Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
this issue is the same as CVE-2010-1447. Additional Analyst Notes: - CVE Program Container: References: - http://www.postgresql.org/docs/current/static/release-8-1-21.html - http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041579.html - http://www.postgresql.org/about/news.1203 - http://www.redhat.com/support/errata/RHSA-2010-0427.html - http://www.redhat.com/support/errata/RHSA-2010-0428.html - http://marc.info/?l=bugtraq&m=134124585221119&w=2 - https://exchange.xforce.ibmcloud.com/vulnerabilities/58693 - http://www.debian.org/security/2010/dsa-2051 - http://secunia.com/advisories/39898 - http://www.postgresql.org/docs/current/static/release-7-4-29.html - http://secunia.c
tp://secunia.com/advisories/39898 - http://www.postgresql.org/docs/current/static/release-7-4-29.html - http://secunia.com/advisories/39820 - http://www.vupen.com/english/advisories/2010/1198 - http://www.postgresql.org/docs/current/static/release-8-0-25.html - http://www.vupen.com/english/advisories/2010/1167 - http://www.vupen.com/english/advisories/2010/1221 - http://secunia.com/advisories/39845 - http://www.securityfocus.com/bid/40215 - http://www.postgresql.org/docs/current/static/release-8-3-11.html - http://www.vupen.com/english/advisories/2010/1207 - http://www.postgresql.org/docs/current/static/release-8-2-17.html - http://www.redhat.com/support/errata/RHSA-2010-0430.html - http://w
gresql.org/docs/current/static/release-8-2-17.html - http://www.redhat.com/support/errata/RHSA-2010-0430.html - http://www.postgresql.org/support/security - http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041559.html - http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041591.html - http://www.postgresql.org/docs/current/static/release-8-4-4.html - http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html - http://www.vupen.com/english/advisories/2010/1182 - https://bugzilla.redhat.com/show_bug.cgi?id=582615 - http://secunia.com/advisories/39815 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10645 -
ia.com/advisories/39815 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10645 - http://www.redhat.com/support/errata/RHSA-2010-0429.html - http://www.mandriva.com/security/advisories?name=MDVSA-2010:103 - http://www.securitytracker.com/id?1023988 - http://www.openwall.com/lists/oss-security/2010/05/20/5 - http://secunia.com/advisories/39939 - http://marc.info/?l=bugtraq&m=134124585221119&w=2 - http://osvdb.org/64755 - https://bugzilla.redhat.com/show_bug.cgi?id=588269 - http://www.vupen.com/english/advisories/2010/1197
CVE ID: CVE-2010-1170 State: PUBLISHED Published: 2010-05-19T18:13:00 Last Updated: 2024-08-07T01:14:06.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 loads Tcl code from the pltcl_modules table regardless of the table's ownership and permissions, which allows remote authenticated users, with database-creation privileges, to execute arbitrary Tcl code by creating this table and inserting a crafted Tcl script. Additional Analyst Notes: - CVE Program Container: References: - http://www.postgresql
d inserting a crafted Tcl script. Additional Analyst Notes: - CVE Program Container: References: - http://www.postgresql.org/docs/current/static/release-8-1-21.html - http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041579.html - http://www.postgresql.org/about/news.1203 - http://www.redhat.com/support/errata/RHSA-2010-0427.html - http://www.securitytracker.com/id?1023987 - http://www.redhat.com/support/errata/RHSA-2010-0428.html - http://marc.info/?l=bugtraq&m=134124585221119&w=2 - http://www.debian.org/security/2010/dsa-2051 - http://secunia.com/advisories/39898 - http://www.postgresql.org/docs/current/static/release-7-4-29.html - http://secunia.com/advisories/39820 - htt
es/39898 - http://www.postgresql.org/docs/current/static/release-7-4-29.html - http://secunia.com/advisories/39820 - http://www.vupen.com/english/advisories/2010/1198 - http://www.postgresql.org/docs/current/static/release-8-0-25.html - http://www.vupen.com/english/advisories/2010/1167 - http://www.vupen.com/english/advisories/2010/1221 - http://secunia.com/advisories/39845 - https://bugzilla.redhat.com/show_bug.cgi?id=583072 - http://www.securityfocus.com/bid/40215 - http://www.postgresql.org/docs/current/static/release-8-3-11.html - http://osvdb.org/64757 - http://www.vupen.com/english/advisories/2010/1207 - http://www.postgresql.org/docs/current/static/release-8-2-17.html - http://www.red
