deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1637
Published: 2010-06-22
Description: The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: http://conference.hitb.org/hitbsecconf2010dxb/materials/D1%20-%20Laurent%20Oudot%20-%20Improving%20the%20Stealthiness%20of%20Web%20Hacking.pdf#page=69; http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043239.html
CVE: CVE-2010-1638
Published: 2010-06-22
Description: The IMP plugin in Horde allows remote attackers to bypass firewall restrictions and use Horde as a proxy to scan internal networks via a crafted request to an unspecified test script.  NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://conference.hitb.org/hitbsecconf2010dxb/materials/D1%20-%20Laurent%20Oudot%20-%20Improving%20the%20Stealthiness%20of%20Web%20Hacking.pdf#page=74; http://www.openwall.com/lists/oss-security/2010/05/21/2; http://www.openwall.com/lists/oss-security/2010/05/25/2
CVE: CVE-2010-2420
Published: 2010-06-22
Description: Multiple unspecified vulnerabilities in Fenrir Inc. ActiveGeckoBrowser 1.0.0 and 1.0.5 alpha, a module for the Sleipnir web browser, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the Gecko engine.
CVSS Score: 6.8 (MEDIUM)
References: http://jvn.jp/en/jp/JVN67120749/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000025.html; http://www.fenrir.co.jp/blog/2010/06/activegeckobrowser.html
CVE: CVE-2010-2421
Published: 2010-06-22
Description: Multiple unspecified vulnerabilities in Opera before 10.54 have unknown impact and attack vectors related to (1) "extremely severe," (2) "highly severe," (3) "moderately severe," and (4) "less severe" issues.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/40250; http://www.opera.com/docs/changelogs/mac/1054/; http://www.opera.com/docs/changelogs/windows/1054/
CVE: CVE-2010-1407
Published: 2010-06-22
Description: WebKit in Apple iOS before 4 on the iPhone and iPod touch does not properly implement the history.replaceState method in certain situations involving IFRAME elements, which allows remote attackers to obtain sensitive information via a crafted HTML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-1632
Published: 2010-06-22
Description: Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html; http://geronimo.apache.org/21x-security-report.html; http://geronimo.apache.org/22x-security-report.html
CVE: CVE-2010-1751
Published: 2010-06-22
Description: Application Sandbox in Apple iOS before 4 on the iPhone and iPod touch does not prevent photo-library access, which might allow remote attackers to obtain location information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://support.apple.com/kb/HT4225; http://www.securityfocus.com/bid/41016
CVE: CVE-2010-1752
Published: 2010-06-22
Description: Stack-based buffer overflow in CFNetwork in Apple iOS before 4 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to URL handling.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://support.apple.com/kb/HT4225
CVE: CVE-2010-1753
Published: 2010-06-22
Description: ImageIO in Apple iOS before 4 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted JPEG image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://support.apple.com/kb/HT4225; http://www.securityfocus.com/bid/41016
CVE: CVE-2010-1754
Published: 2010-06-22
Description: Passcode Lock in Apple iOS before 4 on the iPhone and iPod touch does not properly handle alert-based unlocks in conjunction with subsequent Remote Lock operations through MobileMe, which allows physically proximate attackers to bypass intended passcode requirements via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://support.apple.com/kb/HT4225; http://www.securityfocus.com/bid/41016
CVE: CVE-2010-1755
Published: 2010-06-22
Description: Safari in Apple iOS before 4 on the iPhone and iPod touch does not properly implement the Accept Cookies preference, which makes it easier for remote web servers to track users via a cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://support.apple.com/kb/HT4225; http://www.securityfocus.com/bid/41016
CVE: CVE-2010-1756
Published: 2010-06-22
Description: The Settings application in Apple iOS before 4 on the iPhone and iPod touch does not properly report the wireless network that is in use, which might make it easier for remote attackers to trick users into communicating over an unintended network.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://support.apple.com/kb/HT4225; http://www.securityfocus.com/bid/41016
CVE: CVE-2010-1757
Published: 2010-06-22
Description: WebKit in Apple iOS before 4 on the iPhone and iPod touch does not enforce the expected boundary restrictions on content display by an IFRAME element, which allows remote attackers to spoof the user interface via a crafted HTML document.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-1775
Published: 2010-06-22
Description: Race condition in Passcode Lock in Apple iOS before 4 on the iPhone and iPod touch allows physically proximate attackers to bypass intended passcode requirements, and pair a locked device with a computer and access arbitrary data, via vectors involving the initial boot.
