Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2010-4280 State: PUBLISHED Published: 2010-12-02T17:00:00 Last Updated: 2024-08-07T03:43:14.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the id_group parameter in an operation/agentes/ver_agente action to ajax.php or (2) the group_id parameter in an operation/agentes/estado_agente action to index.php, related to operation/agentes/estado_agente.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/42347 - http://www.securityfocus.com/archive/1/514939/100/0/threaded - http://osv
ences: - http://secunia.com/advisories/42347 - http://www.securityfocus.com/archive/1/514939/100/0/threaded - http://osvdb.org/69548 - http://osvdb.org/69547 - http://www.exploit-db.com/exploits/15641 - http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download - http://www.securityfocus.com/bid/45112 - http://seclists.org/fulldisclosure/2010/Nov/326 - http://www.exploit-db.com/exploits/15642
CVE ID: CVE-2010-4281 State: PUBLISHED Published: 2010-12-02T17:00:00 Last Updated: 2024-08-07T03:43:13.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in the safe_url_extraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : (colon) character. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/42347 - http://www.securityfocus.com/archive/1/514939/100/0/threaded - http://osvdb.org/69546 - http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203
chive/1/514939/100/0/threaded - http://osvdb.org/69546 - http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download - http://www.securityfocus.com/bid/45112 - http://seclists.org/fulldisclosure/2010/Nov/326 - http://www.exploit-db.com/exploits/15643
CVE ID: CVE-2010-4282 State: PUBLISHED Published: 2010-12-02T17:00:00 Last Updated: 2024-08-07T03:43:14.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/69545 - http://secunia.com/advisories/42347 - http:/
lyst Notes: - CVE Program Container: References: - http://osvdb.org/69545 - http://secunia.com/advisories/42347 - http://www.securityfocus.com/archive/1/514939/100/0/threaded - http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download - http://osvdb.org/69543 - http://www.securityfocus.com/bid/45112 - http://osvdb.org/69544 - http://seclists.org/fulldisclosure/2010/Nov/326 - http://www.exploit-db.com/exploits/15643
CVE ID: CVE-2010-4283 State: PUBLISHED Published: 2010-12-02T17:00:00 Last Updated: 2024-08-07T03:43:13.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in extras/pandora_diag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the argv[1] parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/42347 - http://www.securityfocus.com/archive/1/514939/100/0/threaded - http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download - http://osvdb.org/6
03.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download - http://osvdb.org/69542 - http://www.securityfocus.com/bid/45112 - http://seclists.org/fulldisclosure/2010/Nov/326 - http://www.exploit-db.com/exploits/15643
CVE ID: CVE-2010-4284 State: PUBLISHED Published: 2011-05-09T22:00:00Z Last Updated: 2024-09-16T18:18:07.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the authentication form in the integrated web server in the Data Management Server (DMS) before 1.4.3 in Samsung Integrated Management System allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/236668 - http://www.us-cert.gov/control_systems/pdf/ICSA-11-069-01.pdf
CVE ID: CVE-2010-4285 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2010-4286 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2010-4287 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2010-4288 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2010-4289 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2010-4290 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2010-4291 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2010-4292 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2010-4293 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2010-4294 State: PUBLISHED Published: 2010-12-06T21:00:00 Last Updated: 2024-08-07T03:43:14.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: The frame decompression functionality in the VMnc media codec in VMware Movie Decoder before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548, VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548 on Windows, VMware Player 2.5.x before 2.5.5 build 246459 and 3.x before 3.1.2 build 301548 on Windows, and VMware Server 2.x on Windows does not properly validate an unspecified size field, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption)
