deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-4712
Published: 2011-01-31
Description: Multiple stack-based buffer overflows in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a Content-Type header containing (1) multiple items separated by ; (semicolon) characters or (2) crafted string data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.facebook.com/note.php?note_id=[PII_REDACTED]28; http://www.novell.com/support/viewContent.do?externalId=7007152&sliceId=1; http://www.novell.com/support/viewContent.do?externalId=7007153&sliceId=1
CVE: CVE-2010-4713
Published: 2011-01-31
Description: Integer signedness error in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allows remote attackers to execute arbitrary code via a signed integer value in the Content-Type header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://www.facebook.com/note.php?note_id=[PII_REDACTED]28; http://www.novell.com/support/viewContent.do?externalId=7007154&sliceId=1; http://zerodayinitiative.com/advisories/ZDI-10-241/
CVE: CVE-2010-4714
Published: 2011-01-31
Description: Multiple stack-based buffer overflows in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a long HTTP Host header to (1) gwpoa.exe in the Post Office Agent, (2) gwmta.exe in the Message Transfer Agent, (3) gwia.exe in the Internet Agent, (4) the WebAccess Agent, or (5) the Monitor Agent.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.facebook.com/note.php?note_id=[PII_REDACTED]28; http://www.novell.com/support/viewContent.do?externalId=7007159&sliceId=1; http://zerodayinitiative.com/advisories/ZDI-10-247/
CVE: CVE-2010-4715
Published: 2011-01-31
Description: Multiple directory traversal vulnerabilities in the (1) WebAccess Agent and (2) Document Viewer Agent components in Novell GroupWise before 8.02HP allow remote attackers to read arbitrary files via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/40820; http://www.facebook.com/note.php?note_id=[PII_REDACTED]28; http://www.novell.com/support/viewContent.do?externalId=7007156&sliceId=1
CVE: CVE-2010-4716
Published: 2011-01-31
Description: Cross-site scripting (XSS) vulnerability in the WebPublisher component in Novell GroupWise before 8.02HP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.facebook.com/note.php?note_id=[PII_REDACTED]28; http://www.novell.com/support/viewContent.do?externalId=7007158&sliceId=1; https://bugzilla.novell.com/show_bug.cgi?id=651159
CVE: CVE-2010-4717
Published: 2011-01-31
Description: Multiple stack-based buffer overflows in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a long (1) LIST or (2) LSUB command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.facebook.com/note.php?note_id=[PII_REDACTED]28; http://www.novell.com/support/viewContent.do?externalId=7007157&sliceId=1; http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=19&Itemid=19
CVE: CVE-2011-0096
Published: 2011-01-31
Description: The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://blogs.technet.com/b/msrc/archive/2011/01/28/microsoft-releases-security-advisory-2501696.aspx; http://blogs.technet.com/b/srd/archive/2011/01/28/more-information-about-the-mhtml-script-injection-vulnerability.aspx; http://osvdb.org/70693
CVE: CVE-2011-0450
Published: 2011-01-31
Description: The downloads manager in Opera before 11.01 on Windows does not properly determine the pathname of the filesystem-viewing application, which allows user-assisted remote attackers to execute arbitrary code via a crafted web site that hosts an executable file.
CVSS Score: 7.6 (HIGH)
References: http://jvn.jp/en/jp/JVN33880169/index.html; http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000010.html; http://osvdb.org/70726
CVE: CVE-2011-0680
Published: 2011-01-31
Description: data/WorkingMessage.java in the Mms application in Android before 2.2.2 and 2.3.x before 2.3.2 does not properly manage the draft cache, which allows remote attackers to read SMS messages intended for other recipients in opportunistic circumstances via a standard text messaging service.