en.com/english/advisories/2010/1207 - http://www.postgresql.org/docs/current/static/release-8-2-17.html - http://www.redhat.com/support/errata/RHSA-2010-0430.html - http://www.postgresql.org/support/security - http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041559.html - http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041591.html - http://www.postgresql.org/docs/current/static/release-8-4-4.html - http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html - http://www.vupen.com/english/advisories/2010/1182 - http://secunia.com/advisories/39815 - http://www.redhat.com/support/errata/RHSA-2010-0429.html - http://www.mandriva.com/security/ad
ia.com/advisories/39815 - http://www.redhat.com/support/errata/RHSA-2010-0429.html - http://www.mandriva.com/security/advisories?name=MDVSA-2010:103 - http://www.openwall.com/lists/oss-security/2010/05/20/5 - http://secunia.com/advisories/39939 - http://marc.info/?l=bugtraq&m=134124585221119&w=2 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10510 - http://www.vupen.com/english/advisories/2010/1197
CVE ID: CVE-2010-1171 State: PUBLISHED Published: 2011-04-18T17:00:00 Last Updated: 2024-08-07T01:14:06.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Red Hat Network (RHN) Satellite 5.3 and 5.4 exposes a dangerous, obsolete XML-RPC API, which allows remote authenticated users to access arbitrary files and cause a denial of service (failed yum operations) via vectors related to configuration and package group (comps.xml) files for channels. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/44150 - http://www.redhat.com/support/errata/RHSA-2011-0434.html - http://www.securitytracker.com/id?1025316 - https://exchange.xforce.ibmcloud
at.com/support/errata/RHSA-2011-0434.html - http://www.securitytracker.com/id?1025316 - https://exchange.xforce.ibmcloud.com/vulnerabilities/66690 - http://www.securityfocus.com/bid/47316 - http://www.vupen.com/english/advisories/2011/0967 - https://bugzilla.redhat.com/show_bug.cgi?id=584118
CVE ID: CVE-2010-1172 State: PUBLISHED Published: 2010-08-20T17:00:00 Last Updated: 2024-08-07T01:14:06.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: DBus-GLib 0.73 disregards the access flag of exported GObject properties, which allows local users to bypass intended access restrictions and possibly cause a denial of service by modifying properties, as demonstrated by properties of the (1) DeviceKit-Power, (2) NetworkManager, and (3) ModemManager services. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/40908 - http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html - http://www.vupen.com/english/advisories/2
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html - http://www.vupen.com/english/advisories/2010/2063 - https://exchange.xforce.ibmcloud.com/vulnerabilities/61041 - http://cgit.freedesktop.org/dbus/dbus-glib/commit/?h=rhel5&id=9a6bce9b615abca6068348c1606ba8eaf13d9ae0 - http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00006.html - http://secunia.com/advisories/40925 - http://secunia.com/advisories/42397 - http://support.avaya.com/css/P8/documents/100113103 - http://www.securityfocus.com/bid/42347 - http://www.vupen.com/english/advisories/2010/3097 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 - http://lists.opensuse.org/opensuse-se
ries/2010/3097 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 - http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html - http://www.redhat.com/support/errata/RHSA-2010-0616.html - https://bugzilla.redhat.com/show_bug.cgi?id=585394
CVE ID: CVE-2010-1173 State: PUBLISHED Published: 2010-05-07T18:23:00 Last Updated: 2024-08-07T01:14:06.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2010/04/29/1 - http://www.mandriva.com/security/advisories?name=MDVSA-2010:198 - http://article.gmane.org/gmane.linux.
