deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-2117
Published: 2010-06-01
Description: Mozilla Firefox 3.0.19, 3.5.x, and 3.6.x allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid (1) news:// or (2) nntp:// URIs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://websecurity.com.ua/4238/; http://www.securityfocus.com/archive/1/511509/100/0/threaded; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11190
CVE: CVE-2010-2118
Published: 2010-06-01
Description: Microsoft Internet Explorer 6.0.2900.2180 and 8.0.7600.16385 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid news:// URIs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://websecurity.com.ua/4238/; http://www.securityfocus.com/archive/1/511509/100/0/threaded; http://websecurity.com.ua/4238/
CVE: CVE-2010-2119
Published: 2010-06-01
Description: Microsoft Internet Explorer 6.0.2900.2180 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid nntp:// URIs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://websecurity.com.ua/4238/; http://www.securityfocus.com/archive/1/511509/100/0/threaded; http://websecurity.com.ua/4238/
CVE: CVE-2010-2120
Published: 2010-06-01
Description: Google Chrome 1.0.154.48 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid news:// URIs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://websecurity.com.ua/4238/; http://www.securityfocus.com/archive/1/511509/100/0/threaded; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11966
CVE: CVE-2010-2121
Published: 2010-06-01
Description: Opera 9.52 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid (1) news:// or (2) nntp:// URIs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://websecurity.com.ua/4238/; http://www.securityfocus.com/archive/1/511509/100/0/threaded; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11622
CVE: CVE-2010-2122
Published: 2010-06-01
Description: Directory traversal vulnerability in the SimpleDownload (com_simpledownload) component before 0.9.6 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://extensions.joomla.org/extensions/directory-a-documentation/downloads/10717; http://packetstormsecurity.org/1005-exploits/joomlasimpledownload-lfi.txt; http://secunia.com/advisories/39871
CVE: CVE-2010-2123
Published: 2010-06-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x and 6.x before 6.x-1.33 for Drupal allow remote authenticated users, with certain module privileges, to inject arbitrary web script or HTML via the (1) fullname, (2) address, (3) city, (4) provstate (aka state), (5) phone, or (6) taxid parameter in a stormorganization action to index.php; the (7) name parameter in a stormperson action to index.php; the (8) stepno (aka Step no.) or (9) title parameter in a stormtask action to index.php; the (10) title (aka Project) parameter in a stormticket action to index.php; or (11) unspecified parameters in a stormproject action to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0160.html; http://drupal.org/node/803770; http://secunia.com/advisories/39732
CVE: CVE-2010-2124
Published: 2010-06-01
Description: SQL injection vulnerability in firma.php in Bartels Schone ConPresso 4.0.7 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1005-exploits/conpresso407-sql.txt; http://www.exploit-db.com/exploits/12684; http://www.securityfocus.com/bid/40335
CVE: CVE-2010-2125
Published: 2010-06-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Rotor Banner module 5.x before 5.x-1.8 and 6.x before 6.x-2.5 for Drupal allow remote authenticated users, with "create rotor item" or "edit any rotor item" privileges, to inject arbitrary web script or HTML via the (1) srs, (2) title, or (3) alt image attribute.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/803930; http://secunia.com/advisories/39883; http://www.osvdb.org/64770
CVE: CVE-2010-2126
Published: 2010-06-01
Description: Multiple PHP remote file inclusion vulnerabilities in Snipe Gallery 3.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the cfg_admin_path parameter to (1) index.php, (2) view.php, (3) image.php, (4) search.php, (5) admin/index.php, (6) admin/gallery/index.php, (7) admin/gallery/view.php, (8) admin/gallery/gallery.php, (9) admin/gallery/image.php, and (10) admin/gallery/crop.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://eidelweiss-advisories.blogspot.com/2010/04/snipegallery-315-multiple-remote-file.html; http://packetstormsecurity.org/1004-exploits/snipegallery-rfi.txt; http://www.securityfocus.com/bid/40279
CVE: CVE-2010-2127
Published: 2010-06-01
Description: PHP remote file inclusion vulnerability in gallery.php in JV2 Folder Gallery 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/1005-exploits/jv2foldergallery-rfi.txt; http://www.exploit-db.com/exploits/12688; http://www.securityfocus.com/bid/40339
CVE: CVE-2010-2128
Published: 2010-06-01
Description: Directory traversal vulnerability in the JE Quotation Form (com_jequoteform) component 1.0b1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the view parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/39832; http://www.exploit-db.com/exploits/12607; http://www.osvdb.org/64706
CVE: CVE-2010-2129
Published: 2010-06-01
