityreason.com/securityalert/8086 - http://secunia.com/advisories/
- http://www.securityfocus.com/bid/45182 - http://securityreason.com/securityalert/8086 - http://secunia.com/advisories/27660
CVE ID: CVE-2010-4737 State: PUBLISHED Published: 2011-02-16T01:00:00 Last Updated: 2024-08-07T03:55:35.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in resorts.asp in HotWebScripts HotWeb Rentals allows remote attackers to execute arbitrary SQL commands via the PropResort parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/15688 - http://securityreason.com/securityalert/8085 - http://www.securityfocus.com/bid/45184 - http://secunia.com/advisories/36747 - http://packetstormsecurity.org/files/view/96388/hotwebrentals-sqlpr.txt
CVE ID: CVE-2010-4738 State: PUBLISHED Published: 2011-02-16T01:00:00 Last Updated: 2024-08-07T03:55:35.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Rae Media INC Real Estate Single and Multi Agent System 3.0 allow remote attackers to execute arbitrary SQL commands via the probe parameter to (1) multi/city.asp in the Multi Agent System and (2) resulttype.asp in the Single Agent System. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/45212 - http://osvdb.org/69628 - http://packetstormsecurity.org/files/view/96389/raemediaincresmas-sql.txt - http://www.securityfocus.com/bid/45211 - ht
http://packetstormsecurity.org/files/view/96389/raemediaincresmas-sql.txt - http://www.securityfocus.com/bid/45211 - http://secunia.com/advisories/42515 - http://securityreason.com/securityalert/8080 - http://securityreason.com/securityalert/8082 - http://osvdb.org/69627 - http://securityreason.com/securityalert/8088
CVE ID: CVE-2010-4739 State: PUBLISHED Published: 2011-02-16T01:00:00 Last Updated: 2024-08-07T03:55:35.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Maian Media Silver (com_maianmedia) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in a music action to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/8084 - http://packetstormsecurity.org/files/view/95879/joomlamaianmedia-sql.txt - http://www.securityfocus.com/bid/44877 - http://www.osvdb.org/69358 - http://www.exploit-db.com/exploits/555 - http://secunia.com/advisories
ocus.com/bid/44877 - http://www.osvdb.org/69358 - http://www.exploit-db.com/exploits/555 - http://secunia.com/advisories/42284
CVE ID: CVE-2010-4740 State: PUBLISHED Published: 2011-02-16T01:00:00 Last Updated: 2024-08-07T03:55:35.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in WTclient.dll in SCADA Engine BACnet OPC Client before 1.0.25 allows user-assisted remote attackers to execute arbitrary code via a crafted .csv file, related to a status log message. Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/control_systems/pdf/ICSA-10-264-01.pdf - http://securityreason.com/securityalert/8083 - http://secunia.com/advisories/41466 - http://packetstormsecurity.org/1009-exploits/bacnet-overflow.py.txt - http://www.securityfocus.com/bid/4
isories/41466 - http://packetstormsecurity.org/1009-exploits/bacnet-overflow.py.txt - http://www.securityfocus.com/bid/43289 - http://www.kb.cert.org/vuls/id/660688
CVE ID: CVE-2010-4741 State: PUBLISHED Published: 2011-02-18T17:00:00Z Last Updated: 2024-09-17T00:06:44.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in MDMUtil.dll in MDMTool.exe in MDM Tool before 2.3 in Moxa Device Manager allows remote MDM Gateways to execute arbitrary code via crafted data in a session on TCP port 54321. Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/control_systems/pdf/ICSA-10-301-01A.pdf - http://reversemode.com/index.php?option=com_content&task=view&id=70&Itemid=1 - http://www.kb.cert.org/vuls/id/237495 - http://www.moxa.com/support/download.aspx?d_id=2669 - http://www.kb.cert.org
1 - http://www.kb.cert.org/vuls/id/237495 - http://www.moxa.com/support/download.aspx?d_id=2669 - http://www.kb.cert.org/vuls/id/MORO-8D9JX8