y/2010/04/29/1 - http://www.mandriva.com/security/advisories?name=MDVSA-2010:198 - http://article.gmane.org/gmane.linux.network/159531 - http://www.openwall.com/lists/oss-security/2010/04/29/6 - http://www.redhat.com/support/errata/RHSA-2010-0474.html - http://secunia.com/advisories/43315 - http://kbase.redhat.com/faq/docs/DOC-31052 - https://bugzilla.redhat.com/show_bug.cgi?id=584645 - http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809 - http://secunia.com/advisories/40218 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11416 - http://www.vmware.com/security/advisories/VMSA-2011-0003.ht
tory/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11416 - http://www.vmware.com/security/advisories/VMSA-2011-0003.html - http://www.debian.org/security/2010/dsa-2053 - http://www.securityfocus.com/archive/1/516397/100/0/threaded - http://secunia.com/advisories/39830 - http://marc.info/?l=oss-security&m=127251068407878&w=2
CVE ID: CVE-2010-1174 State: PUBLISHED Published: 2010-03-29T19:00:00 Last Updated: 2024-08-07T01:14:06.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco TFTP Server 1.1 allows remote attackers to cause a denial of service (daemon crash) via a crafted (1) read (aka RRQ) or (2) write (aka WRQ) request, or other TFTP packet. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/39116 - http://www.exploit-db.com/exploits/11878 - http://www.securityfocus.com/bid/38968 - https://exchange.xforce.ibmcloud.com/vulnerabilities/57165
CVE ID: CVE-2010-1175 State: PUBLISHED Published: 2010-03-29T19:00:00 Last Updated: 2024-08-07T01:14:06.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 7.0 on Windows XP and Windows Server 2003 allows remote attackers to have an unspecified impact via a certain XML document that references a crafted web site in the SRC attribute of an image element, related to a "0day Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/510280/100/0/threaded
CVE ID: CVE-2010-1176 State: PUBLISHED Published: 2010-03-29T19:00:00 Last Updated: 2024-08-07T01:14:06.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to an array of long strings, an array of IMG elements with crafted strings in their SRC attributes, a TBODY element with no associated TABLE element, and certain calls to the delete operator and the cloneNode, clearAttributes, and CollectGarbage methods, possibly a related issue to CVE-2009-0075. Additional Analyst Notes: - CVE Program Container: Referenc
tGarbage methods, possibly a related issue to CVE-2009-0075. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/11891 - http://www.securityfocus.com/bid/38989 - http://nishantdaspatnaik.yolasite.com/ipodpoc1.php
CVE ID: CVE-2010-1177 State: PUBLISHED Published: 2010-03-29T19:00:00Z Last Updated: 2024-09-16T19:56:00.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving document.write calls with long crafted strings. Additional Analyst Notes: - CVE Program Container: References: - http://nishantdaspatnaik.yolasite.com/ipodpoc2.php - http://www.securityfocus.com/bid/38994
CVE ID: CVE-2010-1178 State: PUBLISHED Published: 2010-03-29T19:00:00 Last Updated: 2024-08-07T01:14:06.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) via a JavaScript loop that attempts to construct an infinitely long string. Additional Analyst Notes: - CVE Program Container: References: - http://nishantdaspatnaik.yolasite.com/ipodpoc3.php - https://exchange.xforce.ibmcloud.com/vulnerabilities/57993
CVE ID: CVE-2010-1179 State: PUBLISHED Published: 2010-03-29T19:00:00 Last Updated: 2024-08-07T01:14:06.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large integer in the numcolors attribute of a recolorinfo element in a VML file, possibly a related issue to CVE-2007-0024. Additional Analyst Notes: - CVE Program Container: References: - http://nishantdaspatnaik.yolasite.com/ipodpoc4.php - http://www.exploit-db.com/exploits/11890 - http://www.securityfocus.com/bid/38990
