Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2010-3233 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T03:03:18.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Excel 2002 SP3 and 2003 SP3 does not properly validate record information, which allows remote attackers to execute arbitrary code via a crafted .wk3 (aka Lotus 1-2-3 workbook) file, aka "Lotus 1-2-3 Workbook Parsing Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6737 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - http://www.us-cert.gov/cas/techalerts/TA10-285
cs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-3234 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T03:03:18.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Excel 2002 SP3 does not properly validate formula information, which allows remote attackers to execute arbitrary code via a crafted Excel document, aka "Formula Substream Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7555 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-3235 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T03:03:18.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Excel 2002 SP3 does not properly validate formula information, which allows remote attackers to execute arbitrary code via a crafted Excel document, aka "Formula Biff Record Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7028 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-3236 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T03:03:18.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate record information, which allows remote attackers to execute arbitrary code via a crafted Excel document, aka "Out Of Bounds Array Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7209 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - http:
Aorg.mitre.oval%3Adef%3A7209 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-3237 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T03:03:18.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Excel 2002 SP3 and Office 2004 for Mac do not properly validate record information, which allows remote attackers to execute arbitrary code via a crafted Excel document, aka "Merge Cell Record Pointer Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6727 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-3238 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T03:03:18.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Excel 2002 SP3 and 2003 SP3, and Office 2004 for Mac, does not properly validate binary file-format information, which allows remote attackers to execute arbitrary code via a crafted Excel document, aka "Negative Future Function Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6872 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - http://www.us-cert.gov/cas/techale
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-3239 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T03:03:18.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Excel 2002 SP3 does not properly validate record information, which allows remote attackers to execute arbitrary code via a crafted Excel document, aka "Extra Out of Boundary Record Parsing Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7616 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-3240 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T03:03:18.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Excel 2002 SP3 and 2007 SP2; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 do not properly validate record information, which allows remote attackers to execute arbitrary code via a crafted Excel document, aka "Real Time Data Array Record Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7196 - https://docs.microsoft.com/en-us/security-updates/se
g/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7196 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-3241 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T03:03:18.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate binary file-format information, which allows remote attackers to execute arbitrary code via a crafted Excel document, aka "Out-of-Bounds Memory Write in Parsing Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6738 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010
definition/oval%3Aorg.mitre.oval%3Adef%3A6738 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-3242 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T03:03:18.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate record information, which allows remote attackers to execute arbitrary code via a crafted Excel document, aka "Ghost Record Type Parsing Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6902 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - http://www.u
tre.oval%3Adef%3A6902 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-080 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-3243 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-10-17T20:16:42.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "HTML Sanitization Vulnerability." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7637 - htt
ichment: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7637 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-071 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-072 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html - http://support.avaya.com/css/P8/documents/100113324
CVE ID: CVE-2010-3244 State: PUBLISHED Published: 2010-09-07T17:00:00Z Last Updated: 2024-09-16T21:07:41.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: BbtsConnection_Edit.exe in Blackboard Transact Suite (formerly Blackboard Commerce Suite) before 3.6.0.2 relies on field names when determining whether it is appropriate to decrypt a connection.xml field value, which allows local users to discover the database password via a modified connection.xml file that contains an encrypted password in the <Server> field. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/MAPG-86YPVM - http://www.kb.cert.org/vuls/id/204055
CVE ID: CVE-2010-3245 State: PUBLISHED Published: 2010-09-07T17:00:00Z Last Updated: 2024-09-17T00:37:23.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: The automated-backup functionality in Blackboard Transact Suite (formerly Blackboard Commerce Suite) stores the (1) database username and (2) database password in cleartext in (a) script and (b) batch (.bat) files, which allows local users to obtain sensitive information by reading a file. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/MAPG-86YPVM - http://www.kb.cert.org/vuls/id/204055
CVE ID: CVE-2010-3246 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome before 6.0.472.53 does not properly handle the _blank value for the target attribute of unspecified elements, which allows remote attackers to bypass the pop-up blocker via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://code.google.com/p/chromium/issues/detail?id=34414 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11752 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html
CVE ID: CVE-2010-3247 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome before 6.0.472.53 does not properly restrict the characters in URLs, which allows remote attackers to spoof the appearance of the URL bar via homographic sequences. Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12176 - http://code.google.com/p/chromium/issues/detail?id=37201 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html
CVE ID: CVE-2010-3248 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome before 6.0.472.53 does not properly restrict copying to the clipboard, which has unspecified impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2011:039 - http://www.vupen.com/english/advisories/2010/2722 - http://code.google.com/p/chromium/issues/detail?id=41654 - http://www.ubuntu.com/usn/USN-1006-1 - http://secunia.com/advisories/41856 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%
