Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2010-1104 State: PUBLISHED Published: 2010-03-25T17:00:00 Last Updated: 2024-08-07T01:14:06.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/0104 - http://www.securityfocus.com/bid/37765 - http://www.osvdb.org/61655 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55599 - https://mail.zope.org
/37765 - http://www.osvdb.org/61655 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55599 - https://mail.zope.org/pipermail/zope-announce/2010-January/002229.html - http://secunia.com/advisories/38007
CVE ID: CVE-2010-1105 State: PUBLISHED Published: 2010-03-25T17:00:00 Last Updated: 2024-08-07T01:14:05.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in cgi/index.php in AdvertisementManager 3.1.0 and 3.6 allows remote attackers to inject arbitrary web script or HTML via the usr parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/55754 - http://www.packetstormsecurity.com/1001-exploits/advertisemanager-xssrfitraversal.txt - http://secunia.com/advisories/38243 - http://www.securityfocus.com/bid/40151 - http://osvdb.org/61846
CVE ID: CVE-2010-1106 State: PUBLISHED Published: 2010-03-25T17:00:00 Last Updated: 2024-08-07T01:14:05.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in cgi/index.php in AdvertisementManager 3.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the req parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/55756 - http://www.packetstormsecurity.com/1001-exploits/advertisemanager-xssrfitraversal.txt
CVE ID: CVE-2010-1107 State: PUBLISHED Published: 2010-03-25T17:00:00 Last Updated: 2024-08-07T01:14:05.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Recent Comments module 5.x through 5.x-1.2 and 6.x through 6.x-1.0 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a "custom block title interface." Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/688632 - http://secunia.com/advisories/38281 - http://drupal.org/node/690734 - http://drupal.org/node/688636 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55770 - http://www.securityfocus.com/bid/37
rupal.org/node/688636 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55770 - http://www.securityfocus.com/bid/37898
CVE ID: CVE-2010-1108 State: PUBLISHED Published: 2010-03-25T17:00:00 Last Updated: 2024-08-07T01:14:05.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Control Panel module 5.x through 5.x-1.5 and 6.x through 6.x-1.2 for Drupal allows remote authenticated users, with "administer blocks" privileges, to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/690718 - http://www.securityfocus.com/bid/37890 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55769 - http://drupal.org/node/686428 - http://secunia.com/advisories/38280
CVE ID: CVE-2010-1109 State: PUBLISHED Published: 2010-03-25T17:00:00 Last Updated: 2024-08-07T01:14:05.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) v2 parameter in a member view action, (2) v1 parameter in a news action, (3) v1 parameter in an information action, (4) v2 parameter in a team view action, (5) v2 parameter in a club view action, or (6) v2 parameter in a matches view action. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabiliti
ion. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/55762 - http://secunia.com/advisories/34279 - http://phpmysport.sourceforge.net/en/forum/bugs/sujet_2851.html - http://packetstormsecurity.org/1001-exploits/phpmysport-sqlaccess.txt - http://www.securityfocus.com/bid/37856
CVE ID: CVE-2010-1110 State: PUBLISHED Published: 2010-03-25T17:00:00 Last Updated: 2024-08-07T01:14:06.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in index.php in phpMySport 1.4 allows remote attackers to list arbitrary directories via a .. (dot dot) in the current_folder parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/55763 - http://phpmysport.sourceforge.net/en/forum/bugs/sujet_2851.html - http://packetstormsecurity.org/1001-exploits/phpmysport-sqlaccess.txt - http://www.securityfocus.com/bid/37856
CVE ID: CVE-2010-1111 State: PUBLISHED Published: 2010-03-25T17:00:00 Last Updated: 2024-08-07T01:14:05.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Jokes Complete Website allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to joke.php and the (2) searchingred parameter to results.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/55761 - http://www.securityfocus.com/bid/37852 - http://www.packetstormsecurity.com/1001-exploits/jokescomplete-xss.txt
CVE ID: CVE-2010-1112 State: PUBLISHED Published: 2010-03-25T17:00:00Z Last Updated: 2024-09-17T00:46:50.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in cat.php in KloNews 2.0 allows remote attackers to inject arbitrary web script or HTML via the cat parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/38268 - http://packetstormsecurity.org/1001-exploits/klonews-xss.txt
CVE ID: CVE-2010-1113 State: PUBLISHED Published: 2010-03-25T17:00:00 Last Updated: 2024-08-07T01:14:06.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the forum page in Web Server Creator - Web Portal 0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37841 - http://www.packetstormsecurity.com/1001-exploits/webservercreator-traversalxssrfi.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/55726
