deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-2145
Published: 2011-06-06
Description: mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x before 3.1.3, VMware ESXi 3.5 through 4.1, and VMware ESX 3.0.3 through 4.1, when a Solaris or FreeBSD guest OS is used, allows guest OS users to modify arbitrary guest OS files via unspecified vectors, related to a "procedural error."
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/44840; http://secunia.com/advisories/44904; http://www.securityfocus.com/bid/48098
CVE: CVE-2011-2146
Published: 2011-06-06
Description: mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x before 3.1.3, VMware ESXi 3.5 through 4.1, and VMware ESX 3.0.3 through 4.1 allows guest OS users to determine the existence of host OS files and directories via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/44840; http://secunia.com/advisories/44904; http://www.securityfocus.com/bid/48098
CVE: CVE-2011-2174
Published: 2011-06-06
Description: Double free vulnerability in the tvb_uncompress function in epan/tvbuff.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a packet with malformed data that uses zlib compression.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=37081; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061290.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061437.html
CVE: CVE-2011-2175
Published: 2011-06-06
Description: Integer underflow in the visual_read function in wiretap/visual.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a malformed Visual Networks file that triggers a heap-based buffer over-read.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=37128; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061290.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061437.html
CVE: CVE-2011-2216
Published: 2011-06-06
Description: reqresp_parser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.2 does not initialize certain strings, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed Contact header.
CVSS Score: 5.0 (MEDIUM)
References: http://downloads.digium.com/pub/security/AST-2011-007.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062658.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062013.html
CVE: CVE-2011-2217
Published: 2011-06-06
Description: Certain ActiveX controls in (1) tsgetxu71ex552.dll and (2) tsgetx71ex552.dll in Tom Sawyer GET Extension Factory 5.5.2.237, as used in VI Client (aka VMware Infrastructure Client) 2.0.2 before Build 230598 and 2.5 before Build 204931 in VMware Infrastructure 3, do not properly handle attempted initialization within Internet Explorer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HTML document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=911; http://secunia.com/advisories/44826; http://secunia.com/advisories/44844
CVE: CVE-2009-5076
Published: 2011-06-08
Description: CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with (1) login.php or (2) password_forgotten.php appended as the PATH_INFO, which bypasses a check that uses PHP_SELF, which is not properly handled by (a) includes/application_top.php and (b) admin/includes/application_top.php, as exploited in the wild in 2009.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://hosting-4-creloaded.com/node/116; https://www.creloaded.com/fdm_file_detail.php?file_id=191; http://hosting-4-creloaded.com/node/116
CVE: CVE-2010-4663
Published: 2011-06-08
Description: Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://forum.cmsmadesimple.org/viewtopic.php?t=49245; http://openwall.com/lists/oss-security/2011/03/29/2; http://openwall.com/lists/oss-security/2011/03/30/9
CVE: CVE-2011-1584
Published: 2011-06-08
Description: The updateFile function in inc/core/class.dc.media.php in the Media Manager in Dotclear before 2.2.3 does not properly restrict pathnames, which allows remote authenticated users to upload and execute arbitrary PHP code via the media_path or media_file parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://dev.dotclear.org/2.0/changeset/2:3427; http://dotclear.org/blog/post/2011/04/01/Dotclear-2.2.3; http://fr.dotclear.org/blog/post/2011/04/01/Dotclear-2.2.3
CVE: CVE-2011-2386
Published: 2011-06-08
Description: VisiWaveReport.exe in AZO Technologies, Inc. VisiWave Site Survey before 2.1.9 allows user-assisted remote attackers to execute arbitrary code via a (1) vws and (2) vwr file with an invalid Type property, which triggers an untrusted pointer dereference.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/72464; http://secunia.com/advisories/44636; http://www.exploit-db.com/exploits/17317
CVE: CVE-2009-5077
Published: 2011-06-08
Description: CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHP_SELF variable, which is not properly handled by (1) includes/application_top.php and (2) admin/includes/application_top.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://hosting-4-creloaded.com/node/116; http://hosting-4-creloaded.com/node/116
CVE: CVE-2011-1711
Published: 2011-06-09
Description: Unspecified vulnerability in the Mobility Pack 1.1.2 and earlier in Novell Data Synchronizer 1.0.x, and 1.1.x through 1.1.1 build 428, allows remote authenticated users to access the accounts of other users via unknown vectors.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/72759; http://secunia.com/advisories/44864; http://www.novell.com/support/viewContent.do?externalId=7008690
CVE: CVE-2011-2107
Published: 2011-06-09
Description: Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.22 and earlier on Android, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "universal cross-site scripting vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://googlechromereleases.blogspot.com/2011/06/stable-channel-update.html; http://secunia.com/advisories/44846; http://secunia.com/advisories/44847
CVE: CVE-2011-2395
Published: 2011-06-09
Description: The Neighbor Discovery (ND) protocol implementation in Cisco IOS on unspecified switches allows remote attackers to bypass the Router Advertisement Guarding functionality via a fragmented IPv6 packet in which the Router Advertisement (RA) message is contained in the second fragment, as demonstrated by (1) a packet in which the first fragment contains a long Destination Options extension header or (2) a packet in which the first fragment contains an ICMPv6 Echo Request message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://seclists.org/fulldisclosure/2011/May/446; http://securityreason.com/securityalert/8271; https://exchange.xforce.ibmcloud.com/vulnerabilities/67940
