deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-3949
Published: 2010-12-16
Description: Buffer overflow in the TIFF image converter in the graphics filters in Microsoft Office XP SP3 and Office Converter Pack allows remote attackers to execute arbitrary code via a crafted TIFF image in an Office document, aka "TIFF Image Converter Buffer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id?1024887; http://www.us-cert.gov/cas/techalerts/TA10-348A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-105
CVE: CVE-2010-3950
Published: 2010-12-16
Description: The TIFF image converter in the graphics filters in Microsoft Office XP SP3, Office Converter Pack, and Works 9 does not properly convert data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF image in an Office document, aka "TIFF Image Converter Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id?1024887; http://www.us-cert.gov/cas/techalerts/TA10-348A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-105
CVE: CVE-2010-3951
Published: 2010-12-16
Description: Buffer overflow in the FlashPix image converter in the graphics filters in Microsoft Office XP SP3 and Office Converter Pack allows remote attackers to execute arbitrary code via a crafted FlashPix image in an Office document, aka "FlashPix Image Converter Buffer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id?1024887; http://www.us-cert.gov/cas/techalerts/TA10-348A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-105
CVE: CVE-2010-3952
Published: 2010-12-16
Description: The FlashPix image converter in the graphics filters in Microsoft Office XP SP3 and Office Converter Pack allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted FlashPix image in an Office document, aka "FlashPix Image Converter Heap Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id?1024887; http://www.us-cert.gov/cas/techalerts/TA10-348A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-105
CVE: CVE-2010-3954
Published: 2010-12-16
Description: Microsoft Publisher 2002 SP3, 2003 SP3, and 2010 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Publisher file, aka "Microsoft Publisher Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id?1024885; http://www.us-cert.gov/cas/techalerts/TA10-348A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-103
CVE: CVE-2010-3955
Published: 2010-12-16
Description: pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3 does not properly perform array indexing, which allows remote attackers to execute arbitrary code via a crafted Publisher file that uses an old file format, aka "Array Indexing Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securitytracker.com/id?1024885; http://www.us-cert.gov/cas/techalerts/TA10-348A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-103
CVE: CVE-2010-3956
Published: 2010-12-16
Description: The OpenType Font (OTF) driver in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly perform array indexing, which allows local users to gain privileges via a crafted OpenType font, aka "OpenType Font Index Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securitytracker.com/id?1024873; http://www.us-cert.gov/cas/techalerts/TA10-348A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-091
CVE: CVE-2010-3957
Published: 2010-12-16
Description: Double free vulnerability in the OpenType Font (OTF) driver in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges via a crafted OpenType font, aka "OpenType Font Double Free Vulnerability."
CVSS Score: 7.3 (HIGH)
CWE: CWE-399, CWE-415
References: http://www.securitytracker.com/id?1024873; http://www.us-cert.gov/cas/techalerts/TA10-348A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-091
CVE: CVE-2010-3959
Published: 2010-12-16
Description: The OpenType Font (OTF) driver in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges via a crafted CMAP table in an OpenType font, aka "OpenType CMAP Table Vulnerability."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-94
References: http://www.securitytracker.com/id?1024873; http://www.us-cert.gov/cas/techalerts/TA10-348A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-091
CVE: CVE-2010-3960
Published: 2010-12-16
Description: Hyper-V in Microsoft Windows Server 2008 Gold, SP2, and R2 allows guest OS users to cause a denial of service (host OS hang) by sending a crafted encapsulated packet over the VMBus, aka "Hyper-V VMBus Vulnerability."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/69818; http://secunia.com/advisories/42617; http://www.securityfocus.com/bid/45293
CVE: CVE-2010-3961
Published: 2010-12-16
Description: The Consent User Interface (UI) in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly handle an unspecified registry-key value, which allows local users with SeImpersonatePrivilege rights to gain privileges via a crafted application, aka "Consent UI Impersonation Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/69824; http://secunia.com/advisories/42614; http://www.securityfocus.com/bid/45318
CVE: CVE-2010-3963
Published: 2010-12-16
Description: Buffer overflow in the Routing and Remote Access NDProxy component in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, related to the Routing and Remote Access service (RRAS) and improper copying from user mode to the kernel, aka "Kernel NDProxy Buffer Overflow Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://osvdb.org/69823; http://secunia.com/advisories/42613; http://www.securityfocus.com/bid/45269
CVE: CVE-2010-3964
Published: 2010-12-16
Description: Unrestricted file upload vulnerability in the Document Conversions Launcher Service in Microsoft Office SharePoint Server 2007 SP2, when the Document Conversions Load Balancer Service is enabled, allows remote attackers to execute arbitrary code via a crafted SOAP request to TCP port 8082, aka "Malformed Request Code Execution Vulnerability."