CVE ID: CVE-2010-1114 State: PUBLISHED Published: 2010-03-25T17:00:00 Last Updated: 2024-08-07T01:14:05.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pg parameter to index.php and the (2) path parameter to news/form.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37841 - http://www.packetstormsecurity.com/1001-exploits/webservercreator-traversalxssrfi.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/55727
CVE ID: CVE-2010-1115 State: PUBLISHED Published: 2010-03-25T17:00:00 Last Updated: 2024-08-07T01:14:05.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in news/include/customize.php in Web Server Creator - Web Portal 0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the l parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37841 - http://www.packetstormsecurity.com/1001-exploits/webservercreator-traversalxssrfi.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/55725
CVE ID: CVE-2010-1116 State: PUBLISHED Published: 2010-03-25T17:00:00 Last Updated: 2024-08-07T01:14:06.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: LookMer Music Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for dbmdb/LookMerSarkiMDB.mdb. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/38247 - http://osvdb.org/61845 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55751 - http://www.packetstormsecurity.com/1001-exploits/lookmer-disclose.txt
CVE ID: CVE-2010-1117 State: PUBLISHED Published: 2010-03-25T20:31:00 Last Updated: 2024-08-07T01:14:06.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to discover the base address of a Windows .dll file, and possibly have unspecified other impact, via unknown vectors, as demonstrated by Peter Vreugdenhil during a Pwn2Own competition at CanSecWest 2010. Additional Analyst Notes: - CVE Program Container: References: - http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010 - http://twitter.com/thezdi/statuses/11003801960 - http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-Int
/pwn2own-2010 - http://twitter.com/thezdi/statuses/11003801960 - http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-InternetExplorer8.pdf - https://exchange.xforce.ibmcloud.com/vulnerabilities/57196 - http://news.cnet.com/8301-27080_3-20001126-245.html
CVE ID: CVE-2010-1118 State: PUBLISHED Published: 2010-03-25T20:31:00 Last Updated: 2024-08-07T01:14:05.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a use-after-free issue, as demonstrated by Peter Vreugdenhil during a Pwn2Own competition at CanSecWest 2010. Additional Analyst Notes: - CVE Program Container: References: - http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010 - http://twitter.com/thezdi/statuses/11003801960 - https://exchange.xforce.ibmcloud.com/vulnerabilities/57197 - http://vreugdenhilrese
er.com/thezdi/statuses/11003801960 - https://exchange.xforce.ibmcloud.com/vulnerabilities/57197 - http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-InternetExplorer8.pdf - http://news.cnet.com/8301-27080_3-20001126-245.html
CVE ID: CVE-2010-1119 State: PUBLISHED Published: 2010-03-25T20:31:00 Last Updated: 2024-08-07T01:14:05.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or read the SMS database or other data, via vectors related to "attribute manipulation," as demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010. Additional Analyst Notes: - CVE Program Container: Referenc
pp Weinmann during a Pwn2Own competition at CanSecWest 2010. Additional Analyst Notes: - CVE Program Container: References: - http://support.apple.com/kb/HT4220 - http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010 - http://support.apple.com/kb/HT4225 - http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html - http://secunia.com/advisories/40196 - http://secunia.com/advisories/40105 - http://www.vupen.com/english/advisories/2010/1373 - http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html - http://news.cnet.com/8301-27080_3-20001126-245.html - http://www.vupen.com/english/advisories/2010/1512 - http://www.securityfocus.com/bid/40620 - https://oval
126-245.html - http://www.vupen.com/english/advisories/2010/1512 - http://www.securityfocus.com/bid/40620 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7037 - http://securityreason.com/securityalert/8128 - http://securitytracker.com/id?1024067 - http://support.apple.com/kb/HT4196 - http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html - http://twitter.com/thezdi/statuses/11001080021
CVE ID: CVE-2010-1120 State: PUBLISHED Published: 2010-03-25T20:31:00Z Last Updated: 2024-09-16T17:29:11.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Safari 4 on Apple Mac OS X 10.6 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by Charlie Miller during a Pwn2Own competition at CanSecWest 2010. Additional Analyst Notes: - CVE Program Container: References: - http://twitter.com/thezdi/statuses/11002504493 - http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010 - http://news.cnet.com/8301-27080_3-20001126-245.html