CVE: CVE-2011-2468
Published: 2011-06-09
Description: Directory traversal vulnerability in the web interface in AnyMacro Mail System G4X allows remote attackers to read arbitrary files via directory traversal sequences in a request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/44810; http://www.cnvd.org.cn/vulnerability/CNVD-2011-05282; http://www.kb.cert.org/vuls/id/603590
CVE: CVE-2010-4804
Published: 2011-06-09
Description: The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// URIs, related to (1) BrowserActivity.java and (2) BrowserSettings.java in com/android/browser/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=f440831d76817e837164ca18c7705e81d2391f87; http://android.git.kernel.org/?p=platform/packages/apps/Browser.git%3Ba=commit%3Bh=604a598e1e01bda781600a45e0a971898a582666; http://thomascannon.net/blog/2010/11/android-data-stealing-vulnerability/
CVE: CVE-2011-1823
Published: 2011-06-09
Description: The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: http://android.git.kernel.org/?p=platform/system/core.git%3Ba=commit%3Bh=b620a0b1c7ae486e979826200e8e441605b0a5d6; http://android.git.kernel.org/?p=platform/system/netd.git%3Ba=commit%3Bh=79b579c92afc08ab12c0a5788d61f2dd2934836f; http://android.git.kernel.org/?p=platform/system/vold.git%3Ba=commit%3Bh=c51920c82463b240e2be[PII_REDACTED]d6fdc5352e
CVE: CVE-2011-1699
Published: 2011-06-09
Description: Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted uri parameter in a printer-url.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=6_bNby38ERg~; http://secunia.com/advisories/44811; http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7008720
CVE: CVE-2011-1700
Published: 2011-06-09
Description: Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted profile-time parameter in a printer-url.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=6_bNby38ERg~; http://secunia.com/advisories/44811; http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7008722
CVE: CVE-2011-1701
Published: 2011-06-09
Description: Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted profile-name parameter in a printer-url.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=6_bNby38ERg~; http://secunia.com/advisories/44811; http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7008723
CVE: CVE-2011-1702
Published: 2011-06-09
Description: Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted file-date-time parameter in a printer-url.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=6_bNby38ERg~; http://secunia.com/advisories/44811; http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7008724
CVE: CVE-2011-1703
Published: 2011-06-09
Description: Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted driver-version parameter in a printer-url.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=6_bNby38ERg~; http://secunia.com/advisories/44811; http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7008727
CVE: CVE-2011-1704
Published: 2011-06-09
Description: Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted core-package parameter in a printer-url.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=6_bNby38ERg~; http://secunia.com/advisories/44811; http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7008728
CVE: CVE-2011-1705
Published: 2011-06-09
Description: Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted client-file-name parameter in a printer-url.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=6_bNby38ERg~; http://secunia.com/advisories/44811; http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7008729
CVE: CVE-2011-1706
Published: 2011-06-09
Description: Stack-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted iprint-client-config-info parameter in a printer-url.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=6_bNby38ERg~; http://secunia.com/advisories/44811; http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7008730
CVE: CVE-2011-1707
Published: 2011-06-09
Description: Stack-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted op-printer-list-all-jobs parameter in a printer-url.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=6_bNby38ERg~; http://secunia.com/advisories/44811; http://www.securityfocus.com/archive/1/518275/100/0/threaded
CVE: CVE-2011-1760
Published: 2011-06-09
Description: utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to conduct eval injection attacks and gain privileges via shell metacharacters in the -e argument.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624212; http://openwall.com/lists/oss-security/2011/04/29/3; http://openwall.com/lists/oss-security/2011/05/01/1
CVE: CVE-2011-1808
Published: 2011-06-09
Description: Use-after-free vulnerability in Google Chrome before 12.0.742.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to incorrect integer calculations during float handling.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=73962; http://code.google.com/p/chromium/issues/detail?id=79746; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
CVE: CVE-2011-1809
Published: 2011-06-09
Description: Use-after-free vulnerability in the accessibility feature in Google Chrome before 12.0.742.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=75496; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html; http://osvdb.org/72779
CVE: CVE-2011-1810
Published: 2011-06-09
Description: The Cascading Style Sheets (CSS) implementation in Google Chrome before 12.0.742.91 does not properly restrict access to the visit history, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=75643; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html; http://osvdb.org/72780
CVE: CVE-2011-1811
Published: 2011-06-09
Description: Google Chrome before 12.0.742.91 does not properly handle a large number of form submissions, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=76034; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html; http://osvdb.org/72781
