deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1891
Published: 2010-09-15
Description: The Client/Server Runtime Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2, when a Chinese, Japanese, or Korean locale is enabled, does not properly allocate memory for transactions, which allows local users to gain privileges via a crafted application, aka "CSRSS Local Elevation of Privilege Vulnerability."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-069; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7536; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-069
CVE: CVE-2010-1899
Published: 2010-09-15
Description: Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage) via a crafted request, related to asp.dll, aka "IIS Repeated Parameter Request Denial of Service Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-065; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7127; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-065
CVE: CVE-2010-2563
Published: 2010-09-15
Description: The Word 97 text converter in the WordPad Text Converters in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly parse malformed structures in Word 97 documents, which allows remote attackers to execute arbitrary code via a crafted document containing an unspecified value that is used in a loop counter, aka "WordPad Word 97 Text Converter Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=879; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-067; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6632
CVE: CVE-2010-2567
Published: 2010-09-15
Description: The RPC client implementation in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly allocate memory during the parsing of responses, which allows remote RPC servers and man-in-the-middle attackers to execute arbitrary code via a malformed response, aka "RPC Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-066; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7177; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-066
CVE: CVE-2010-2728
Published: 2010-09-15
Description: Heap-based buffer overflow in Microsoft Outlook 2002 SP3, 2003 SP3, and 2007 SP2, when Online Mode for an Exchange Server is enabled, allows remote attackers to execute arbitrary code via a crafted e-mail message, aka "Heap Based Buffer Overflow in Outlook Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-064; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7125; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-064
CVE: CVE-2010-2729
Published: 2010-09-15
Description: The Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when printer sharing is enabled, does not properly validate spooler access permissions, which allows remote attackers to create files in a system directory, and consequently execute arbitrary code, by sending a crafted print request over RPC, as exploited in the wild in September 2010, aka "Print Spooler Service Impersonation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-061; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7358; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-061
CVE: CVE-2010-2730
Published: 2010-09-15
Description: Buffer overflow in Microsoft Internet Information Services (IIS) 7.5, when FastCGI is enabled, allows remote attackers to execute arbitrary code via crafted headers in a request, aka "Request Header Buffer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-065; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6933; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-065
CVE: CVE-2010-2731
Published: 2010-09-15
Description: Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.1 on Windows XP SP3, when directory-based Basic Authentication is enabled, allows remote attackers to bypass intended access restrictions and execute ASP files via a crafted request, aka "Directory Authentication Bypass Vulnerability."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-065; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6942; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-065
CVE: CVE-2010-2738
Published: 2010-09-15
Description: The Uniscribe (aka new Unicode Script Processor) implementation in USP10.DLL in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2, and Microsoft Office XP SP3, 2003 SP3, and 2007 SP2, does not properly validate tables associated with malformed OpenType fonts, which allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) Office document, aka "Uniscribe Font Parsing Engine Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-063; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7214; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-063
CVE: CVE-2010-3010
Published: 2010-09-15
Description: Cross-site scripting (XSS) vulnerability on the HP 3Com OfficeConnect Gigabit VPN Firewall 3CREVF100-73 with firmware before 1.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: a separate XSS issue for HP System Management Homepage (SMH) was originally assigned CVE-2010-3010 due to a CNA error, but CVE-2010-3012 is the appropriate identifier for the SMH issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02507909; http://securitytracker.com/id?1024449; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02507909
CVE: CVE-2010-3089
Published: 2010-09-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) the list information field or (2) the list description field.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052297.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052312.html
CVE: CVE-2010-3171
Published: 2010-09-15
Description: The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5.11, 3.6.4 through 3.6.8, and 4.0 Beta1 uses a random number generator that is seeded only once per document object, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack." NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-5913.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2010-09/0117.html; http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://secunia.com/advisories/42867
CVE: CVE-2010-3398
Published: 2010-09-15
Description: Unspecified vulnerability in the webcontainer implementation in IBM Lotus Sametime Connect 8.5.1 before CF1 has unknown impact and attack vectors, aka SPRs LXUU87S57H and LXUU87S93W.