ize field, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted video file. Additional Analyst Notes: - CVE Program Container: References: - http://lists.vmware.com/pipermail/security-announce/2010/000112.html - http://www.vmware.com/security/advisories/VMSA-2010-0018.html - http://www.securityfocus.com/bid/45169 - http://www.securityfocus.com/archive/1/514995/100/0/threaded - http://osvdb.org/69596 - http://www.securitytracker.com/id?1024819 - http://secunia.com/advisories/42482 - http://www.vupen.com/english/advisories/2010/3116
CVE ID: CVE-2010-4295 State: PUBLISHED Published: 2010-12-06T21:00:00 Last Updated: 2024-08-07T03:43:13.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the mounting process in vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Server 2.0.2 on Linux, and VMware Fusion 3.1.x before 3.1.2 build 332101 allows host OS users to gain privileges via vectors involving temporary files. Additional Analyst Notes: - CVE Program Container: References: - http://lists.vmware.com/pipermail/security-announce/2010/000112.html - http://osvdb.org/69585 - http://www.vmware.com/security/advisori
ware.com/pipermail/security-announce/2010/000112.html - http://osvdb.org/69585 - http://www.vmware.com/security/advisories/VMSA-2010-0018.html - http://www.securityfocus.com/bid/45167 - http://www.securityfocus.com/archive/1/514995/100/0/threaded - http://secunia.com/advisories/42453 - http://www.securitytracker.com/id?1024819 - http://secunia.com/advisories/42482 - http://www.vupen.com/english/advisories/2010/3116 - http://www.securitytracker.com/id?1024820
CVE ID: CVE-2010-4296 State: PUBLISHED Published: 2010-12-06T21:00:00 Last Updated: 2024-08-07T03:43:14.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Server 2.0.2 on Linux, and VMware Fusion 3.1.x before 3.1.2 build 332101 does not properly load libraries, which allows host OS users to gain privileges via vectors involving shared object files. Additional Analyst Notes: - CVE Program Container: References: - http://lists.vmware.com/pipermail/security-announce/2010/000112.html - http://www.vmware.com/security/advisories/VMSA-2010-0018.html
vmware.com/pipermail/security-announce/2010/000112.html - http://www.vmware.com/security/advisories/VMSA-2010-0018.html - http://www.securityfocus.com/bid/45168 - http://www.securityfocus.com/archive/1/514995/100/0/threaded - http://secunia.com/advisories/42453 - http://www.securitytracker.com/id?1024819 - http://secunia.com/advisories/42482 - http://www.vupen.com/english/advisories/2010/3116 - http://www.securitytracker.com/id?1024820 - http://osvdb.org/69584
CVE ID: CVE-2010-4297 State: PUBLISHED Published: 2010-12-06T21:00:00 Last Updated: 2024-08-07T03:43:14.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before 2.5.5 build 328052 and 3.1.x before 3.1.2 build 301548; VMware Server 2.0.2; VMware Fusion 2.x before 2.0.8 build 328035 and 3.1.x before 3.1.2 build 332101; VMware ESXi 3.5, 4.0, and 4.1; and VMware ESX 3.0.3, 3.5, 4.0, and 4.1 allows host OS users to gain privileges on the guest OS via unspecified vectors, related to a "command injection" issue. Additional Analyst Notes: -
privileges on the guest OS via unspecified vectors, related to a "command injection" issue. Additional Analyst Notes: - CVE Program Container: References: - http://lists.vmware.com/pipermail/security-announce/2010/000112.html - http://osvdb.org/69590 - http://www.vmware.com/security/advisories/VMSA-2010-0018.html - http://www.securityfocus.com/bid/45166 - http://www.securityfocus.com/archive/1/514995/100/0/threaded - http://secunia.com/advisories/42480 - http://www.securitytracker.com/id?1024819 - http://secunia.com/advisories/42482 - http://www.vupen.com/english/advisories/2010/3116 - http://www.securitytracker.com/id?1024820
CVE ID: CVE-2010-4298 State: PUBLISHED Published: 2010-11-26T19:00:00 Last Updated: 2024-08-07T03:43:14.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the download module in Free Simple Software 1.0 allows remote attackers to execute arbitrary SQL commands via the downloads_id parameter in a download_now action to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.uncompiled.com/2010/11/free-simple-software-sql-injection-vulnerability-cve-2010-4298/ - http://www.securityfocus.com/archive/1/514863/100/0/threaded - http://www.securityfocus.com/bid/44998
CVE ID: CVE-2010-4299 State: PUBLISHED Published: 2010-11-20T20:00:00 Last Updated: 2024-08-07T03:43:13.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in ZfHIPCND.exe in Novell Zenworks 7 Handheld Management (ZHM) allows remote attackers to execute arbitrary code via a crafted request to TCP port 2400. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=full-disclosure&m=128916914213292&w=2 - http://www.novell.com/support/viewContent.do?externalId=7007135 - http://www.securitytracker.com/id?1024691 - http://www.zerodayinitiative.com/advisories/ZDI-10-230/ - http://secunia.com/advisories/42130
