deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-3374
Published: 2010-10-04
Description: Qt Creator before 2.0.1 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://qt.nokia.com/about/news/security-announcement-qt-creator-2.0.0-for-desktop-platforms; http://www.mandriva.com/security/advisories?name=MDVSA-2010:193; http://www.qt.gitorious.org/qt-creator/qt-creator/commit/3c00715c8e90c57953ec4a8716110f6954e524e4
CVE: CVE-2010-3437
Published: 2010-10-04
Description: Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and system crash) via a crafted index value in a PKT_CTRL_CMD_STATUS ioctl call.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-476
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=252a52aa4fa22a668f019e55b3aac3ff71ec1c29; http://jon.oberheide.org/files/cve-2010-3437.c; http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html
CVE: CVE-2010-3442
Published: 2010-10-04
Description: Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel before 2.6.36-rc5-next-20100929 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-190
References: http://git.kernel.org/?p=linux/kernel/git/tiwai/sound-2.6.git%3Ba=commit%3Bh=5591bf[PII_REDACTED]0450edd9e6ad258bb877b779; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html; http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html
CVE: CVE-2010-2535
Published: 2010-10-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Back End in Joomla! 1.5.x before 1.5.20 allow remote authenticated users to inject arbitrary web script or HTML via administrator screens.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://developer.joomla.org/security/news/[PII_REDACTED]4-core-xss-vulnerabilitis-in-back-end.html; http://www.ocert.org/advisories/ocert-2010-002.html; http://www.openwall.com/lists/oss-security/2010/07/20/2
CVE: CVE-2010-2653
Published: 2010-10-05
Description: Race condition in the hvc_close function in drivers/char/hvc_console.c in the Linux kernel before 2.6.34 allows local users to cause a denial of service or possibly have unspecified other impact by closing a Hypervisor Virtual Console device, related to the hvc_open and hvc_remove functions.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=320718ee074acce5ffced6506cb51af1388942aa; http://lkml.org/lkml/2010/3/3/207; http://patchwork.kernel.org/patch/83353/
CVE: CVE-2010-3307
Published: 2010-10-05
Description: Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) body, (2) footer, (3) header, (4) menu_left, or (5) menu_right parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/41001; http://www.ocert.org/advisories/ocert-2010-003.html; http://www.openwall.com/lists/oss-security/2010/09/17/11
CVE: CVE-2010-3729
Published: 2010-10-05
Description: The SPDY protocol implementation in Google Chrome before 6.0.472.62 does not properly manage buffers, which might allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://code.google.com/p/chromium/issues/detail?id=55119; http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_17.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7380
CVE: CVE-2010-3730
Published: 2010-10-05
Description: Google Chrome before 6.0.472.62 does not properly use information about the origin of a document to manage properties, which allows remote attackers to have an unspecified impact via a crafted web site, related to a "property pollution" issue.
CVSS Score: 8.8 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=55350; http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_17.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7313
CVE: CVE-2010-3731
Published: 2010-10-05
Description: Stack-based buffer overflow in the validateUser implementation in the com.ibm.db2.das.core.DasSysCmd function in db2dasrrm in the DB2 Administration Server (DAS) component in IBM DB2 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP3 allows remote attackers to execute arbitrary code via a long username string.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://secunia.com/advisories/41686; http://www-01.ibm.com/support/docview.wss?uid=swg1IC69986
CVE: CVE-2010-3732
Published: 2010-10-05
Description: The DRDA Services component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service (database server ABEND) by using the client CLI on Linux, UNIX, or Windows for executing a prepared statement with a large number of parameter markers.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ56428; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14219
CVE: CVE-2010-3733
Published: 2010-10-05
Description: The Engine Utilities component in IBM DB2 UDB 9.5 before FP6a uses world-writable permissions for the sqllib/cfg/db2sprf file, which might allow local users to gain privileges by modifying this file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ68463; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14707
CVE: CVE-2010-3734
Published: 2010-10-05
Description: The Install component in IBM DB2 UDB 9.5 before FP6a on Linux, UNIX, and Windows enforces an unintended limit on password length, which makes it easier for attackers to obtain access via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://www-01.ibm.com/support/docview.wss?uid=swg1IC62856; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14764
CVE: CVE-2010-3735
Published: 2010-10-05
Description: The "Query Compiler, Rewrite, Optimizer" component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted query involving certain UNION ALL views, leading to an indefinitely large amount of compilation time.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ58417; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14736
CVE: CVE-2010-3736
Published: 2010-10-05
Description: Memory leak in the Relational Data Services component in IBM DB2 UDB 9.5 before FP6a, when the connection concentrator is enabled, allows remote authenticated users to cause a denial of service (heap memory consumption) by using a different code page than the database server.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://www-01.ibm.com/support/docview.wss?uid=swg1IC68182; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13859
CVE: CVE-2010-3737
Published: 2010-10-05
Description: Memory leak in the Relational Data Services component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service (heap memory consumption) by executing a (1) user-defined function (UDF) or (2) stored procedure while using a different code page than the database server.