CVE ID: CVE-2010-4742 State: PUBLISHED Published: 2011-02-18T17:00:00Z Last Updated: 2024-09-16T21:57:40.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in a certain ActiveX control in MediaDBPlayback.DLL 2.2.0.5 in the Moxa ActiveX SDK allows remote attackers to execute arbitrary code via a long PlayFileName property value. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/68986 - http://www.metasploit.com/modules/exploit/windows/fileformat/moxa_mediadbplayback - http://reversemode.com/index.php?option=com_content&task=view&id=70&Itemid=1
CVE ID: CVE-2010-4743 State: PUBLISHED Published: 2011-02-18T18:00:00 Last Updated: 2024-08-07T03:55:35.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the getarena function in abc2ps.c in abcm2ps before 5.9.13 might allow remote attackers to execute arbitrary code via a crafted ABC file, a different vulnerability than CVE-2010-3441. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/40033 - http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054424.html - http://www.vupen.com/english/advisories/2011/0390 - http://bu
ct.org/pipermail/package-announce/2011-March/054424.html - http://www.vupen.com/english/advisories/2011/0390 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577014 - https://bugzilla.redhat.com/show_bug.cgi?id=600729 - http://secunia.com/advisories/43338 - http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054015.html - http://moinejf.free.fr/abcm2ps-5.txt
CVE ID: CVE-2010-4744 State: PUBLISHED Published: 2011-02-18T18:00:00 Last Updated: 2024-08-07T03:55:35.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in abcm2ps before 5.9.13 have unknown impact and attack vectors, a different issue than CVE-2010-3441. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054424.html - http://www.vupen.com/english/advisories/2011/0390 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577014 - https://bugzilla.redhat.com/show_bug.cgi?id=600729 - http://secunia.com/advisories/43338 - http://lists.fedoraproject.org/pipermail/pa
la.redhat.com/show_bug.cgi?id=600729 - http://secunia.com/advisories/43338 - http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054015.html - http://moinejf.free.fr/abcm2ps-5.txt
CVE ID: CVE-2010-4745 State: PUBLISHED Published: 2011-02-21T18:00:00 Last Updated: 2024-08-07T03:55:35.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in nav.html in PHPXref before 0.7.1 allows remote attackers to inject arbitrary web script or HTML via the query string. Additional Analyst Notes: - CVE Program Container: References: - http://phpxref.sourceforge.net/Changelog - http://websecurity.com.ua/4795/ - http://osvdb.org/70855 - http://www.securityfocus.com/bid/46302 - https://exchange.xforce.ibmcloud.com/vulnerabilities/65434 - http://secunia.com/advisories/42069
CVE ID: CVE-2010-4746 State: PUBLISHED Published: 2011-02-23T18:00:00Z Last Updated: 2024-09-16T16:22:49.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple memory leaks in the normalization functionality in 389 Directory Server before 1.2.7.5 allow remote attackers to cause a denial of service (memory consumption) via "badly behaved applications," related to (1) Slapi_Attr mishandling in the DN normalization code and (2) pointer mishandling in the syntax normalization code, a different issue than CVE-2011-0019. Additional Analyst Notes: - CVE Program Container: References: - http://directory.fedoraproject.org/wiki/Release_Notes - https://bugzilla.redhat.com/show_bug.cgi
ontainer: References: - http://directory.fedoraproject.org/wiki/Release_Notes - https://bugzilla.redhat.com/show_bug.cgi?id=663597
CVE ID: CVE-2010-4747 State: PUBLISHED Published: 2011-03-01T21:00:00 Last Updated: 2024-08-07T03:55:35.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pluginurl parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/69764 - http://www.securityfocus.com/bid/45266 - https://exchange.xforce.ibmcloud.com/vulnerabilities/63761 - http://secunia.com/advisories/42545 - http://www.johnleitch.net/Vulnerabilities/WordPress.Processing.Embed.0.