CVE ID: CVE-2010-1121 State: PUBLISHED Published: 2010-03-25T20:31:00 Last Updated: 2024-08-07T01:14:06.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Firefox 3.6.x before 3.6.3 does not properly manage the scopes of DOM nodes that are moved from one document to another, which allows remote attackers to conduct use-after-free attacks and execute arbitrary code via unspecified vectors involving improper interaction with garbage collection, as demonstrated by Nils during a Pwn2Own competition at CanSecWest 2010. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/40481 - http://ubuntu.com/usn/usn-930-1 - http://lists.fedorapro
Container: References: - http://secunia.com/advisories/40481 - http://ubuntu.com/usn/usn-930-1 - http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10924 - http://www.vupen.com/english/advisories/2010/1640 - http://www.redhat.com/support/errata/RHSA-2010-0501.html - http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010 - http://www.vupen.com/english/advisories/2010/1557 - http://www.vupen.com/english/advisories/2010/1773 - http://www.vupen.com/english/advisories/2010/1592 - http://www.ubuntu.com/usn/usn-930-2 - http://www.securitytracker.com/id?1023817 - https://bugzil
/advisories/2010/1592 - http://www.ubuntu.com/usn/usn-930-2 - http://www.securitytracker.com/id?1023817 - https://bugzilla.mozilla.org/show_bug.cgi?id=555109 - http://www.redhat.com/support/errata/RHSA-2010-0500.html - http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html - http://news.cnet.com/8301-27080_3-20001126-245.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6844 - http://secunia.com/advisories/40323 - http://twitter.com/thezdi/statuses/11005277222 - http://secunia.com/advisories/40401 - http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html - http://www.mozilla.org/security/announce/2010/mfs
s.fedoraproject.org/pipermail/package-announce/2010-June/043369.html - http://www.mozilla.org/security/announce/2010/mfsa2010-25.html - http://secunia.com/advisories/40326 - http://support.avaya.com/css/P8/documents/100091069
CVE ID: CVE-2010-1122 State: PUBLISHED Published: 2010-03-25T22:00:00 Last Updated: 2024-08-07T01:14:06.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Mozilla Firefox 3.5.x through 3.5.8 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly have unknown other impact via vectors that might involve compressed data, a different vulnerability than CVE-2010-1028. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=552216 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12448 - http://www.mandriva.com/s
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12448 - http://www.mandriva.com/security/advisories?name=MDVSA-2010:070
CVE ID: CVE-2010-1123 State: PUBLISHED Published: 2010-03-26T18:00:00 Last Updated: 2024-08-07T01:14:06.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chip Salzenberg Deliver does not properly associate a lockfile with the user who created the file, which allows local users to cause a denial of service (blockage of incoming e-mail) by creating lockfiles for arbitrary mailboxes. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/57558 - http://www.securityfocus.com/archive/1/510306/100/0/threaded - http://www.securityfocus.com/bid/38924
CVE ID: CVE-2010-1124 State: PUBLISHED Published: 2010-03-26T18:00:00Z Last Updated: 2024-09-16T16:58:45.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: bos.rte.libc 5.3.9.4 on IBM AIX 5.3 does not properly support reading a certain address field after a successful getaddrinfo function call, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors, as demonstrated by IBM DB2 crashes on "systems with databases cataloged with alternate servers using IP addresses." Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=isg1IZ66710 - http://www.securityfocus.com/bid/38
Container: References: - http://www-01.ibm.com/support/docview.wss?uid=isg1IZ66710 - http://www.securityfocus.com/bid/38964
CVE ID: CVE-2010-1125 State: PUBLISHED Published: 2010-03-26T20:00:00 Last Updated: 2024-08-07T01:14:06.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JavaScript implementation in Mozilla Firefox 3.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the focus method. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/40481 - http://ubuntu.com/usn/usn-930-1 - http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html - http://www.se
untu.com/usn/usn-930-1 - http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html - http://www.securitytracker.com/id?1024138 - http://www.vupen.com/english/advisories/2010/1640 - https://bugzilla.mozilla.org/show_bug.cgi?id=552255 - http://www.redhat.com/support/errata/RHSA-2010-0501.html - http://www.vupen.com/english/advisories/2010/1557 - http://www.mandriva.com/security/advisories?name=MDVSA-2010:125 - http://www.vupen.com/english/advisories/2010/1773 - http://www.vupen.com/english/advisories/2010/1592 - http://www.ubuntu.com/usn/usn-930-2 - http://www.vupen.com/english/advisories/2010/1551 - http://www.redhat.com/support/errata/RHSA-2010-0500.html - http://lists.