CVSS Score: 3.5 (LOW)
CWE: CWE-399
References: ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://www-01.ibm.com/support/docview.wss?uid=swg1LI75022; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14567
CVE: CVE-2010-3738
Published: 2010-10-05
Description: The Security component in IBM DB2 UDB 9.5 before FP6a logs AUDIT events by using a USERID and an AUTHID value corresponding to the instance owner, instead of a USERID and an AUTHID value corresponding to the logged-in user account, which makes it easier for remote authenticated users to execute Audit administration commands without discovery.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://www-01.ibm.com/support/docview.wss?uid=swg1IC65184; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14488
CVE: CVE-2010-3739
Published: 2010-10-05
Description: The audit facility in the Security component in IBM DB2 UDB 9.5 before FP6a uses instance-level audit settings to capture connection (aka CONNECT and AUTHENTICATION) events in certain circumstances in which database-level audit settings were intended, which might make it easier for remote attackers to connect without discovery.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://www-01.ibm.com/support/docview.wss?uid=swg1JR34218; ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT
CVE: CVE-2010-3740
Published: 2010-10-05
Description: The Net Search Extender (NSE) implementation in the Text Search component in IBM DB2 UDB 9.5 before FP6a does not properly handle an alphanumeric Fuzzy search, which allows remote authenticated users to cause a denial of service (memory consumption and system hang) via the db2ext.textSearch function.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://www-01.ibm.com/support/docview.wss?uid=swg1IC66613; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13811
CVE: CVE-2010-3741
Published: 2010-10-05
Description: The offline backup mechanism in Research In Motion (RIM) BlackBerry Desktop Software uses single-iteration PBKDF2, which makes it easier for local users to decrypt a .ipd file via a brute-force attack.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-310
References: http://blog.crackpassword.com/2010/09/smartphone-forensics-cracking-blackberry-backup-passwords/; http://it.slashdot.org/story/10/10/01/166226/; http://twitter.com/elcomsoft/statuses/[PII_REDACTED]6
CVE: CVE-2010-3742
Published: 2010-10-05
Description: Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) meta or (2) phpincdir parameter, a different issue than CVE-2010-3307.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/1008-exploits/freesimplesoftware-rfi.txt; http://secunia.com/advisories/41001; http://www.exploit-db.com/exploits/14672/
CVE: CVE-2010-0218
Published: 2010-10-05
Description: ISC BIND 9.7.2 through 9.7.2-P1 uses an incorrect ACL to restrict the ability of Recursion Desired (RD) queries to access the cache, which allows remote attackers to obtain potentially sensitive information via a DNS query.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://ftp.isc.org/isc/bind9/9.7.2-P2/RELEASE-NOTES-BIND-9.7.2-P2.html; http://www.kb.cert.org/vuls/id/784855; https://lists.isc.org/pipermail/bind-announce/2010-September/000655.html
CVE: CVE-2010-3302
Published: 2010-10-05
Description: Buffer overflow in programs/pluto/xauth.c in the client in Openswan 2.6.25 through 2.6.28 might allow remote authenticated gateways to execute arbitrary code or cause a denial of service via long (1) cisco_dns_info or (2) cisco_domain_info data in a packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-October/048999.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049053.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049073.html
CVE: CVE-2010-3303
Published: 2010-10-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) a plugin name, related to manage_plugin_uninstall.php; (2) an enumeration value or (3) a String value of a custom field, related to core/cfdefs/cfdef_standard.php; or a (4) project or (5) category name to print_all_bug_page_word.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048548.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048639.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048659.html