CVSS Score: 10.0 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21445669; http://www.securityfocus.com/bid/43220; http://www.vupen.com/english/advisories/2010/2380
CVE: CVE-2010-3399
Published: 2010-09-15
Description: The js_InitRandom function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5.11, 3.6.4 through 3.6.8, and 4.0 Beta1 uses a context pointer in conjunction with its successor pointer for seeding of a random number generator, which makes it easier for remote attackers to guess the seed value via a brute-force attack, a different vulnerability than CVE-2010-3171.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2010-09/0117.html; http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://secunia.com/advisories/42867
CVE: CVE-2010-3400
Published: 2010-09-15
Description: The js_InitRandom function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses the current time for seeding of a random number generator, which makes it easier for remote attackers to guess the seed value via a brute-force attack, a different vulnerability than CVE-2008-5913.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: https://bugzilla.mozilla.org/show_bug.cgi?id=475585; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7339; https://bugzilla.mozilla.org/show_bug.cgi?id=475585
CVE: CVE-2010-3402
Published: 2010-09-16
Description: Untrusted search path vulnerability in IDM Computer Solutions UltraEdit 16.20.0.1009, 16.10.0.1036, and probably other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a bin, cpp, css, c, dat, hpp, html, h, ini, java, log, mak, php, prj, txt, or xml file.
CVSS Score: 9.3 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0227.html; http://osvdb.org/67995; http://secunia.com/advisories/41403
CVE: CVE-2010-3403
Published: 2010-09-16
Description: Untrusted search path vulnerability in Qualcomm eXtensible Diagnostic Monitor (QXDM) 03.09.19 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse mfc71enu.dll that is located in the same folder as a .isf file.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/67991; http://secunia.com/advisories/41309; http://www.exploit-db.com/dll-hijacking-vulnerable-applications/
CVE: CVE-2010-3404
Published: 2010-09-16
Description: Multiple SQL injection vulnerabilities in eshtery CMS (aka eshtery.com) allow remote attackers to execute arbitrary SQL commands via the (1) Criteria field in an unspecified form related to catlgsearch.aspx or (2) user name to an unspecified form related to adminlogin.aspx.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14980; http://www.securityfocus.com/bid/43168; https://exchange.xforce.ibmcloud.com/vulnerabilities/61767
CVE: CVE-2010-3405
Published: 2010-09-16
Description: Buffer overflow in sa_snap in the bos.esagent fileset in IBM AIX 6.1, 5.3, and earlier and VIOS 2.1, 1.5, and earlier allows local users to leverage system group membership and gain privileges via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://aix.software.ibm.com/aix/efixes/security/sa_snap_advisory.asc; http://secunia.com/advisories/41446; http://securitytracker.com/id?1024430
CVE: CVE-2010-3406
Published: 2010-09-16
Description: Unspecified vulnerability in sa_snap in the bos.esagent fileset in IBM AIX 5.3 allows local users to leverage system group membership and delete files via unknown vectors.
CVSS Score: 1.7 (LOW)
References: http://aix.software.ibm.com/aix/efixes/security/sa_snap_advisory.asc; http://secunia.com/advisories/41446; http://www.ibm.com/support/docview.wss?uid=isg1IZ81819
CVE: CVE-2010-3407
Published: 2010-09-16
Description: Stack-based buffer overflow in the MailCheck821Address function in nnotes.dll in the nrouter.exe service in the server in IBM Lotus Domino 8.0.x before 8.0.2 FP5 and 8.5.x before 8.5.1 FP2 allows remote attackers to execute arbitrary code via a long e-mail address in an ORGANIZER:mailto header in an iCalendar calendar-invitation e-mail message, aka SPR NRBY7ZPJ9V.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.mwrinfosecurity.com/advisories/lotus_domino_ical_stack_buffer_overflow/; http://labs.mwrinfosecurity.com/files/Advisories/mwri_lotus-domino-ical-stack-overflow_2010-09-14.pdf; http://secunia.com/advisories/41433
CVE: CVE-2010-3408
Published: 2010-09-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-1823.  Reason: This candidate is a duplicate of CVE-2010-1823.  Notes: All CVE users should reference CVE-2010-1823 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-3409
Published: 2010-09-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-1824.  Reason: This candidate is a duplicate of CVE-2010-1824.  Notes: All CVE users should reference CVE-2010-1824 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-3410
Published: 2010-09-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-1825.  Reason: This candidate is a duplicate of CVE-2010-1825.  Notes: All CVE users should reference CVE-2010-1825 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-3411
Published: 2010-09-16
Description: Google Chrome before 6.0.472.59 on Linux does not properly handle cursors, which might allow attackers to cause a denial of service (assertion failure) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-617
References: http://code.google.com/p/chromium/issues/detail?id=51709; http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_14.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14156
CVE: CVE-2010-3412
Published: 2010-09-16
Description: Race condition in the console implementation in Google Chrome before 6.0.472.59 has unspecified impact and attack vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-362
References: http://code.google.com/p/chromium/issues/detail?id=51919; http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_14.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7354
CVE: CVE-2010-3413
Published: 2010-09-16