CVE ID: CVE-2010-1180 State: PUBLISHED Published: 2010-03-29T19:00:00 Last Updated: 2024-08-07T01:14:06.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long exception string in a throw statement, possibly a related issue to CVE-2009-1514. Additional Analyst Notes: - CVE Program Container: References: - http://nishantdaspatnaik.yolasite.com/ipodpoc5.php - http://www.securityfocus.com/bid/38992 - https://exchange.xforce.ibmcloud.com/vulnerabilities/57992
CVE ID: CVE-2010-1181 State: PUBLISHED Published: 2010-03-29T19:00:00Z Last Updated: 2024-09-17T00:26:14.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a MARQUEE element. Additional Analyst Notes: - CVE Program Container: References: - http://nishantdaspatnaik.yolasite.com/ipodpoc6.php
CVE ID: CVE-2010-1182 State: PUBLISHED Published: 2010-03-29T20:00:00Z Last Updated: 2024-09-16T17:08:33.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in the administrative console in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.9 on z/OS have unknown impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/0609 - http://www-01.ibm.com/support/docview.wss?uid=swg1PK97376 - http://www-01.ibm.com/support/docview.wss?uid=swg1PM09161
CVE ID: CVE-2010-1183 State: PUBLISHED Published: 2010-03-29T22:00:00 Last Updated: 2024-08-07T01:14:06.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain patch-installation scripts in Oracle Solaris allow local users to append data to arbitrary files via a symlink attack on the /tmp/CLEANUP temporary file, related to use of Update Manager. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/510311/100/0/threaded - http://www.securityfocus.com/bid/38928 - https://exchange.xforce.ibmcloud.com/vulnerabilities/57149 - http://www.securityfocus.com/archive/1/510305/100/0/threaded
CVE ID: CVE-2010-1184 State: PUBLISHED Published: 2010-03-29T22:00:00 Last Updated: 2024-08-07T01:14:06.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Microsoft wireless keyboard uses XOR encryption with a key derived from the MAC address, which makes it easier for remote attackers to obtain keystroke information and inject arbitrary commands via a nearby wireless device, as demonstrated by Keykeriki 2. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/57978 - http://www.theregister.co.uk/2010/03/26/open_source_wireless_sniffer/ - http://www.remote-exploit.org/?p=437
CVE ID: CVE-2010-1185 State: PUBLISHED Published: 2010-03-29T22:00:00 Last Updated: 2024-08-07T01:14:06.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in serv.exe in SAP MaxDB 7.4.3.32, and 7.6.0.37 through 7.6.06 allows remote attackers to execute arbitrary code via an invalid length parameter in a handshake packet to TCP port 7210. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/63047 - https://exchange.xforce.ibmcloud.com/vulnerabilities/56950 - http://www.securitytracker.com/id?1023719 - http://www.zerodayinitiative.com/advisories/ZDI-10-03
ulnerabilities/56950 - http://www.securitytracker.com/id?1023719 - http://www.zerodayinitiative.com/advisories/ZDI-10-032/ - http://www.securityfocus.com/bid/38769 - http://www.securityfocus.com/archive/1/510125/100/0/threaded - http://www.vupen.com/english/advisories/2010/0643 - http://secunia.com/advisories/38955
CVE ID: CVE-2010-1186 State: PUBLISHED Published: 2010-04-07T15:00:00 Last Updated: 2024-08-07T01:14:06.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/12098 - http://secunia.com/advisories/39341 - http://www.securityfocus.com/bid/39250 - https://exchange.xforce.ibmcloud.com/vulnerabilities/57562 - http://wordpress.org/extend/plugins/nextgen-gallery/changelog/ - http://www.co
orce.ibmcloud.com/vulnerabilities/57562 - http://wordpress.org/extend/plugins/nextgen-gallery/changelog/ - http://www.coresecurity.com/content/nextgen-gallery-xss-vulnerability - http://www.vupen.com/english/advisories/2010/0821
CVE ID: CVE-2010-1187 State: PUBLISHED Published: 2010-03-31T17:35:00 Last Updated: 2024-08-07T01:14:06.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Transparent Inter-Process Communication (TIPC) functionality in Linux kernel 2.6.16-rc1 through 2.6.33, and possibly other versions, allows local users to cause a denial of service (kernel OOPS) by sending datagrams through AF_TIPC before entering network mode, which triggers a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2010:198 - http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commitdiff%3Bh=d0021b252eaf6