CVE: CVE-2010-3308
Published: 2010-10-05
Description: Buffer overflow in programs/pluto/xauth.c in the client in Openswan 2.6.26 through 2.6.28 might allow remote authenticated gateways to execute arbitrary code or cause a denial of service via a long cisco_banner (aka server_banner) field.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-October/048999.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049053.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049073.html
CVE: CVE-2010-3752
Published: 2010-10-05
Description: programs/pluto/xauth.c in the client in Openswan 2.6.25 through 2.6.28 allows remote authenticated gateways to execute arbitrary commands via shell metacharacters in (1) cisco_dns_info or (2) cisco_domain_info data in a packet, a different vulnerability than CVE-2010-3302.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: http://www.openswan.org/download/CVE-2010-3302/CVE-2010-3302.txt; http://www.openswan.org/download/CVE-2010-3302/openswan-2.6.25-CVE-2010-3302.patch; http://www.openswan.org/download/CVE-2010-3308/openswan-2.6.26-2.6.28-CVE-2010-330x.patch
CVE: CVE-2010-3753
Published: 2010-10-05
Description: programs/pluto/xauth.c in the client in Openswan 2.6.26 through 2.6.28 allows remote authenticated gateways to execute arbitrary commands via shell metacharacters in the cisco_banner (aka server_banner) field, a different vulnerability than CVE-2010-3308.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: http://www.openswan.org/download/CVE-2010-3308/CVE-2010-3308.txt; http://www.openswan.org/download/CVE-2010-3308/openswan-2.6.26-2.6.28-CVE-2010-330x.patch; http://www.redhat.com/support/errata/RHSA-2010-0892.html
CVE: CVE-2010-3754
Published: 2010-10-05
Description: The FXCLI_OraBR_Exec_Command function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 uses values of packet fields to determine the content and length of data copied to memory, which allows remote attackers to execute arbitrary code via a crafted packet.  NOTE: this might overlap CVE-2010-3059.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC69883; http://www.ibm.com/support/docview.wss?uid=swg21443820; http://www.securityfocus.com/archive/1/514058/100/0/threaded
CVE: CVE-2010-3755
Published: 2010-10-05
Description: The _DAS_ReadBlockReply function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via data in a TCP packet.  NOTE: this might overlap CVE-2010-3060.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC69883; http://www.ibm.com/support/docview.wss?uid=swg21443820; http://www.securityfocus.com/archive/1/514063/100/0/threaded
CVE: CVE-2010-3756
Published: 2010-10-05
Description: The _CalcHashValueWithLength function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 does not properly validate an unspecified length value, which allows remote attackers to cause a denial of service (daemon crash) by sending data over TCP.  NOTE: this might overlap CVE-2010-3060.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC69883; http://www.ibm.com/support/docview.wss?uid=swg21443820; http://www.securityfocus.com/archive/1/514070/100/0/threaded
CVE: CVE-2010-3757
Published: 2010-10-05
Description: Format string vulnerability in the _Eventlog function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 allows remote attackers to execute arbitrary code via format string specifiers located after a | (pipe) character in a string.  NOTE: this might overlap CVE-2010-3059.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC69883; http://www.ibm.com/support/docview.wss?uid=swg21443820; http://www.securityfocus.com/archive/1/514069/100/0/threaded
CVE: CVE-2010-3758
Published: 2010-10-05
Description: Multiple stack-based buffer overflows in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 allow remote attackers to execute arbitrary code via vectors involving the (1) AGI_SendToLog (aka _SendToLog) function; the (2) group, (3) workgroup, or (4) domain name field to the USER_S_AddADGroup function; the (5) user_path variable to the FXCLI_checkIndexDBLocation function; or (6) the _AGI_S_ActivateLTScriptReply (aka ActivateLTScriptReply) function. NOTE: this might overlap CVE-2010-3059.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC69883; http://www.ibm.com/support/docview.wss?uid=swg21443820; http://www.securityfocus.com/archive/1/514059/100/0/threaded
