deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-0790
Published: 2010-03-10
Description: sutil/ncpumount.c in ncpumount in ncpfs 2.2.6 produces certain detailed error messages about the results of privileged file-access attempts, which allows local users to determine the existence of arbitrary files via the mountpoint name.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html; http://seclists.org/fulldisclosure/2010/Mar/122
CVE: CVE-2010-0791
Published: 2010-03-10
Description: The (1) ncpmount, (2) ncpumount, and (3) ncplogin programs in ncpfs 2.2.6 do not properly create lock files, which allows local users to cause a denial of service (application failure) via unspecified vectors that trigger the creation of a /etc/mtab~ file that persists after the program exits.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html; http://seclists.org/fulldisclosure/2010/Mar/122
CVE: CVE-2010-0926
Published: 2010-03-10
Description: The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-02/0083.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-02/0107.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-02/0108.html
CVE: CVE-2010-0947
Published: 2010-03-10
Description: Cross-site scripting (XSS) vulnerability in post.aspx in Max Network Technology BBSMAX 3.0, 4.1, and 4.2 allows remote attackers to inject arbitrary web script or HTML via the action parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1003-exploits/bbsmax-xss.txt; http://www.securityfocus.com/archive/1/509905/100/0/threaded; http://www.securityfocus.com/bid/38592
CVE: CVE-2010-0948
Published: 2010-03-10
Description: SQL injection vulnerability in profil.php in Bigforum 4.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/62778; http://packetstormsecurity.org/1003-exploits/bigforum-sql.txt; http://secunia.com/advisories/38872
CVE: CVE-2010-0949
Published: 2010-03-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Natychmiast CMS allow remote attackers to inject arbitrary web script or HTML via the id_str parameter to (1) index.php and (2) a_index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.packetstormsecurity.com/1003-exploits/natychmiast-sqlxss.txt; http://www.securityfocus.com/archive/1/509890/100/0/threaded; http://www.securityfocus.com/bid/38561
CVE: CVE-2010-0950
Published: 2010-03-10
Description: Multiple SQL injection vulnerabilities in Natychmiast CMS allow remote attackers to execute arbitrary SQL commands via the id_str parameter to (1) index.php and (2) a_index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.packetstormsecurity.com/1003-exploits/natychmiast-sqlxss.txt; http://www.securityfocus.com/archive/1/509890/100/0/threaded; http://www.securityfocus.com/bid/38561
CVE: CVE-2010-0951
Published: 2010-03-10
Description: SQL injection vulnerability in go_target.php in dev4u CMS allows remote attackers to execute arbitrary SQL commands via the kontent_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1003-exploits/dev4u-sql.txt; http://www.exploit-db.com/exploits/11643; http://www.securityfocus.com/bid/38577
CVE: CVE-2010-0952
Published: 2010-03-10
Description: SQL injection vulnerability in index.php in OneCMS 2.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an elite action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/1003-exploits/onecmsv25-sql.txt; http://secunia.com/advisories/30378; http://www.exploit-db.com/exploits/11635
CVE: CVE-2010-0953
Published: 2010-03-10
Description: Directory traversal vulnerability in mod.php in phpCOIN 1.2.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the mod parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/11641; http://www.securityfocus.com/bid/38576; https://exchange.xforce.ibmcloud.com/vulnerabilities/56721
CVE: CVE-2010-0954
Published: 2010-03-10
Description: SQL injection vulnerability in search_result.asp in Pre Projects Pre E-Learning Portal allows remote attackers to execute arbitrary SQL commands via the course_ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://evilc0de.blogspot.com/2010/03/pre-e-learning-portal-sql-injection.html; http://osvdb.org/62774; http://secunia.com/advisories/38891
CVE: CVE-2010-0955
Published: 2010-03-10
Description: SQL injection vulnerability in index.php in Bild Flirt Community 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://4004securityproject.wordpress.com/2010/03/07/bild-flirt-system-v2-0-index-php-id-sql-injection/; http://osvdb.org/62780; http://packetstormsecurity.org/1003-exploits/bildflirt-sql.txt
CVE: CVE-2010-0956
Published: 2010-03-10