ories?name=MDVSA-2010:198 - http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commitdiff%3Bh=d0021b252eaf65ca07ed14f0d66425dd9ccab9a6%3Bhp=6d55cb91a0020ac0d78edcad61efd6c8cf5785a3 - https://bugzilla.redhat.com/show_bug.cgi?id=578057 - http://www.securityfocus.com/bid/39120 - http://secunia.com/advisories/43315 - http://www.openwall.com/lists/oss-security/2010/03/31/1 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9832 - http://www.vmware.com/security/advisories/VMSA-2011-0003.html - http://www.openwall.com/lists/oss-security/2010/03/30/1 - http://www.debian.org/security/2010/dsa-2053 - http://www.securityfocus.com/archive/1/516397/100/0
curity/2010/03/30/1 - http://www.debian.org/security/2010/dsa-2053 - http://www.securityfocus.com/archive/1/516397/100/0/threaded - http://secunia.com/advisories/39830
CVE ID: CVE-2010-1188 State: PUBLISHED Published: 2010-03-31T17:35:00 Last Updated: 2024-08-07T01:14:06.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20, when IPV6_RECVPKTINFO is set on a listening socket, allows remote attackers to cause a denial of service (kernel panic) via a SYN packet while the socket is in a listening (TCP_LISTEN) state, which is not properly handled and causes the skb structure to be freed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1023992 - http://www.redhat.com/support/errata/RHSA-2010-0380.html - https://
ences: - http://www.securitytracker.com/id?1023992 - http://www.redhat.com/support/errata/RHSA-2010-0380.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9878 - http://www.redhat.com/support/errata/RHSA-2010-0394.html - http://support.avaya.com/css/P8/documents/100090459 - http://www.redhat.com/support/errata/RHSA-2010-0882.html - http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20 - http://www.openwall.com/lists/oss-security/2010/03/29/1 - http://secunia.com/advisories/39652 - http://www.vmware.com/security/advisories/VMSA-2011-0009.html - http://git.kernel.org/linus/fb7e2399ec17f1004c0e0ccfd17439f8759ede01 - http://www.redhat.com/suppor
MSA-2011-0009.html - http://git.kernel.org/linus/fb7e2399ec17f1004c0e0ccfd17439f8759ede01 - http://www.redhat.com/support/errata/RHSA-2010-0439.html - http://www.securityfocus.com/bid/39016 - http://www.redhat.com/support/errata/RHSA-2010-0424.html
CVE ID: CVE-2010-1189 State: PUBLISHED Published: 2010-03-31T17:35:00 Last Updated: 2024-08-07T01:14:06.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.15.2 does not prevent wiki editors from linking to images from other web sites in wiki pages, which allows editors to obtain IP addresses and other information of wiki users by adding a link to an image on an attacker-controlled web site, aka "CSS validation issue." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/39656 - http://www.debian.org/security/2010/dsa-2022 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-March/000088.html - http://lists.op
ecurity/2010/dsa-2022 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-March/000088.html - http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html - http://www.vupen.com/english/advisories/2010/0685 - http://secunia.com/advisories/39022 - http://www.vupen.com/english/advisories/2010/1001
CVE ID: CVE-2010-1190 State: PUBLISHED Published: 2010-03-31T17:35:00 Last Updated: 2024-08-07T01:14:06.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: thumb.php in MediaWiki before 1.15.2, when used with access-restriction mechanisms such as img_auth.php, does not check user permissions before providing scaled images, which allows remote attackers to bypass intended access restrictions and read private images via unspecified manipulations. Additional Analyst Notes: - CVE Program Container: References: - http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_15_2/phase3/RELEASE-NOTES - http://secunia.com/advisories/39656 - http://www.debian.org/security/2010/dsa-2022 - http://l