CVE: CVE-2010-3759
Published: 2010-10-05
Description: FastBackMount.exe in the Mount service in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 writes a certain value to a memory location specified by a UDP packet field, which allows remote attackers to execute arbitrary code via multiple requests.  NOTE: this might overlap CVE-2010-3058.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC69883; http://www.ibm.com/support/docview.wss?uid=swg21443820; http://www.securityfocus.com/archive/1/514068/100/0/threaded
CVE: CVE-2010-3760
Published: 2010-10-05
Description: FastBackMount.exe in the Mount service in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 does not properly handle a certain failure to allocate memory, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash, and recovery failure) by specifying a large size value within TCP packet data.  NOTE: this might overlap CVE-2010-3061.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC69883; http://www.ibm.com/support/docview.wss?uid=swg21443820; http://zerodayinitiative.com/advisories/ZDI-10-188/
CVE: CVE-2010-3761
Published: 2010-10-05
Description: Unspecified vulnerability in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-700.  NOTE: this might overlap CVE-2010-3058 or CVE-2010-3059.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC69883; http://www.ibm.com/support/docview.wss?uid=swg21443820; http://zerodayinitiative.com/advisories/upcoming/
CVE: CVE-2010-3762
Published: 2010-10-05
Description: ISC BIND before 9.7.2-P2, when DNSSEC validation is enabled, does not properly handle certain bad signatures if multiple trust anchors exist for a single zone, which allows remote attackers to cause a denial of service (daemon crash) via a DNS query.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://ftp.isc.org/isc/bind9/9.7.2-P2/RELEASE-NOTES-BIND-9.7.2-P2.html; http://lists.vmware.com/pipermail/security-announce/2011/000126.html; http://support.avaya.com/css/P8/documents/100124923
CVE: CVE-2010-3763
Published: 2010-10-05
Description: Cross-site scripting (XSS) vulnerability in core/summary_api.php in MantisBT before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the Summary field, a different vector than CVE-2010-3303.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052721.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052730.html; http://secunia.com/advisories/42772
CVE: CVE-2010-2367
Published: 2010-10-06
Description: Cross-site scripting (XSS) vulnerability in search.cgi in AD-EDIT2 before 3.0.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://adedit.blogspot.com/2010/10/ad-edit2-xss.html; http://jvn.jp/en/jp/JVN69191943/index.html; http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000036.html
CVE: CVE-2010-2887
Published: 2010-10-06
Description: Multiple unspecified vulnerabilities in Adobe Reader and Acrobat 9.x before 9.4 on Linux allow attackers to gain privileges via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-2888
Published: 2010-10-06
Description: Multiple unspecified vulnerabilities in an ActiveX control in Adobe Reader and Acrobat 8.x before 8.2.5 and 9.x before 9.4 on Windows allow attackers to execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.adobe.com/support/security/bulletins/apsb10-21.html; http://www.us-cert.gov/cas/techalerts/TA10-279A.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7348
CVE: CVE-2010-2889
Published: 2010-10-06
Description: Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows attackers to execute arbitrary code via a crafted font, a different vulnerability than CVE-2010-3626.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-2890
Published: 2010-10-06
Description: Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-3619, CVE-2010-3621, CVE-2010-3622, CVE-2010-3628, CVE-2010-3632, and CVE-2010-3658.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025