CVSS Score: 5.0 (MEDIUM)
References: http://android.git.kernel.org/?p=platform/packages/apps/Mms.git%3Ba=commit%3Bh=18d6b7e9d2e538fb3c0264332b96c02abf367267; http://android.git.kernel.org/?p=platform/packages/apps/Mms.git%3Ba=commit%3Bh=4d26623ce82230e8e7009adb921c5edea370a9e0; http://code.google.com/p/android/issues/detail?id=9392#c1460
CVE: CVE-2010-0110
Published: 2011-01-31
Description: Multiple stack-based buffer overflows in Intel Alert Management System (aka AMS or AMS2), as used in Symantec AntiVirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allow remote attackers to execute arbitrary code via (1) a long string to msgsys.exe, related to the AMSSendAlertAct function in AMSLIB.dll in the Intel Alert Handler service (aka Symantec Intel Handler service); a long (2) modem string or (3) PIN number to msgsys.exe, related to pagehndl.dll in the Intel Alert Handler service; or (4) a message to msgsys.exe, related to iao.exe in the Intel Alert Originator service.
CVSS Score: 7.9 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/43099; http://secunia.com/advisories/43106; http://securitytracker.com/id?1024996
CVE: CVE-2010-0111
Published: 2011-01-31
Description: HDNLRSVC.EXE in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System (aka AMS or AMS2), as used in Symantec AntiVirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allows remote attackers to execute arbitrary programs by sending msgsys.exe a UNC share pathname, which is used directly in a CreateProcessA (aka CreateProcess) call.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/43099; http://secunia.com/advisories/43106; http://securitytracker.com/id?1024997
CVE: CVE-2010-4393
Published: 2011-01-31
Description: Heap-based buffer overflow in vidplin.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.x before 14.0.2, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via a crafted header in an AVI file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/70682; http://secunia.com/advisories/43098; http://securitytracker.com/id?1024998
CVE: CVE-2011-0413
Published: 2011-01-31
Description: The DHCPv6 server in ISC DHCP 4.0.x and 4.1.x before 4.1.2-P1, 4.0-ESV and 4.1-ESV before 4.1-ESV-R1, and 4.2.x before 4.2.1b1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) by sending a message over IPv6 for a declined and abandoned address.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053644.html; http://secunia.com/advisories/43006; http://secunia.com/advisories/43104
CVE: CVE-2011-0681
Published: 2011-01-31
Description: The Cascading Style Sheets (CSS) Extensions for XML implementation in Opera before 11.01 recognizes links to javascript: URLs in the -o-link property, which makes it easier for remote attackers to bypass CSS filtering via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/70727; http://secunia.com/advisories/43023; http://www.opera.com/docs/changelogs/mac/1101/
CVE: CVE-2011-0682
Published: 2011-01-31
Description: Integer truncation error in opera.dll in Opera before 11.01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTML form with a select element that contains a large number of children.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/70728; http://secunia.com/advisories/43023; http://www.opera.com/docs/changelogs/mac/1101/
CVE: CVE-2011-0683
Published: 2011-01-31
Description: Opera before 11.01 does not properly restrict the use of opera: URLs, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/70729; http://secunia.com/advisories/43023; http://www.opera.com/docs/changelogs/mac/1101/
CVE: CVE-2011-0684
Published: 2011-01-31
Description: Opera before 11.01 does not properly handle redirections and unspecified other HTTP responses, which allows remote web servers to obtain sufficient access to local files to use these files as page resources, and consequently obtain potentially sensitive information from the contents of the files, via an unknown response manipulation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/70730; http://secunia.com/advisories/43023; http://www.opera.com/docs/changelogs/mac/1101/
CVE: CVE-2011-0685
Published: 2011-01-31
Description: The Delete Private Data feature in Opera before 11.01 does not properly implement the "Clear all email account passwords" option, which might allow physically proximate attackers to access an e-mail account via an unattended workstation.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://osvdb.org/70731; http://secunia.com/advisories/43023; http://www.opera.com/docs/changelogs/mac/1101/
CVE: CVE-2011-0686
Published: 2011-01-31
Description: Unspecified vulnerability in Opera before 11.01 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by vkontakte.ru.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/70732; http://secunia.com/advisories/43023; http://www.opera.com/docs/changelogs/mac/1101/
CVE: CVE-2011-0687
Published: 2011-01-31