Description: SQL injection vulnerability in index.php in OpenCart 1.3.2 allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1003-exploits/opencart-sql.txt; http://www.securityfocus.com/bid/38605; http://packetstormsecurity.org/1003-exploits/opencart-sql.txt
CVE: CVE-2010-0957
Published: 2010-03-10
Description: Directory traversal vulnerability in content.php in Saskia's Shopsystem beta1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1002-exploits/saskiashopsystem-lfi.txt; http://www.exploit-db.com/exploits/11433; http://www.securityfocus.com/bid/38574
CVE: CVE-2010-0958
Published: 2010-03-10
Description: Directory traversal vulnerability in modules/hayoo/index.php in Tribisur 2.1, 2.0, and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary files via directory traversal sequences in the theme parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1003-exploits/tribisur-lfi.txt; http://secunia.com/advisories/28362; http://www.exploit-db.com/exploits/11655
CVE: CVE-2009-4680
Published: 2010-03-10
Description: SQL injection vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to execute arbitrary SQL commands via the st parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/wbd-sqlxss.txt; http://secunia.com/advisories/35941; http://www.exploit-db.com/exploits/9226
CVE: CVE-2009-4681
Published: 2010-03-10
Description: Cross-site scripting (XSS) vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to inject arbitrary web script or HTML via the st parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/wbd-sqlxss.txt; http://secunia.com/advisories/35941; http://www.exploit-db.com/exploits/9226
CVE: CVE-2009-4682
Published: 2010-03-10
Description: Cross-site scripting (XSS) vulnerability in vote.php in Good/Bad Vote allows remote attackers to inject arbitrary web script or HTML via the id parameter in a vote action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35835; http://www.exploit-db.com/exploits/9185; http://www.osvdb.org/55919
CVE: CVE-2009-4683
Published: 2010-03-10
Description: Directory traversal vulnerability in vote.php in Good/Bad Vote allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the id parameter in a dovote action. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/35835; http://www.exploit-db.com/exploits/9185; http://www.osvdb.org/55918
CVE: CVE-2009-4684
Published: 2010-03-10
Description: Cross-site scripting (XSS) vulnerability in index.php in EZodiak allows remote attackers to inject arbitrary web script or HTML via the sign parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56073; http://packetstormsecurity.org/0907-exploits/ezodiak-xss.txt; http://secunia.com/advisories/35923
CVE: CVE-2009-4685
Published: 2010-03-10
Description: Cross-site scripting (XSS) vulnerability in celebrities.php in PHP Scripts Now Astrology allows remote attackers to inject arbitrary web script or HTML via the day parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56083; http://packetstormsecurity.org/0907-exploits/astrology-xss.txt; http://secunia.com/advisories/35933
CVE: CVE-2009-4686
Published: 2010-03-10
Description: Cross-site scripting (XSS) vulnerability in account.php in phplemon AdQuick 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the red_url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56056; http://packetstormsecurity.org/0907-exploits/adquick-xss.txt; http://secunia.com/advisories/35926
CVE: CVE-2009-4687
Published: 2010-03-10
Description: SQL injection vulnerability in silentum_guestbook.php in Silentum Guestbook 2.0.2 allows remote attackers to execute arbitrary SQL commands via the messageid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9202; https://exchange.xforce.ibmcloud.com/vulnerabilities/51845; http://www.exploit-db.com/exploits/9202
CVE: CVE-2009-4688
Published: 2010-03-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in PHP Shopping Cart Selling Website Script allow remote attackers to inject arbitrary web script or HTML via the (1) txtkeywords and (2) cid parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/scsc-sqlxss.txt; http://secunia.com/advisories/35894; http://www.vupen.com/english/advisories/2009/1977
CVE: CVE-2009-4689
Published: 2010-03-10
Description: SQL injection vulnerability in index.php in PHP Shopping Cart Selling Website Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/scsc-sqlxss.txt; http://secunia.com/advisories/35894; http://www.vupen.com/english/advisories/2009/1977
CVE: CVE-2009-4690
Published: 2010-03-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Programs Rating Script allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) rate.php and (2) postcomments.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56076; http://osvdb.org/56077; http://packetstormsecurity.org/0907-exploits/programsrating-xss.txt