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/69817; http://secunia.com/advisories/42631; http://www.securityfocus.com/bid/45264
CVE: CVE-2010-3965
Published: 2010-12-16
Description: Untrusted search path vulnerability in Windows Media Encoder 9 on Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, and Windows Server 2008 Gold and SP2 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a Windows Media Profile (PRX) file, aka "Insecure Library Loading Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.securityfocus.com/bid/42855; http://www.securitytracker.com/id?1024876; http://www.us-cert.gov/cas/techalerts/TA10-348A.html
CVE: CVE-2010-3966
Published: 2010-12-16
Description: Untrusted search path vulnerability in Microsoft Windows Server 2008 R2 and Windows 7, when BranchCache is supported, allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains an EML file, an RSS file, or a WPOST file, aka "BranchCache Insecure Library Loading Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/69816; http://secunia.com/advisories/42609; http://www.securityfocus.com/bid/45295
CVE: CVE-2010-3967
Published: 2010-12-16
Description: Untrusted search path vulnerability in Microsoft Windows Movie Maker (WMM) 2.6 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a Movie Maker (MSWMM) file, aka "Insecure Library Loading Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/42607; http://www.securitytracker.com/id?1024875; http://www.us-cert.gov/cas/techalerts/TA10-348A.html
CVE: CVE-2009-5032
Published: 2010-12-16
Description: The encrypted e-mail feature in IBM Lotus Notes Traveler before 8.5.0.2 sends unencrypted messages when the feature is used without uploading a Notes ID file, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg24019529&aid=1; http://www-1.ibm.com/support/docview.wss?uid=swg1LO38116; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
CVE: CVE-2009-5033
Published: 2010-12-16
Description: IBM Lotus Notes Traveler before 8.5.0.2 does not properly handle a "* *" argument sequence for a certain tell command, which allows remote authenticated users to obtain access to other users' data via a sync operation, related to storage of the data of multiple users within the same thread.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg24019529&aid=1; http://www-1.ibm.com/support/docview.wss?uid=swg1LO41040; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
CVE: CVE-2009-5034
Published: 2010-12-16
Description: IBM Lotus Notes Traveler before 8.5.0.2 allows remote authenticated users to cause a denial of service (memory consumption and daemon crash) by syncing a large volume of data, related to the launch of a new process to handle the data while the previous process is still operating on the data.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg24019529&aid=1; http://www-1.ibm.com/support/docview.wss?uid=swg1LO41707; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
CVE: CVE-2009-5035
Published: 2010-12-16
Description: The Nokia client in IBM Lotus Notes Traveler before 8.5.0.2 does not properly handle multiple outgoing e-mail messages between sync operations, which might allow remote attackers to read communications intended for other recipients by examining appended messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-1.ibm.com/support/docview.wss?uid=swg1LO47028; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument; http://www-1.ibm.com/support/docview.wss?uid=swg1LO47028
CVE: CVE-2009-5036
Published: 2010-12-16
Description: traveler.exe in IBM Lotus Notes Traveler before 8.0.1.3 CF1 allows remote authenticated users to cause a denial of service (daemon crash) via a malformed invitation document in a sync operation.