Description: Opera before 11.01 does not properly implement Wireless Application Protocol (WAP) dropdown lists, which allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted WAP document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/70733; http://secunia.com/advisories/43023; http://www.opera.com/docs/changelogs/mac/1101/
CVE: CVE-2011-0688
Published: 2011-01-31
Description: Intel Alert Management System (aka AMS or AMS2), as used in Symantec Antivirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allows remote attackers to execute arbitrary commands via crafted messages over TCP, as discovered by Junaid Bohio, a different vulnerability than CVE-2010-0110 and CVE-2010-0111.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/43099; http://securitytracker.com/id?1024996; http://www.securityfocus.com/bid/45936
CVE: CVE-2011-0321
Published: 2011-02-01
Description: librpc.dll in nsrexecd in EMC NetWorker before 7.5 SP4, 7.5.3.x before 7.5.3.5, and 7.6.x before 7.6.1.2 does not properly mitigate the possibility of a spoofed localhost source IP address, which allows remote attackers to (1) register or (2) unregister RPC services, and consequently cause a denial of service or obtain sensitive information from interprocess communication, via crafted UDP packets containing service commands.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2011-01/0162.html; http://archives.neohapsis.com/archives/bugtraq/2011-01/att-0162/ESA-2011-003.txt; http://secunia.com/advisories/43113
CVE: CVE-2011-0731
Published: 2011-02-01
Description: Buffer overflow in the DB2 Administration Server (DAS) component in IBM DB2 9.1 before FP10, 9.5 before FP7, and 9.7 before FP3 on Linux, UNIX, and Windows allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/43059; http://www-01.ibm.com/support/docview.wss?uid=swg1IC71203; http://www-01.ibm.com/support/docview.wss?uid=swg1IC72028
CVE: CVE-2011-0732
Published: 2011-02-01
Description: Multiple unspecified vulnerabilities in IBM Tivoli Integrated Portal (TIP) 1.1.1.1, as used in IBM Tivoli Common Reporting (TCR) 1.2.0 before Interim Fix 9, have unknown impact and attack vectors, related to "security vulnerabilities of Websphere Application Server bundled within" and "many internal defects and APARs."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/43030; http://www.ibm.com/support/docview.wss?uid=swg1IY99978; http://secunia.com/advisories/43030
CVE: CVE-2011-0733
Published: 2011-02-01
Description: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header in an id=- query to a .cfm file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html; http://kb2.adobe.com/cps/890/cpsid_89094.html; http://osvdb.org/70777
CVE: CVE-2011-0734
Published: 2011-02-01
Description: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element, related to a "tag body" attack.  NOTE: this was originally reported as affecting 9.0.1 CHF1 and earlier.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html; http://kb2.adobe.com/cps/890/cpsid_89094.html; http://osvdb.org/70778
CVE: CVE-2011-0735
Published: 2011-02-01
Description: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html; http://kb2.adobe.com/cps/890/cpsid_89094.html; http://osvdb.org/70779
CVE: CVE-2011-0736
Published: 2011-02-01
Description: Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file.  NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html; http://osvdb.org/70780; http://websecurity.com.ua/4879/
CVE: CVE-2011-0737
Published: 2011-02-01
Description: Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message.  NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html; http://osvdb.org/70781; http://websecurity.com.ua/4879/
CVE: CVE-2009-0189
Published: 2011-02-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-1012.  Reason: This candidate is a reservation duplicate of CVE-2009-1012.  Notes: All CVE users should reference CVE-2009-1012 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-0190
Published: 2011-02-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-1016.  Reason: This candidate is a reservation duplicate of CVE-2009-1016.  Notes: All CVE users should reference CVE-2009-1016 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-4718
Published: 2011-02-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Lyftenbloggie (com_lyftenbloggie) component 1.1.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) tag and (2) category parameters to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/96761/joomlalyftenbloggie-xss.txt; http://secunia.com/advisories/42677; http://www.securityfocus.com/bid/45468
CVE: CVE-2010-4719
Published: 2011-02-01
Description: Directory traversal vulnerability in JRadio (com_jradio) component before 1.5.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/files/view/96751/joomlajradio-lfi.txt; http://secunia.com/advisories/42600; http://www.exploit-db.com/exploits/15749