CVE ID: CVE-2010-4300 State: PUBLISHED Published: 2010-11-26T18:23:00 Last Updated: 2024-08-07T03:43:13.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the dissect_ldss_transfer function (epan/dissectors/packet-ldss.c) in the LDSS dissector in Wireshark 1.2.0 through 1.2.12 and 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an LDSS packet with a long digest line that triggers memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5318 - http://lists.opensuse.org/opensuse-security-announce/2011-
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5318 - http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html - http://blogs.sun.com/security/entry/buffer_overflow_vulnerability_in_wireshark - http://www.vupen.com/english/advisories/2010/3093 - http://secunia.com/advisories/43068 - http://secunia.com/advisories/42290 - http://www.securitytracker.com/id?1024762 - http://www.vupen.com/english/advisories/2011/0212 - http://www.vupen.com/english/advisories/2010/3068 - http://osvdb.org/69354 - http://secunia.com/advisories/42877 - http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html - http://www.redhat.com/support/errata/RHSA-2010-0924.html - http:
.org/opensuse-security-announce/2011-01/msg00006.html - http://www.redhat.com/support/errata/RHSA-2010-0924.html - http://www.exploit-db.com/exploits/15676 - http://www.vupen.com/english/advisories/2011/0404 - http://www.wireshark.org/security/wnpa-sec-2010-14.html - http://www.vupen.com/english/advisories/2011/0076 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14287 - http://www.mandriva.com/security/advisories?name=MDVSA-2010:242 - http://www.wireshark.org/security/wnpa-sec-2010-13.html - http://www.vupen.com/english/advisories/2010/3038 - http://secunia.com/advisories/42411 - http://www.securityfocus.com/bid/44987
CVE ID: CVE-2010-4301 State: PUBLISHED Published: 2010-11-26T18:23:00 Last Updated: 2024-08-07T03:43:14.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: epan/dissectors/packet-zbee-zcl.c in the ZigBee ZCL dissector in Wireshark 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted ZCL packet, related to Discover Attributes. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html - http://secunia.com/advisories/43068 - http://www.securityfocus.com/bid/44986 - http://secunia.com/advisories/42290 - https://oval.cisecurity.org/repository/search/defin
.securityfocus.com/bid/44986 - http://secunia.com/advisories/42290 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14713 - http://www.vupen.com/english/advisories/2011/0212 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5303 - https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5315&action=edit - http://osvdb.org/69355 - http://secunia.com/advisories/42877 - http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html - http://www.wireshark.org/security/wnpa-sec-2010-14.html - http://www.vupen.com/english/advisories/2011/0076 - http://www.vupen.com/english/advisories/2010/3038 - http://www.exploit-db.com/exploits/15973
CVE ID: CVE-2010-4302 State: PUBLISHED Published: 2010-11-22T19:00:00Z Last Updated: 2024-09-16T19:31:27.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: /opt/rv/Versions/CurrentVersion/Mcu/Config/Mcu.val in Cisco Unified Videoconferencing (UVC) System 5110 and 5115, when the Linux operating system is used, uses a weak hashing algorithm for the (1) administrator and (2) operator passwords, which makes it easier for local users to obtain sensitive information by recovering the cleartext values, aka Bug ID CSCti54010. Additional Analyst Notes: - CVE Program Container: References: - http://www.trustmatta.com/advisories/MATTA-2010-001.txt - http://www.cisco.com/en/US/products/prod
tainer: References: - http://www.trustmatta.com/advisories/MATTA-2010-001.txt - http://www.cisco.com/en/US/products/products_security_response09186a0080b56d0d.html - http://seclists.org/fulldisclosure/2010/Nov/167
CVE ID: CVE-2010-4303 State: PUBLISHED Published: 2010-11-22T19:00:00Z Last Updated: 2024-09-16T16:18:25.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Unified Videoconferencing (UVC) System 5110 and 5115, when the Linux operating system is used, uses world-readable permissions for the /etc/shadow file, which allows local users to discover encrypted passwords by reading this file, aka Bug ID CSCti54043. Additional Analyst Notes: - CVE Program Container: References: - http://www.trustmatta.com/advisories/MATTA-2010-001.txt - http://www.cisco.com/en/US/products/products_security_response09186a0080b56d0d.html - http://seclists.org/fulldisclosure/2010/Nov/167