es/63761 - http://secunia.com/advisories/42545 - http://www.johnleitch.net/Vulnerabilities/WordPress.Processing.Embed.0.5.Reflected.Cross-site.Scripting/65
CVE ID: CVE-2010-4748 State: PUBLISHED Published: 2011-03-01T21:00:00 Last Updated: 2024-08-07T03:55:35.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in pmwiki.php in PmWiki 2.2.20 allows remote attackers to inject arbitrary web script or HTML via the from parameter to Main/WikiSandbox. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.pmwiki.org/wiki/PmWiki/ChangeLog - http://marc.info/?l=full-disclosure&m=129234473228351&w=2 - http://securityreason.com/securityalert/8113 - http://packetstormsecurity.org/files/view/96687/pm-wiki-xss.txt
51&w=2 - http://securityreason.com/securityalert/8113 - http://packetstormsecurity.org/files/view/96687/pm-wiki-xss.txt - http://secunia.com/advisories/42608 - http://www.pmwiki.org/wiki/PmWiki/ReleaseNotes
CVE ID: CVE-2010-4749 State: PUBLISHED Published: 2011-03-01T21:00:00 Last Updated: 2024-08-07T03:55:35.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1.e, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) body parameter to action.php and the (2) amount and (3) action parameters to admin/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.htbridge.ch/advisory/cross_site_scripting_vulnerability_in_blogcms.html - http://www.exploit-db.com/exploits/15743 - http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms_1.html - http:/
http://www.exploit-db.com/exploits/15743 - http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms_1.html - http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms.html - http://blogcms.com/ - http://securityreason.com/securityalert/8112 - http://packetstormsecurity.org/files/view/96731/blogcms-xsrfxss.txt
CVE ID: CVE-2010-4750 State: PUBLISHED Published: 2011-03-01T21:00:00 Last Updated: 2024-08-07T03:55:35.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in admin/libs/ADMIN.php in BLOG:CMS 4.2.1.e, and possibly earlier, allows remote attackers to hijack the authentication of administrators. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/15743 - http://blogcms.com/ - http://www.htbridge.ch/advisory/xsrf_csrf_in_blogcms.html - http://securityreason.com/securityalert/8112 - http://packetstormsecurity.org/files/view/96731/blogcms-xsrfxss.txt
CVE ID: CVE-2010-4751 State: PUBLISHED Published: 2011-03-01T21:00:00 Last Updated: 2024-08-07T03:55:35.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the id parameter in an edituser action, a different vector than CVE-2008-6593, CVE-2010-3484, and CVE-2010-3485. Additional Analyst Notes: - CVE Program Container: References: - http://holisticinfosec.org/content/view/168/45/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/63723 - http://www.lightneasy.org/punbb/viewtopic.php?id=1207 - http://www.se
change.xforce.ibmcloud.com/vulnerabilities/63723 - http://www.lightneasy.org/punbb/viewtopic.php?id=1207 - http://www.securityfocus.com/bid/45230 - http://secunia.com/advisories/42391
CVE ID: CVE-2010-4752 State: PUBLISHED Published: 2011-03-01T21:00:00 Last Updated: 2024-08-07T03:55:35.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the page parameter, a different vector than CVE-2008-6593, CVE-2010-3484, and CVE-2010-3485. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/63722 - http://www.lightneasy.org/punbb/vi
Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/63722 - http://www.lightneasy.org/punbb/viewtopic.php?id=1207 - http://www.securityfocus.com/bid/45230 - http://secunia.com/advisories/42391
CVE ID: CVE-2010-4753 State: PUBLISHED Published: 2011-03-01T21:00:00Z Last Updated: 2024-09-16T17:17:51.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in LightNEasy.php in LightNEasy 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter, which is not properly handled in a forced SQL error message. Additional Analyst Notes: - CVE Program Container: References: - http://holisticinfosec.org/content/view/168/45/ - http://www.lightneasy.org/punbb/viewtopic.php?id=1207 - http://secunia.com/advisories/42391
CVE ID: CVE-2010-4754 State: PUBLISHED Published: 2011-03-02T19:00:00 Last Updated: 2024-08-07T03:55:35.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: The glob implementation in libc in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, and OpenBSD 4.7, and Libsystem in Apple Mac OS X before 10.6.8, allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/achievement_securityalert/89 - http:
nal Analyst Notes: - CVE Program Container: References: - http://securityreason.com/achievement_securityalert/89 - http://support.apple.com/kb/HT4723 - http://securityreason.com/exploitalert/9223 - http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html - http://cxib.net/stuff/glob-0day.c - http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2010-008.txt.asc - http://securityreason.com/securityalert/8116 - http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/lib/libc/gen/glob.c#rev1.18.10.1 - http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/lib/libc/gen/glob.3#rev1.30.12.1
CVE ID: CVE-2010-4755 State: PUBLISHED Published: 2011-03-02T19:00:00 Last Updated: 2024-08-07T03:55:34.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632. Additional Analyst Notes: - CVE Program Container: Referenc