- http://secunia.com/advisories/41856 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12052 - http://www.securityfocus.com/bid/44216 - http://www.vupen.com/english/advisories/2011/0552 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html
CVE ID: CVE-2010-3249 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome before 6.0.472.53 does not properly implement SVG filters, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors, related to a "stale pointer" issue. Additional Analyst Notes: - CVE Program Container: References: - http://code.google.com/p/chromium/issues/detail?id=45659 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12211 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.h
oval%3Aorg.mitre.oval%3Adef%3A12211 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html
CVE ID: CVE-2010-3250 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Google Chrome before 6.0.472.53 allows remote attackers to enumerate the set of installed extensions via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12106 - http://code.google.com/p/chromium/issues/detail?id=45876 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html
CVE ID: CVE-2010-3251 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebSockets implementation in Google Chrome before 6.0.472.53 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11553 - http://code.google.com/p/chromium/issues/detail?id=51846 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html - http://code.google.com/p/chromium
ttp://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html - http://code.google.com/p/chromium/issues/detail?id=46750
CVE ID: CVE-2010-3252 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the Notifications presenter in Google Chrome before 6.0.472.53 allows attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11987 - http://code.google.com/p/chromium/issues/detail?id=50386 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html
CVE ID: CVE-2010-3253 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: The implementation of notification permissions in Google Chrome before 6.0.472.53 allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://code.google.com/p/chromium/issues/detail?id=50839 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11480 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html
CVE ID: CVE-2010-3254 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebSockets implementation in Google Chrome before 6.0.472.53 does not properly handle integer values, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12119 - http://code.google.com/p/chromium/issues/detail?id=51739 - http://code.google.com/p/chromium/issues/detail?id=51630 - http://googlechromerelease
/chromium/issues/detail?id=51739 - http://code.google.com/p/chromium/issues/detail?id=51630 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html
CVE ID: CVE-2010-3255 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome before 6.0.472.53 and webkitgtk before 1.2.6 do not properly handle counter nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2011:039 - http://code.google.com/p/chromium/issues/detail?id=51653 - http://www.vupen.com/english/advisories/2011/0216 - http://secunia.com/advisories/43086 - http://www.re
etail?id=51653 - http://www.vupen.com/english/advisories/2011/0216 - http://secunia.com/advisories/43086 - http://www.redhat.com/support/errata/RHSA-2011-0177.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11736 - http://www.vupen.com/english/advisories/2011/0552 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html
CVE ID: CVE-2010-3256 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome before 6.0.472.53 does not properly limit the number of stored autocomplete entries, which has unspecified impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://code.google.com/p/chromium/issues/detail?id=51727 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12027 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html
CVE ID: CVE-2010-3257 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving element focus. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2011:039 - http://www.vupen.com/english/advisories/2010/2722 - http://secunia.com/advisories/43068 - https://oval.
MDVSA-2011:039 - http://www.vupen.com/english/advisories/2010/2722 - http://secunia.com/advisories/43068 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12138 - http://www.ubuntu.com/usn/USN-1006-1 - http://support.apple.com/kb/HT4455 - http://secunia.com/advisories/41856 - http://www.vupen.com/english/advisories/2011/0212 - http://www.vupen.com/english/advisories/2010/3046 - http://www.vupen.com/english/advisories/2011/0216 - http://secunia.com/advisories/43086 - http://code.google.com/p/chromium/issues/detail?id=52443 - http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html - http://lists.apple.com/archives/security-announce/2010
s.opensuse.org/opensuse-security-announce/2011-01/msg00006.html - http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html - http://secunia.com/advisories/42314 - http://www.redhat.com/support/errata/RHSA-2011-0177.html - http://www.vupen.com/english/advisories/2011/0552 - http://support.apple.com/kb/HT4456 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html - http://www.securityfocus.com/bid/44204 - http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html
CVE ID: CVE-2010-3258 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sandbox implementation in Google Chrome before 6.0.472.53 does not properly deserialize parameters, which has unspecified impact and remote attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://code.google.com/p/chromium/issues/detail?id=52682 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12133 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html
CVE ID: CVE-2010-3259 State: PUBLISHED Published: 2010-09-07T17:00:00 Last Updated: 2024-08-07T03:03:18.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2011:039 - http://www.vupen.com/english/advisories/2010/2722 - http://se
www.mandriva.com/security/advisories?name=MDVSA-2011:039 - http://www.vupen.com/english/advisories/2010/2722 - http://secunia.com/advisories/43068 - http://www.ubuntu.com/usn/USN-1006-1 - http://support.apple.com/kb/HT4455 - http://secunia.com/advisories/41856 - http://www.vupen.com/english/advisories/2011/0212 - https://technet.microsoft.com/library/security/msvr11-002 - http://www.vupen.com/english/advisories/2010/3046 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11221 - http://www.vupen.com/english/advisories/2011/0216 - http://secunia.com/advisories/43086 - http://www.securityfocus.com/bid/44206 - http://lists.opensuse.org/opensuse-security-ann
/secunia.com/advisories/43086 - http://www.securityfocus.com/bid/44206 - http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html - http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html - http://secunia.com/advisories/42314 - http://www.redhat.com/support/errata/RHSA-2011-0177.html - http://www.vupen.com/english/advisories/2011/0552 - http://code.google.com/p/chromium/issues/detail?id=53001 - http://support.apple.com/kb/HT4456 - http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html - http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html
CVE ID: CVE-2010-3260 State: PUBLISHED Published: 2011-04-27T00:00:00Z Last Updated: 2024-09-17T03:54:25.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaration in conjunction with an entity reference, related to an "XML injection" issue. Additional Analyst Notes: - CVE Program Container: References: - http://wiki.orbeon.com/forms/doc/developer-guide/release-notes/39 - http://www.securityfo