Description: Directory traversal vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.1 and 1.0.3 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1005-exploits/joomlaajaxec-lfi.txt; http://secunia.com/advisories/39836; http://www.exploit-db.com/exploits/12598
CVE: CVE-2010-2130
Published: 2010-06-02
Description: Cross-site scripting (XSS) vulnerability in wflogin.jsp in Aris Global ARISg 5.0 allows remote attackers to inject arbitrary web script or HTML via the errmsg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/62665; http://packetstormsecurity.org/1002-exploits/arisg5-xss.txt; http://secunia.com/advisories/38793
CVE: CVE-2010-2131
Published: 2010-06-02
Description: SQL injection vulnerability in the Calendar Base (cal) extension before 1.3.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via iCalendar data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62668; http://secunia.com/advisories/38745; http://typo3.org/extensions/repository/view/cal/1.3.2/
CVE: CVE-2010-2132
Published: 2010-06-02
Description: Multiple PHP remote file inclusion vulnerabilities in Open Education System (OES) 0.1 beta allow remote attackers to execute arbitrary PHP code via a URL in the CONF_INCLUDE_PATH parameter to (1) forum/admin.php and (2) plotgraph/index.php in admin/modules/modules/, and (3) admin_user/mod_admuser.php and (4) ogroup/mod_group.php in admin/modules/user_account/, different vectors than CVE-2007-1446.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.packetstormsecurity.com/1002-exploits/oes-rfi.txt; http://www.securityfocus.com/bid/38449; https://exchange.xforce.ibmcloud.com/vulnerabilities/56590
CVE: CVE-2010-2133
Published: 2010-06-02
Description: SQL injection vulnerability in contact.php in My Little Forum allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2007-2942.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1003-exploits/mlf-sql.txt; http://www.exploit-db.com/exploits/11616; http://www.securityfocus.com/bid/38485
CVE: CVE-2010-2134
Published: 2010-06-02
Description: Multiple SQL injection vulnerabilities in login.php in Project Man 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/11584; https://exchange.xforce.ibmcloud.com/vulnerabilities/56580; http://www.exploit-db.com/exploits/11584
CVE: CVE-2010-2135
Published: 2010-06-02
Description: Multiple SQL injection vulnerabilities in login.php in HazelPress Lite 0.0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) password fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1002-exploits/hazelpresslite-sql.txt; http://www.exploit-db.com/exploits/11602; https://exchange.xforce.ibmcloud.com/vulnerabilities/56587
CVE: CVE-2010-2136
Published: 2010-06-02
Description: Directory traversal vulnerability in admin/index.php in Article Friendly, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/62624; http://secunia.com/advisories/38715; http://www.packetstormsecurity.com/1002-exploits/articlefriendly-lfi.txt
CVE: CVE-2010-2137
Published: 2010-06-02
Description: PHP remote file inclusion vulnerability in _center.php in ProMan 0.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/1002-exploits/proman-rfilfi.txt; http://www.exploit-db.com/exploits/11587; https://exchange.xforce.ibmcloud.com/vulnerabilities/56575
CVE: CVE-2010-2138
Published: 2010-06-02
Description: Multiple directory traversal vulnerabilities in ProMan 0.1.1 and earlier allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the _SESSION[userLang] parameter to (1) elisttasks.php, (2) managepmanagers.php, (3) manageusers.php, (4) helpfunc.php, (5) managegroups.php, (6) manageprocess.php, and (7) manageusersgroups.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1002-exploits/proman-rfilfi.txt; http://www.exploit-db.com/exploits/11587; https://exchange.xforce.ibmcloud.com/vulnerabilities/56577
CVE: CVE-2009-4882
Published: 2010-06-02
Description: Cross-site scripting (XSS) vulnerability in zc/publisher/html.rb in ZoneCheck 2.0.4-13 and 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the ns parameter to zc.cgi.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583290; http://cvs.savannah.gnu.org/viewvc/zonecheck/zc/publisher/html.rb?root=zonecheck&r1=1.79&r2=1.80; http://cvs.savannah.gnu.org/viewvc/zonecheck/zc/publisher/html.rb?root=zonecheck&view=log#rev1.80
CVE: CVE-2010-2139
Published: 2010-06-02
Description: SQL injection vulnerability in pages.php in Multishop CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/39958; http://secunia.com/advisories/39958
CVE: CVE-2010-2140
Published: 2010-06-02
Description: SQL injection vulnerability in itemdetail.php in Multishop CMS allows remote attackers to execute arbitrary SQL commands via the itemid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/39958; http://secunia.com/advisories/39958
CVE: CVE-2010-2141
Published: 2010-06-02
Description: SQL injection vulnerability in index.php in NITRO Web Gallery allows remote attackers to execute arbitrary SQL commands via the PictureId parameter in an open action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1005-exploits/nitro-sql.txt; http://www.exploit-db.com/exploits/12735; http://www.securityfocus.com/bid/40350