CVE ID: CVE-2010-4304 State: PUBLISHED Published: 2010-11-22T19:00:00Z Last Updated: 2024-09-16T22:09:42.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface in Cisco Unified Videoconferencing (UVC) System 3545, 5110, 5115, and 5230; Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway; Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gateway; and Unified Videoconferencing 3515 Multipoint Control Unit (MCU) uses predictable session IDs based on time values, which makes it easier for remote attackers to hijack sessions via a brute-force attack, aka Bug ID CSCti54048. Additional Analyst Notes: - CVE Program Container: References: - http://w
a a brute-force attack, aka Bug ID CSCti54048. Additional Analyst Notes: - CVE Program Container: References: - http://www.trustmatta.com/advisories/MATTA-2010-001.txt - http://www.cisco.com/en/US/products/products_security_response09186a0080b56d0d.html - http://seclists.org/fulldisclosure/2010/Nov/167
CVE ID: CVE-2010-4305 State: PUBLISHED Published: 2010-11-22T19:00:00Z Last Updated: 2024-09-16T23:45:28.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Unified Videoconferencing (UVC) System 3545, 5110, 5115, and 5230; Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway; Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gateway; and Unified Videoconferencing 3515 Multipoint Control Unit (MCU) improperly use cookies for web-interface credentials, which allows remote attackers to obtain sensitive information by reading a (1) cleartext or (2) base64-encoded cleartext cookie, aka Bug ID CSCti54052. Additional Analyst Notes: - CVE Program Container:
artext or (2) base64-encoded cleartext cookie, aka Bug ID CSCti54052. Additional Analyst Notes: - CVE Program Container: References: - http://www.trustmatta.com/advisories/MATTA-2010-001.txt - http://www.cisco.com/en/US/products/products_security_response09186a0080b56d0d.html - http://seclists.org/fulldisclosure/2010/Nov/167
CVE ID: CVE-2010-4306 State: PUBLISHED Published: 2011-02-10T15:00:00 Last Updated: 2024-08-07T03:43:14.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0555, CVE-2010-4093, CVE-2010-4187, CVE-2010-4190, CVE-2010-4191, and CVE-2010-4192. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2011/0335 - http://www.adobe.com/support/security/bulletins/apsb11-01.html - http://www.securityfocus.com/bid/46333 - http://www.securitytracker
dobe.com/support/security/bulletins/apsb11-01.html - http://www.securityfocus.com/bid/46333 - http://www.securitytracker.com/id?1025056
CVE ID: CVE-2010-4307 State: PUBLISHED Published: 2011-02-10T15:00:00 Last Updated: 2024-08-07T03:43:14.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2011/0335 - http://www.adobe.com/support/security/bulletins/apsb11-01.html - http://www.securitytracker.com/id?1025056 - http://www.securityfocus.com/bid/46339
CVE ID: CVE-2010-4308 State: PUBLISHED Published: 2011-08-11T22:00:00 Last Updated: 2024-08-07T03:43:14.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adobe Shockwave Player before 11.6.1.629 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-4309. Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/cas/techalerts/TA11-222A.html - http://www.adobe.com/support/security/bulletins/apsb11-19.html
CVE ID: CVE-2010-4309 State: PUBLISHED Published: 2011-08-11T22:00:00 Last Updated: 2024-08-07T03:43:14.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adobe Shockwave Player before 11.6.1.629 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-4308. Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/cas/techalerts/TA11-222A.html - http://www.adobe.com/support/security/bulletins/apsb11-19.html
CVE ID: CVE-2010-4311 State: PUBLISHED Published: 2010-11-26T19:00:00 Last Updated: 2024-08-07T03:43:14.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: Free Simple Software 1.0 stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.uncompiled.com/2010/11/free-simple-software-sql-injection-vulnerability-cve-2010-4298/ - http://www.securityfocus.com/archive/1/514863/100/0/threaded
CVE ID: CVE-2010-4312 State: PUBLISHED Published: 2010-11-26T19:00:00 Last Updated: 2024-08-07T03:43:14.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/514866/100/0/threaded
CVE ID: CVE-2010-4313 State: PUBLISHED Published: 2010-12-02T17:00:00 Last Updated: 2024-08-07T03:43:14.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in fileman_file_upload.php in Orbis CMS 1.0.2 allows remote authenticated users to execute arbitrary code by uploading a .php file, and then accessing it via a direct request to the file in uploads/. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/15636 - http://www.securityfocus.com/archive/1/514942/100/0/threaded - http://osvdb.org/69599 - http://www.securityfocus.com/bid/45103 - http://www.uncompiled.com/2010/11/orbis-cms-arbitrary-sc
tp://osvdb.org/69599 - http://www.securityfocus.com/bid/45103 - http://www.uncompiled.com/2010/11/orbis-cms-arbitrary-script-execution-vulnerability-cve-2010-4313/