Description: Unspecified vulnerability in the pop-up blocking functionality in Google Chrome before 6.0.472.59 allows remote attackers to cause a denial of service (application crash) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=53176; http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_14.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6937
CVE: CVE-2010-3414
Published: 2010-09-16
Description: Google Chrome before 6.0.472.59 on Mac OS X does not properly implement file dialogs, which allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.  NOTE: this issue exists because of an incorrect fix for CVE-2010-3112 on Mac OS X.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=45400; http://code.google.com/p/chromium/issues/detail?id=53361; http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_14.html
CVE: CVE-2010-3415
Published: 2010-09-16
Description: Google Chrome before 6.0.472.59 does not properly implement Geolocation, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=53394; http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_14.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7620
CVE: CVE-2010-3416
Published: 2010-09-16
Description: Google Chrome before 6.0.472.59 on Linux does not properly implement the Khmer locale, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=53930; http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_14.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14307
CVE: CVE-2010-3417
Published: 2010-09-16
Description: Google Chrome before 6.0.472.59 does not prompt the user before granting access to the extension history, which allows attackers to obtain potentially sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=54006; http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_14.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7371
CVE: CVE-2010-3418
Published: 2010-09-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in NetArt Media Car Portal 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) car_id parameter to index.php and (2) y parameter to include/images.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/67937; http://pridels-team.blogspot.com/2010/09/netartmedia-car-portal-v20-xss-vuln.html; http://secunia.com/advisories/41366
CVE: CVE-2010-3419
Published: 2010-09-16
Description: Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt; http://www.exploit-db.com/exploits/14965; https://exchange.xforce.ibmcloud.com/vulnerabilities/61722
CVE: CVE-2010-3420
Published: 2010-09-16
Description: Cross-site scripting (XSS) vulnerability in Products_Results.php in PowerStore 3.0 allows remote attackers to inject arbitrary web script or HTML via the totalRows_WADAProducts parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/67939; http://pridels-team.blogspot.com/2010/09/powerstore-3-xss-vuln.html; http://secunia.com/advisories/41369
CVE: CVE-2010-3421
Published: 2010-09-16
Description: Cross-site scripting (XSS) vulnerability in AffiliateLogin.asp in ProductCart 3, 4.1 SP1, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the redirectUrl parameter, a different vector than CVE-2004-2174 and CVE-2005-0995. NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/67938; http://secunia.com/advisories/41394; http://www.securityfocus.com/bid/43144
CVE: CVE-2010-3422
Published: 2010-09-16
Description: SQL injection vulnerability in the JGen (com_jgen) component 0.9.33 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14998; http://www.securityfocus.com/bid/43210; http://www.exploit-db.com/exploits/14998
CVE: CVE-2010-3423
Published: 2010-09-16
Description: SQL injection vulnerability in the Yr Weatherdata module for Drupal 6.x before 6.x-1.6 allows remote attackers to execute arbitrary SQL commands via the sorting method.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/606290; http://drupal.org/node/905686; http://secunia.com/advisories/41385
CVE: CVE-2010-3424
Published: 2010-09-16
Description: Cross-site scripting (XSS) vulnerability in admin/sources/classes/bbcode/custom/defaults.php in Invision Power Board (IP.Board) 3.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://community.invisionpower.com/topic/320838-ipboard-31x-security-patch-released/; http://secunia.com/advisories/41314; http://www.securityfocus.com/bid/43053
CVE: CVE-2010-3425
Published: 2010-09-16
Description: Cross-site scripting (XSS) vulnerability in UserControls/Popups/frmHelp.aspx in SmarterStats 5.3, 5.3.3819, and possibly other 5.3 versions, allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cloudscan.blogspot.com/2010/09/vendorsmarterstats-bug-cross-site.html; http://secunia.com/advisories/41389; http://www.osvdb.org/67895
CVE: CVE-2010-3426
Published: 2010-09-16
Description: Directory traversal vulnerability in jphone.php in the JPhone (com_jphone) component 1.0 Alpha 3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1009-exploits/joomlajphone-lfi.txt; http://www.exploit-db.com/exploits/14964; http://www.securityfocus.com/bid/43147
CVE: CVE-2010-3427
Published: 2010-09-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open Classifieds 1.7.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) desc, (2) price, (3) title, and (4) place parameters to index.php and the (5) subject parameter to contact.htm, related to content/contact.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/67971; http://osvdb.org/67972; http://pridels-team.blogspot.com/2010/09/open-classifieds-version-1702-xss-vuln.html
CVE: CVE-2010-3428
Published: 2010-09-16
Description: SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9 allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a category action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14988; http://www.securityfocus.com/bid/43174; http://www.securityfocus.com/bid/43174/exploit
CVE: CVE-2010-3011
Published: 2010-09-17
Description: CRLF injection vulnerability in HP System Management Homepage (SMH) before 6.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/41480; http://secunia.com/advisories/41490; http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995