CVE: CVE-2010-2142
Published: 2010-06-02
Description: SQL injection vulnerability in default.asp in Cyberhost allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1005-exploits/cyberhost-sql.txt; http://www.securityfocus.com/bid/40357; https://exchange.xforce.ibmcloud.com/vulnerabilities/58889
CVE: CVE-2008-7256
Published: 2010-06-03
Description: mm/shmem.c in the Linux kernel before 2.6.28-rc8, when strict overcommit is enabled and CONFIG_SECURITY is disabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1643.
CVSS Score: 1.2 (LOW)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1b79cd04fab80be61dcd2732e2423aafde9a4c1c; http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.28/ChangeLog-2.6.28-rc8; http://www.mandriva.com/security/advisories?name=MDVSA-2010:198
CVE: CVE-2010-0742
Published: 2010-06-03
Description: The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct double-free attacks, and possibly execute arbitrary code, via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://cvs.openssl.org/chngview?cn=19693; http://cvs.openssl.org/filediff?f=openssl/crypto/cms/cms_asn1.c&v1=1.8&v2=1.8.6.1; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5740&w=2
CVE: CVE-2010-1633
Published: 2010-06-03
Description: RSA verification recovery in the EVP_PKEY_verify_recover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive information via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://cvs.openssl.org/chngview?cn=19693; http://cvs.openssl.org/filediff?f=openssl/crypto/rsa/rsa_pmeth.c&v1=1.34&v2=1.34.2.1; http://secunia.com/advisories/40024
CVE: CVE-2010-1643
Published: 2010-06-03
Description: mm/shmem.c in the Linux kernel before 2.6.28-rc3, when strict overcommit is enabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.9 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=731572d39fcd3498702eda4600db4c43d51e0b26; http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00006.html; http://secunia.com/advisories/40645
CVE: CVE-2010-2143
Published: 2010-06-03
Description: Directory traversal vulnerability in index.php in Symphony CMS 2.0.7 allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the mode parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1005-exploits/symphony-lfi.txt; http://www.exploit-db.com/exploits/12809; http://www.securityfocus.com/bid/40441
CVE: CVE-2010-2144
Published: 2010-06-03
Description: Cross-site scripting (XSS) vulnerability in signinform.php in Zeeways eBay Clone Auction Script allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/65006; http://packetstormsecurity.org/1005-exploits/zeeways-xss.txt; http://secunia.com/advisories/39987
CVE: CVE-2010-2145
Published: 2010-06-03
Description: Multiple PHP remote file inclusion vulnerabilities in ClearSite Beta 4.50, and possibly other versions, allow remote attackers to execute arbitrary PHP code via a URL in the cs_base_path parameter to (1) docs.php and (2) include/admin/device_admin.php.  NOTE: the header.php vector is already covered by CVE-2009-3306.  NOTE: this issue may be due to a variable extraction error.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/archive/1/511507/100/0/threaded; http://www.securityfocus.com/bid/40457; http://www.securityfocus.com/archive/1/511507/100/0/threaded
CVE: CVE-2010-2146
Published: 2010-06-03
Description: PHP remote file inclusion vulnerability in banned.php in Visitor Logger allows remote attackers to execute arbitrary PHP code via a URL in the VL_include_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/12820; http://www.securityfocus.com/bid/40469; http://www.vupen.com/english/advisories/2010/1296
CVE: CVE-2010-2147
Published: 2010-06-03
Description: Cross-site scripting (XSS) vulnerability in the My Car (com_mycar) component 1.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the modveh parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/65000; http://secunia.com/advisories/39983; http://www.exploit-db.com/exploits/12779
CVE: CVE-2010-2148
Published: 2010-06-03
Description: SQL injection vulnerability in the My Car (com_mycar) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pagina parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/64999; http://secunia.com/advisories/39983; http://www.exploit-db.com/exploits/12779
CVE: CVE-2010-2149
Published: 2010-06-03
Description: Session fixation vulnerability in Fujitsu e-Pares V01 L01, L03, L10, L20, L30 allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN36925871/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000023.html; http://secunia.com/advisories/40029
CVE: CVE-2010-2150
Published: 2010-06-03
Description: Cross-site scripting (XSS) vulnerability Fujitsu e-Pares V01 L01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN58439007/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000021.html; http://secunia.com/advisories/40029
CVE: CVE-2010-2151
Published: 2010-06-03
Description: Cross-site request forgery (CSRF) vulnerability in Fujitsu e-Pares V01 L01 V01 L01, L03, L10, L20, L30, and L40 allows remote attackers to hijack the authentication of users for requests that modify "facility reservation data" via unknown vectors.