CVSS Score: 4.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg24019529&aid=3; http://www-1.ibm.com/support/docview.wss?uid=swg1LO44111; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
CVE: CVE-2010-4544
Published: 2010-12-16
Description: Cross-site scripting (XSS) vulnerability in the servlet in IBM Lotus Notes Traveler before 8.5.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-1.ibm.com/support/docview.wss?uid=swg1LO52324; http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes; http://www.vupen.com/english/advisories/2010/3193
CVE: CVE-2010-4545
Published: 2010-12-16
Description: IBM Lotus Notes Traveler before 8.5.1.2 allows remote authenticated users to cause a denial of service (resource consumption and sync outage) by syncing a large volume of data.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://www-1.ibm.com/support/docview.wss?uid=swg1LO49125; http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
CVE: CVE-2010-4546
Published: 2010-12-16
Description: IBM Lotus Notes Traveler before 8.5.1.2 does not reject an attachment download request for an e-mail message with a Prevent Copy attribute, which allows remote authenticated users to bypass intended access restrictions via this request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-1.ibm.com/support/docview.wss?uid=swg1LO49840; http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
CVE: CVE-2010-4547
Published: 2010-12-16
Description: IBM Lotus Notes Traveler before 8.5.1.3, when a multidomain environment is used, does not properly apply policy documents to mobile users from a different Domino domain than the Traveler server, which allows remote authenticated users to bypass intended access restrictions by using credentials from a different domain.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www-1.ibm.com/support/docview.wss?uid=swg1LO49967; http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
CVE: CVE-2010-4548
Published: 2010-12-16
Description: IBM Lotus Notes Traveler before 8.5.1.2 allows remote authenticated users to cause a denial of service (daemon crash) by accepting a meeting invitation with an iNotes client and then accepting this meeting invitation with an iPhone client.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://www-1.ibm.com/support/docview.wss?uid=swg1LO48594; http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
CVE: CVE-2010-4549
Published: 2010-12-16
Description: IBM Lotus Notes Traveler before 8.5.1.3 on the Nokia s60 device successfully performs a Replace Data operation for a prohibited application, which allows remote authenticated users to bypass intended access restrictions via this operation.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-1.ibm.com/support/docview.wss?uid=swg1LO53572; http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
CVE: CVE-2010-4550
Published: 2010-12-16
Description: IBM Lotus Notes Traveler before 8.5.1.3 allows remote attackers to cause a denial of service (sync failure) via a malformed document.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www-1.ibm.com/support/docview.wss?uid=swg1LO51818; http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
CVE: CVE-2010-4551
Published: 2010-12-16
Description: IBM Lotus Notes Traveler before 8.5.1.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by omitting the Internet ID field in the person document, and then using an Apple device to (1) accept or (2) decline an invitation.
CVSS Score: 4.0 (MEDIUM)
References: http://www-1.ibm.com/support/docview.wss?uid=swg1LO49829; http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
CVE: CVE-2010-4552
Published: 2010-12-16
Description: Memory leak in IBM Lotus Notes Traveler before 8.5.1.1 allows remote attackers to cause a denial of service (memory consumption and daemon outage) by sending many embedded objects in e-mail messages for iPhone clients.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www-1.ibm.com/support/docview.wss?uid=swg1LO46561; http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
CVE: CVE-2010-4553
Published: 2010-12-16
Description: An unspecified Domino API in IBM Lotus Notes Traveler before 8.5.1.1 does not properly handle MIME types, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www-1.ibm.com/support/docview.wss?uid=swg1LO45478; http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Lotus_Notes_Traveler_851_FP3_Release_Notes; http://www-10.lotus.com/ldd/dominowiki.nsf/page.xsp?documentId=A6604E906E0DF2DF8525778B005D4466&action=openDocument
CVE: CVE-2010-2602
Published: 2010-12-17
Description: Multiple buffer overflows in the PDF distiller component in the BlackBerry Attachment Service in BlackBerry Enterprise Server 5.0.0 through 5.0.2, 4.1.6, and 4.1.7 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/35632; http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB24761; http://www.securityfocus.com/bid/45392
CVE: CVE-2010-2603
Published: 2010-12-17
Description: RIM BlackBerry Desktop Software 4.7 through 6.0 for PC, and 1.0 for Mac, uses a weak password to encrypt a database backup file, which makes it easier for local users to decrypt the file via a brute force attack.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://secunia.com/advisories/42657; http://secunia.com/advisories/42661; http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB24764
CVE: CVE-2010-3616
Published: 2010-12-17
Description: ISC DHCP server 4.2 before 4.2.0-P2, when configured to use failover partnerships, allows remote attackers to cause a denial of service (communications-interrupted state and DHCP client service loss) by connecting to a port that is only intended for a failover peer, as demonstrated by a Nagios check_tcp process check to TCP port 520.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052329.html; http://secunia.com/advisories/42618; http://secunia.com/advisories/42682
CVE: CVE-2010-3906
Published: 2010-12-17
Description: Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052518.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052782.html; http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html
CVE: CVE-2010-4115
Published: 2010-12-17
Description: HP StorageWorks Modular Smart Array P2000 G3 firmware TS100R011, TS100R025, TS100P002, TS200R005, TS201R014, and TS201R015 installs an undocumented admin account with a default "!admin" password, which allows remote attackers to gain privileges.