CVE: CVE-2009-4691
Published: 2010-03-10
Description: SQL injection vulnerability in addlink.php in Classified Linktrader Script allows remote attackers to execute arbitrary SQL commands via the slctCategories parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/linktrader-sqlxss.txt; http://secunia.com/advisories/35904; http://www.vupen.com/english/advisories/2009/1980
CVE: CVE-2009-4692
Published: 2010-03-10
Description: Cross-site scripting (XSS) vulnerability in index.php in RadScripts RadLance Gold 7.5 allows remote attackers to inject arbitrary web script or HTML via the pr parameter in a ulist action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35826; http://www.exploit-db.com/exploits/9195; http://www.osvdb.org/55949
CVE: CVE-2009-4693
Published: 2010-03-10
Description: Multiple PHP remote file inclusion vulnerabilities in GraFX MiniCWB 2.3.0 allow remote attackers to execute arbitrary PHP code via a URL in the LANG parameter to (1) en.inc.php, (2) hu.inc.php, (3) no.inc.php, (4) ro.inc.php, and (5) ru.inc.php in language/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9204; http://www.securityfocus.com/bid/35738; http://www.vupen.com/english/advisories/2009/1960
CVE: CVE-2009-4694
Published: 2010-03-10
Description: Cross-site scripting (XSS) vulnerability in index.php in RadScripts RadLance Gold 7.5 allows remote attackers to inject arbitrary web script or HTML via the fid parameter in a view_forum action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/55949; http://secunia.com/advisories/35826; https://exchange.xforce.ibmcloud.com/vulnerabilities/51835
CVE: CVE-2009-4695
Published: 2010-03-10
Description: SQL injection vulnerability in index.php in RadScripts RadLance Gold 7.5 allows remote attackers to execute arbitrary SQL commands via the fid parameter in a view_forum action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35826; http://www.exploit-db.com/exploits/9195; http://www.osvdb.org/55948
CVE: CVE-2009-4696
Published: 2010-03-10
Description: SQL injection vulnerability in index.php in RadNICS Gold 5 allows remote attackers to execute arbitrary SQL commands via the fid parameter in a view_forum action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35846; http://www.exploit-db.com/exploits/9196; http://www.osvdb.org/55950
CVE: CVE-2009-4697
Published: 2010-03-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in RadNICS Gold 5 allow remote attackers to inject arbitrary web script or HTML via the (1) order parameter in a ulist action and the (2) fid parameter in a view_forum action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35846; http://www.exploit-db.com/exploits/9196; http://www.osvdb.org/55951
CVE: CVE-2010-0257
Published: 2010-03-10
Description: Microsoft Office Excel 2002 SP3 does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Microsoft Office Excel Record Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securitytracker.com/id?1023698; http://www.us-cert.gov/cas/techalerts/TA10-068A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-017
CVE: CVE-2010-0258
Published: 2010-03-10
Description: Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that causes memory to be interpreted as a different object type than intended, aka "Microsoft Office Excel Sheet Object Type Confusion Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=859; http://www.securitytracker.com/id?1023698; http://www.us-cert.gov/cas/techalerts/TA10-068A.html
CVE: CVE-2010-0260
Published: 2010-03-10
Description: Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted spreadsheet in which "a MDXTUPLE record is broken up into several records," aka "Microsoft Office Excel MDXTUPLE Record Heap Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=862; http://www.securitytracker.com/id?1023698; http://www.us-cert.gov/cas/techalerts/TA10-068A.html
CVE: CVE-2010-0261
Published: 2010-03-10
Description: Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2 and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted spreadsheet in which "a MDXSET record is broken up into several records," aka "Microsoft Office Excel MDXSET Record Heap Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=861; http://www.securitytracker.com/id?1023698; http://www.us-cert.gov/cas/techalerts/TA10-068A.html
CVE: CVE-2010-0262
Published: 2010-03-10