://www.vupen.com/english/advisories/2010/1551 - http://www.redhat.com/support/errata/RHSA-2010-0500.html - http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html - http://www.mozilla.org/security/announce/2010/mfsa2010-31.html - http://secunia.com/advisories/40401 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10386 - http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13962 - http://secunia.com/advisories/40326 - http://www.securityfocus.com/archive/1/510070/100/0/threaded - http://support.avaya.com/css/P8/document
visories/40326 - http://www.securityfocus.com/archive/1/510070/100/0/threaded - http://support.avaya.com/css/P8/documents/100091069
CVE ID: CVE-2010-1126 State: PUBLISHED Published: 2010-03-26T20:00:00 Last Updated: 2024-08-07T01:14:05.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JavaScript implementation in WebKit allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the focus method. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/43068 - http://www.vupen.com/english/advisories/2011/0212 - https://bugzilla.mozilla.org/show_bug.cgi?id=552255 - http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html - http://www.securityfocus.
g.cgi?id=552255 - http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html - http://www.securityfocus.com/archive/1/510070/100/0/threaded
CVE ID: CVE-2010-1127 State: PUBLISHED Published: 2010-03-26T20:00:00Z Last Updated: 2024-09-17T02:11:19.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 6 and 7 does not initialize certain data structures during execution of the createElement method, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code, as demonstrated by setting the (1) outerHTML or (2) value property of an object returned by createElement. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2010-01/0237.html - http://securityreason.com/exp
ontainer: References: - http://archives.neohapsis.com/archives/bugtraq/2010-01/0237.html - http://securityreason.com/exploitalert/7731 - http://archives.neohapsis.com/archives/bugtraq/2010-01/0278.html
CVE ID: CVE-2010-1128 State: PUBLISHED Published: 2010-03-26T20:00:00 Last Updated: 2024-08-07T01:14:06.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/0479 - http://www.php.net/releases/5_2_13.php - http://www.redhat.com/support/errata/RHSA-2010-0919.html - http://www.php.net/ChangeLog-5
.php.net/releases/5_2_13.php - http://www.redhat.com/support/errata/RHSA-2010-0919.html - http://www.php.net/ChangeLog-5.php - http://secunia.com/advisories/38708 - http://www.securityfocus.com/bid/38430 - http://secunia.com/advisories/42410 - http://www.vupen.com/english/advisories/2010/3081
CVE ID: CVE-2010-1129 State: PUBLISHED Published: 2010-03-26T20:00:00 Last Updated: 2024-08-07T01:14:06.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: The safe_mode implementation in PHP before 5.2.13 does not properly handle directory pathnames that lack a trailing / (slash) character, which allows context-dependent attackers to bypass intended access restrictions via vectors related to use of the tempnam function. Additional Analyst Notes: - CVE Program Container: References: - http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083 - http://www.vupen.com/english/advisories/2010/0479 - http://www.php.net/releases/5_2_13.php - http://itrc.hp.com/service/cki/docD
ww.vupen.com/english/advisories/2010/0479 - http://www.php.net/releases/5_2_13.php - http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083 - http://secunia.com/advisories/40551 - http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html - http://www.php.net/ChangeLog-5.php - http://secunia.com/advisories/38708 - http://support.apple.com/kb/HT4312 - http://securitytracker.com/id?1023661 - http://www.vupen.com/english/advisories/2010/1796 - http://www.securityfocus.com/bid/38431