CVSS Score: 9.0 (HIGH)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2010-12/0104.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4727&w=2; http://secunia.com/advisories/42583
CVE: CVE-2010-4262
Published: 2010-12-17
Description: Stack-based buffer overflow in Xfig 3.2.4 and 3.2.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a FIG image with a crafted color definition.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052247.html; http://secunia.com/advisories/42579; http://www.mandriva.com/security/advisories?name=MDVSA-2011:010
CVE: CVE-2010-4336
Published: 2010-12-17
Description: The cu_rrd_create_file function (src/utils_rrdcreate.c) in collectd 4.x before 4.9.4 and before 4.10.2 allow remote attackers to cause a denial of service (assertion failure) via a packet with a timestamp whose value is 10 or less, as demonstrated by creating RRD files using the (1) RRDtool and (2) RRDCacheD plugins.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605092; http://collectd.org/news.shtml#news86; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052875.html
CVE: CVE-2010-4481
Published: 2010-12-17
Description: phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4d9fd005671b05c4d74615d5939ed45e4d019e4c; http://secunia.com/advisories/42485; http://secunia.com/advisories/42725
CVE: CVE-2010-4495
Published: 2010-12-17
Description: Unspecified vulnerability in the ActiveMatrix Runtime component in TIBCO ActiveMatrix Service Grid 3.0.0, 3.0.1, and 3.1.0; ActiveMatrix Service Bus 3.0.0 and 3.0.1; ActiveMatrix BusinessWorks Service Engine 5.9.0; ActiveMatrix BPM 1.0.1 and 1.0.2; Silver BPM Service 1.0.1; and Silver CAP Service 1.0.0 allows remote authenticated users to execute arbitrary code via vectors related to JMX connections.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/42640; http://www.securityfocus.com/bid/45400; http://www.securitytracker.com/id?1024894
CVE: CVE-2010-4556
Published: 2010-12-17
Description: Stack-based buffer overflow in the SapThemeRepository ActiveX control (sapwdpcd.dll) in SAP NetWeaver Business Client allows remote attackers to execute arbitrary code via the (1) Load and (2) LoadTheme methods.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/35796; http://www.securityfocus.com/bid/45396; http://www.securitytracker.com/id?1024890
CVE: CVE-2010-4557
Published: 2010-12-17
Description: Buffer overflow in the lm_tcp service in Invensys Wonderware InBatch 8.1 and 9.0, as used in Invensys Foxboro I/A Series Batch 8.1 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted request to port 9001.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/inbatch_1-adv.txt; http://iom.invensys.com/EN/Pages/IOM_CyberSecurityUpdates.aspx; http://iom.invensys.com/EN/pdfLibrary/SecurityAlert_Invensys_SecurityAlert-LFSEC00000051_12-10.pdf
CVE: CVE-2010-4558
Published: 2010-12-17
Description: phpMyFAQ 2.6.11 and 2.6.12, as distributed between December 4th and December 15th 2010, contains an externally introduced modification (Trojan Horse) in the getTopTen method in inc/Faq.php, which allows remote attackers to execute arbitrary PHP code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/42622; http://www.phpmyfaq.de/advisory_2010-12-15.php; http://www.securityfocus.com/bid/45442