n sftp daemon, a different vulnerability than CVE-2010-2632. Additional Analyst Notes: - CVE Program Container: References: - http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp.c#rev1.21.6.1 - http://securityreason.com/achievement_securityalert/89 - http://securityreason.com/exploitalert/9223 - http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp-glob.c#rev1.13.12.1 - http://cxib.net/stuff/glob-0day.c - http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2010-008.txt.asc - http://securityreason.com/securityalert/8116
CVE ID: CVE-2010-4756 State: PUBLISHED Published: 2011-03-02T19:00:00.000Z Last Updated: 2025-11-03T21:43:58.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/achievement_securityalert/89 - http://securityreason.com/exploitalert/9223 - http://cxib.net/stuff/
//securityreason.com/achievement_securityalert/89 - http://securityreason.com/exploitalert/9223 - http://cxib.net/stuff/glob-0day.c - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756 - https://bugzilla.redhat.com/show_bug.cgi?id=681681
CVE ID: CVE-2010-4757 State: PUBLISHED Published: 2011-03-15T17:00:00 Last Updated: 2024-08-07T03:55:35.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in submitnews.php in e107 before 0.7.23 allows remote attackers to inject arbitrary web script or HTML via the submitnews_title parameter, a different vector than CVE-2008-6208. NOTE: some of these details are obtained from third party information. NOTE: this might be the same as CVE-2009-4083.1 or CVE-2011-0457. Additional Analyst Notes: - CVE Program Container: References: - http://www.madirish.net/?article=471 - https://exchange.xforce.ibmcloud.com/vulnerabilities/61331 - http://e107
ences: - http://www.madirish.net/?article=471 - https://exchange.xforce.ibmcloud.com/vulnerabilities/61331 - http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/newspost.php?r1=11655&r2=11654&pathrev=11655 - http://e107.org/svn_changelog.php?version=0.7.23 - http://e107.org/comment.php?comment.news.872 - http://securitytracker.com/id?1024351
CVE ID: CVE-2010-4758 State: PUBLISHED Published: 2011-03-18T16:00:00Z Last Updated: 2024-09-16T20:57:44.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: installer.pl in Open Ticket Request System (OTRS) before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.otrs.org/show_bug.cgi?id=6302 - http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
CVE ID: CVE-2010-4759 State: PUBLISHED Published: 2011-03-18T16:00:00Z Last Updated: 2024-09-16T16:22:32.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Ticket Request System (OTRS) before 3.0.0-beta7 does not properly restrict the ticket ages that are within the scope of a search, which allows remote authenticated users to cause a denial of service (daemon hang) via a fulltext search. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.otrs.org/show_bug.cgi?id=1639 - http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
CVE ID: CVE-2010-4760 State: PUBLISHED Published: 2011-03-18T16:00:00Z Last Updated: 2024-09-16T21:03:38.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Ticket Request System (OTRS) before 3.0.0-beta6 adds email-notification-ext articles to tickets during processing of event-based notifications, which allows remote authenticated users to obtain potentially sensitive information by reading a ticket. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.otrs.org/show_bug.cgi?id=5975 - http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
CVE ID: CVE-2010-4761 State: PUBLISHED Published: 2011-03-18T16:00:00Z Last Updated: 2024-09-16T22:25:10.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: The customer-interface ticket-print dialog in Open Ticket Request System (OTRS) before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the (1) responsible, (2) owner, (3) accounted time, (4) pending until, and (5) lock fields by reading this dialog. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.otrs.org/show_bug.cgi?id=5875 - http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
CVE ID: CVE-2010-4762 State: PUBLISHED Published: 2011-03-18T16:00:00Z Last Updated: 2024-09-16T23:01:20.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the rich-text-editor component in Open Ticket Request System (OTRS) before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "source code" feature in the customer interface. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.otrs.org/show_bug.cgi?id=5724 - http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
CVE ID: CVE-2010-4763 State: PUBLISHED Published: 2011-03-18T16:00:00Z Last Updated: 2024-09-16T20:07:00.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ACL-customer-status Ticket Type setting in Open Ticket Request System (OTRS) before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the (1) Status, (2) Service, and (3) Queue via selections. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.otrs.org/show_bug.cgi?id=4399 - http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
CVE ID: CVE-2010-4764 State: PUBLISHED Published: 2011-03-18T16:00:00Z Last Updated: 2024-09-16T17:58:06.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Ticket Request System (OTRS) before 2.4.10, and 3.x before 3.0.3, does not present warnings about incoming encrypted e-mail messages that were based on revoked PGP or GPG keys, which makes it easier for remote attackers to spoof e-mail communication by leveraging a key that has a revocation signature. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.otrs.org/show_bug.cgi?id=6131 - http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807