CVSS Score: 2.6 (LOW)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN82465391/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000022.html; http://secunia.com/advisories/40029
CVE: CVE-2010-2152
Published: 2010-06-03
Description: Unspecified vulnerability in JustSystems Ichitaro 2004 through 2009, Ichitaro Government 2006 through 2009, and Just School 2008 and 2009 allows remote attackers to execute arbitrary code via unknown vectors related to "product character attribute processing" for a document.
CVSS Score: 9.3 (HIGH)
References: http://jvn.jp/en/jp/JVN17293765/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000024.html; http://osvdb.org/65050
CVE: CVE-2010-2153
Published: 2010-06-03
Description: Unrestricted file upload vulnerability in admin/code/tce_functions_tcecode_editor.php in TCExam 10.1.006 and 10.1.007 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in cache/.
CVSS Score: 6.8 (MEDIUM)
References: http://cross-site-scripting.blogspot.com/2010/06/tcexam-101006-arbitrary-upload.html; http://osvdb.org/65052; http://secunia.com/advisories/40011
CVE: CVE-2010-2154
Published: 2010-06-03
Description: Cross-site scripting (XSS) vulnerability in the Search Site in CMScout 2.09, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the search parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/65010; http://secunia.com/advisories/39986; http://www.exploit-db.com/exploits/12806
CVE: CVE-2010-2155
Published: 2010-06-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in zc/publisher/html.rb in ZoneCheck 2.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) xmlnode.value, (2) zc-error text, (3) $zc_version, (4) domainname in a zc-title row, different vulnerabilities than CVE-2009-4882.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583290; http://cvs.savannah.gnu.org/viewvc/zonecheck/zc/publisher/html.rb?root=zonecheck&r1=1.79&r2=1.80; http://cvs.savannah.gnu.org/viewvc/zonecheck/zc/publisher/html.rb?root=zonecheck&view=log#rev1.80
CVE: CVE-2010-1439
Published: 2010-06-07
Description: yum-rhn-plugin in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Enterprise Linux (RHEL) 5 and Fedora uses world-readable permissions for the /var/spool/up2date/loginAuth.pkl file, which allows local users to access the Red Hat Network profile, and possibly prevent future security updates, by leveraging authentication data from this file.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/39996; http://securitytracker.com/id?1024049; http://www.osvdb.org/65063
CVE: CVE-2010-1646
Published: 2010-06-07
Description: The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042838.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043012.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043026.html
CVE: CVE-2010-1904
Published: 2010-06-07
Description: SQL injection vulnerability in EMC RSA Key Manager (RKM) C Client 1.5.x allows user-assisted remote attackers to execute arbitrary SQL commands via the metadata section of encrypted key data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-06/0078.html; http://seclists.org/bugtraq/2011/Jan/138; http://secunia.com/advisories/43057
CVE: CVE-2010-1962
Published: 2010-06-07
Description: Unspecified vulnerability in HP StorageWorks Storage Mirroring 5 before 5.2.1.870.0 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5729&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5281&w=2; http://osvdb.org/65142