CVE: CVE-2010-4720
Published: 2011-02-01
Description: SQL injection vulnerability in the JExtensions JE Auto (com_jeauto) component before 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the view item page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/69791; http://secunia.com/advisories/42616; http://www.joomlaextensions.co.in/extensions/components/je-auto.html
CVE: CVE-2010-4721
Published: 2011-02-01
Description: SQL injection vulnerability in news.php in Immo Makler allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/42676; http://www.exploit-db.com/exploits/15754; http://www.osvdb.org/69950
CVE: CVE-2010-3719
Published: 2011-02-02
Description: Eval injection vulnerability in IMAdminSchedTask.asp in the administrative interface for Symantec IM Manager 8.4.16 and earlier allows remote attackers to execute arbitrary code via unspecified parameters to the ScheduleTask method.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/70755; http://secunia.com/advisories/43143; http://www.securityfocus.com/archive/1/516103/100/0/threaded
CVE: CVE-2010-3854
Published: 2011-02-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://mail-archives.apache.org/mod_mbox/couchdb-dev/201101.mbox/%3CC840F655-C8C5-4EC6-8AA8-DD223E39C34A%40apache.org%3E; http://osvdb.org/70734; http://secunia.com/advisories/43111
CVE: CVE-2010-3929
Published: 2011-02-02
Description: SQL injection vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to AjaxSearch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN54092716/index.html; http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000008.html; http://modxcms.com/forums/index.php/topic%2C60045.0.html
CVE: CVE-2010-3930
Published: 2011-02-02
Description: Directory traversal vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to read arbitrary files via unspecified vectors related to AjaxSearch, a different vulnerability than CVE-2010-1427.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN95385972/index.html; http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000009.html; http://modxcms.com/forums/index.php/topic%2C60045.0.html
CVE: CVE-2010-4015
Published: 2011-02-02
Description: Buffer overflow in the gettoken function in contrib/intarray/_int_bool.c in the intarray array module in PostgreSQL 9.0.x before 9.0.3, 8.4.x before 8.4.7, 8.3.x before 8.3.14, and 8.2.x before 8.2.20 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via integers with a large number of digits to unspecified functions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-189
References: http://git.postgresql.org/gitweb?p=postgresql.git%3Ba=commitdiff%3Bh=7ccb6dc2d3e266a551827bb[PII_REDACTED]0f72431; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053817.html
CVE: CVE-2010-4652
Published: 2011-02-02
Description: Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in ProFTPD before 1.3.3d, when mod_sql is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted username containing substitution tags, which are not properly handled during construction of an SQL query.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.proftpd.org/show_bug.cgi?id=3536; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053537.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053540.html
CVE: CVE-2011-0017
Published: 2011-02-02
Description: The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20, CWE-59
References: ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74; http://lists.exim.org/lurker/message/20[PII_REDACTED]02.4d69c278.en.html; http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html
CVE: CVE-2011-0276
Published: 2011-02-02
Description: HP OpenView Performance Insight Server 5.2, 5.3, 5.31, 5.4, and 5.41 contains a "hidden account" in the com.trinagy.security.XMLUserManager Java class, which allows remote attackers to execute arbitrary code via the doPost method in the com.trinagy.servlet.HelpManagerServlet class.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02695453; http://osvdb.org/70754; http://secunia.com/advisories/43145
CVE: CVE-2011-0738
Published: 2011-02-02
Description: MyProxy 5.0 through 5.2, as used in Globus Toolkit 5.0.0 through 5.0.2, does not properly verify the (1) hostname or (2) identity in the X.509 certificate for the myproxy-server, which allows remote attackers to spoof the server and conduct man-in-the-middle (MITM) attacks via a crafted certificate when executing (a) myproxy-logon or (b) myproxy-get-delegation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://grid.ncsa.illinois.edu/myproxy/security/myproxy-adv-2011-01.txt; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053461.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053473.html
CVE: CVE-2011-0739
Published: 2011-02-02
Description: The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1; http://osvdb.org/70667; http://secunia.com/advisories/43077