CVE: CVE-2011-1812
Published: 2011-06-09
Description: Google Chrome before 12.0.742.91 allows remote attackers to bypass intended access restrictions via vectors related to extensions.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=77026; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html; http://osvdb.org/72782
CVE: CVE-2011-1813
Published: 2011-06-09
Description: Google Chrome before 12.0.742.91 does not properly implement the framework for extensions, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=78516; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html; http://osvdb.org/72783
CVE: CVE-2011-1814
Published: 2011-06-09
Description: Google Chrome before 12.0.742.91 attempts to read data from an uninitialized pointer, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-824
References: http://code.google.com/p/chromium/issues/detail?id=79362; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html; http://osvdb.org/72784
CVE: CVE-2011-1815
Published: 2011-06-09
Description: Google Chrome before 12.0.742.91 allows remote attackers to inject script into a tab page via vectors related to extensions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://code.google.com/p/chromium/issues/detail?id=79862; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html; http://osvdb.org/72785
CVE: CVE-2011-1816
Published: 2011-06-09
Description: Use-after-free vulnerability in the developer tools in Google Chrome before 12.0.742.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=80358; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html; http://osvdb.org/72786
CVE: CVE-2011-1817
Published: 2011-06-09
Description: Google Chrome before 12.0.742.91 does not properly implement history deletion, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=81916; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html; http://osvdb.org/72787
CVE: CVE-2011-1818
Published: 2011-06-09
Description: Use-after-free vulnerability in the image loader in Google Chrome before 12.0.742.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=81949; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html; http://osvdb.org/72788
CVE: CVE-2011-1819
Published: 2011-06-09
Description: Google Chrome before 12.0.742.91 allows remote attackers to perform unspecified injection into a chrome:// page via vectors related to extensions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://code.google.com/p/chromium/issues/detail?id=83010; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html; http://osvdb.org/72789
CVE: CVE-2011-2332
Published: 2011-06-09
Description: Google V8, as used in Google Chrome before 12.0.742.91, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=83275; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html; http://osvdb.org/72790
CVE: CVE-2011-2342
Published: 2011-06-09
Description: The DOM implementation in Google Chrome before 12.0.742.91 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://code.google.com/p/chromium/issues/detail?id=83743; http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html; http://osvdb.org/72791
CVE: CVE-2011-1708
Published: 2011-06-09
Description: Stack-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted op-printer-list-all-jobs cookie.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=6_bNby38ERg~; http://secunia.com/advisories/44811; http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7008731
CVE: CVE-2011-2471
Published: 2011-06-09
Description: utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to gain privileges via shell metacharacters in the (1) --vmlinux, (2) --session-dir, or (3) --xen argument, related to the daemonrc file and the do_save_setup and do_load_setup functions, a different vulnerability than CVE-2011-1760.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624212; http://openwall.com/lists/oss-security/2011/05/03/1; http://openwall.com/lists/oss-security/2011/05/10/6
CVE: CVE-2011-2472
Published: 2011-06-09
Description: Directory traversal vulnerability in utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to overwrite arbitrary files via a .. (dot dot) in the --save argument, related to the --session-dir argument, a different vulnerability than CVE-2011-1760.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624212; http://openwall.com/lists/oss-security/2011/05/03/1; http://openwall.com/lists/oss-security/2011/05/10/6
CVE: CVE-2011-2473
Published: 2011-06-09
Description: The do_dump_data function in utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to create or overwrite arbitrary files via a crafted --session-dir argument in conjunction with a symlink attack on the opd_pipe file, a different vulnerability than CVE-2011-1760.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624212; http://openwall.com/lists/oss-security/2011/05/03/1; http://openwall.com/lists/oss-security/2011/05/10/6
CVE: CVE-2011-2474
Published: 2011-06-09
Description: Directory traversal vulnerability in the HTTP Server in Sybase EAServer 6.3.1 Developer Edition allows remote attackers to read arbitrary files via a /.\../\../\ sequence in a path.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=912; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=912
CVE: CVE-2011-2475
Published: 2011-06-09
Description: Format string vulnerability in ECTrace.dll in the iMailGateway service in the Internet Mail Gateway in OneBridge Server and DMZ Proxy in Sybase OneBridge Mobile Data Suite 5.5 and 5.6 allows remote attackers to execute arbitrary code via format string specifiers in unspecified string fields, related to authentication logging.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://www.sybase.com/detail?id=1092074; http://zerodayinitiative.com/advisories/ZDI-11-171/; http://www.sybase.com/detail?id=1092074
CVE: CVE-2010-4667
Published: 2011-06-14
Description: Cross-site scripting (XSS) vulnerability in Coppermine Photo Gallery (CPG) before 1.4.27 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.gentoo.org/show_bug.cgi?id=347287; http://forum.coppermine-gallery.net/index.php/topic%2C65023.msg322935.html; http://www.openwall.com/lists/oss-security/2011/06/08/2