Description: Microsoft Office Excel 2007 SP1 and SP2 and Office 2004 for Mac do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that triggers access of an uninitialized stack variable, aka "Microsoft Office Excel FNGROUPNAME Record Uninitialized Memory Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=860; http://www.securitytracker.com/id?1023698; http://www.us-cert.gov/cas/techalerts/TA10-068A.html
CVE: CVE-2010-0263
Published: 2010-03-10
Description: Microsoft Office Excel 2007 SP1 and SP2; Office 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; and Office SharePoint Server 2007 SP1 and SP2 do not validate ZIP headers during decompression of Open XML (.XLSX) documents, which allows remote attackers to execute arbitrary code via a crafted document that triggers access to uninitialized memory locations, aka "Microsoft Office Excel XLSX File Parsing Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/archive/1/509979/100/0/threaded; http://www.securitytracker.com/id?1023698; http://www.us-cert.gov/cas/techalerts/TA10-068A.html
CVE: CVE-2010-0264
Published: 2010-03-10
Description: Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Microsoft Office Excel DbOrParamQry Record Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securitytracker.com/id?1023698; http://www.us-cert.gov/cas/techalerts/TA10-068A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-017
CVE: CVE-2010-0265
Published: 2010-03-10
Description: Buffer overflow in Microsoft Windows Movie Maker 2.1, 2.6, and 6.0, and Microsoft Producer 2003, allows remote attackers to execute arbitrary code via a crafted project (.MSWMM) file, aka "Movie Maker and Producer Buffer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/cas/techalerts/TA10-068A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-016; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8595
CVE: CVE-2010-0447
Published: 2010-03-10
Description: The helpmanager servlet in the web server in HP OpenView Performance Insight (OVPI) 5.4 and earlier does not properly authenticate and validate requests, which allows remote attackers to execute arbitrary commands via vectors involving upload of a JSP document.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4020&w=2; http://osvdb.org/62797; http://secunia.com/advisories/38899
CVE: CVE-2010-0806
Published: 2010-03-10
Description: Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx; http://osvdb.org/62810; http://secunia.com/advisories/38860
CVE: CVE-2010-0959
Published: 2010-03-10
Description: Cross-site scripting (XSS) vulnerability in WebEditor/Authentication/LoginPage.aspx in IBM ENOVIA SmarTeam 5 allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/62901; http://www.securityfocus.com/archive/1/509975/100/0/threaded; http://www.securityfocus.com/bid/38612
CVE: CVE-2010-0960
Published: 2010-03-10
Description: Buffer overflow in qosmod in bos.net.tcp.server in IBM AIX 6.1 and VIOS 2.1 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://aix.software.ibm.com/aix/efixes/security/qosmod_advisory.asc; http://securitytracker.com/id?1023695; http://www.ibm.com/support/docview.wss?uid=isg1IZ68231
CVE: CVE-2010-0961
Published: 2010-03-10
Description: Buffer overflow in qoslist in bos.net.tcp.server in IBM AIX 6.1 and VIOS 2.1 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://aix.software.ibm.com/aix/efixes/security/qoslist_advisory.asc; http://securitytracker.com/id?1023694; http://www.ibm.com/support/docview.wss?uid=isg1IZ68194
CVE: CVE-2010-0962
Published: 2010-03-10
Description: The FTP proxy server in Apple AirPort Express, AirPort Extreme, and Time Capsule with firmware 7.5 does not restrict the IP address and port specified in a PORT command from a client, which allows remote attackers to leverage intranet FTP servers for arbitrary TCP forwarding via a crafted PORT command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2010/Mar/106; http://www.securityfocus.com/archive/1/509867/100/0/threaded; http://www.securityfocus.com/archive/1/509974/100/0/threaded
CVE: CVE-2009-4001
Published: 2010-03-15
Description: Integer overflow in XnView before 1.97.2 might allow remote attackers to execute arbitrary code via a DICOM image with crafted dimensions, leading to a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://newsgroup.xnview.com/viewtopic.php?f=35&t=19469; http://secunia.com/secunia_research/2009-60/; http://www.osvdb.org/62829
CVE: CVE-2010-0040
Published: 2010-03-15
Description: Integer overflow in ColorSync in Apple Safari before 4.0.5 on Windows, and iTunes before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image with a crafted color profile that triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html; http://secunia.com/advisories/39135