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://support.apple.com/kb/HT4225; http://www.securityfocus.com/bid/41016
CVE: CVE-2010-2431
Published: 2010-06-22
Description: The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file.
CVSS Score: 2.6 (LOW)
CWE: CWE-59
References: http://cups.org/articles.php?L596; http://cups.org/str.php?L3510; http://rhn.redhat.com/errata/RHSA-2010-0811.html
CVE: CVE-2010-2432
Published: 2010-06-22
Description: The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4, when HAVE_GSSAPI is omitted, does not properly handle a demand for authorization, which allows remote CUPS servers to cause a denial of service (infinite loop) via HTTP_UNAUTHORIZED responses.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://cups.org/articles.php?L596; http://cups.org/str.php?L3518; http://secunia.com/advisories/43521
CVE: CVE-2010-2422
Published: 2010-06-24
Description: Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.4 before hotfix 20100612 allows remote attackers to inject arbitrary web script or HTML via the safe_html transform.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://plone.org/products/plone/security/advisories/cve-2010-unassigned-html-injection-in-safe_html; http://secunia.com/advisories/40270; http://www.securityfocus.com/bid/40999
CVE: CVE-2010-2425
Published: 2010-06-24
Description: Directory traversal vulnerability in TitanFTPd in South River Technologies Titan FTP Server 8.10.1125, and probably earlier versions, allows remote authenticated users to read or delete arbitrary files via "..//" sequences in a COMB command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/40237; http://www.osvdb.org/65622; http://www.securityfocus.com/archive/1/511873/100/0/threaded
CVE: CVE-2010-2426
Published: 2010-06-24
Description: Directory traversal vulnerability in TitanFTPd in South River Technologies Titan FTP Server 8.10.1125, and probably earlier versions, allows remote authenticated users to read arbitrary files, determine file size, via "..//" sequences in the xcrc command.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/65533; http://secunia.com/advisories/40237; http://www.securityfocus.com/archive/1/511839/100/0/threaded
CVE: CVE-2010-2428
Published: 2010-06-24
Description: Cross-site scripting (XSS) vulnerability in admin_loginok.html in the Administrator web interface in Wing FTP Server for Windows 3.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted POST request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2010-06/0031.html; http://labs-werew01f.sectester.net/2010/06/wing-ftp-server-cross-site-scripting.html; http://seclists.org/fulldisclosure/2010/Jun/128
CVE: CVE-2010-2429
Published: 2010-06-24
Description: Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.1.2, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer in a "404 Not Found" response.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40187; http://www.osvdb.org/65623; http://www.splunk.com/view/SP-CAAAFHY
CVE: CVE-2010-2433
Published: 2010-06-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in content/internalError.jsp in IBM WebSphere ILOG JRules 6.7 allow remote attackers to inject arbitrary web script or HTML via an RTS URL to (1) explore/explore.jsp, (2) compose/compose.jsp, or (3) home.jsp in faces/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40275; http://www-01.ibm.com/support/docview.wss?uid=swg1RS00133; http://www.securityfocus.com/bid/41030
CVE: CVE-2010-0183
Published: 2010-06-24
Description: Use-after-free vulnerability in the nsCycleCollector::MarkRoots function in Mozilla Firefox 3.5.x before 3.5.10 and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a crafted HTML document, related to an improper frame construction process for menus.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html; http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html
CVE: CVE-2010-1196
Published: 2010-06-24
Description: Integer overflow in the nsGenericDOMDataNode::SetTextInternal function in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a DOM node with a long text value that triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html; http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html
CVE: CVE-2010-1197
Published: 2010-06-24
Description: Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an uploaded HTML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html; http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html
CVE: CVE-2010-1198
Published: 2010-06-24
Description: Use-after-free vulnerability in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, allows remote attackers to execute arbitrary code via vectors involving multiple plugin instances.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html; http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html
CVE: CVE-2010-1199
Published: 2010-06-24
Description: Integer overflow in the XSLT node sorting implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a large text value for a node.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html; http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html
CVE: CVE-2010-1200
Published: 2010-06-24
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html; http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html
CVE: CVE-2010-1201
Published: 2010-06-24
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.10, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html; http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html
CVE: CVE-2010-1202
Published: 2010-06-24
Description: Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html; http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html
CVE: CVE-2010-1203
Published: 2010-06-24
Description: The JavaScript engine in Mozilla Firefox 3.6.x before 3.6.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors that trigger an assertion failure in jstracer.cpp.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html; http://secunia.com/advisories/40323; http://secunia.com/advisories/40326
CVE: CVE-2010-1448
Published: 2010-06-24
Description: Cross-site scripting (XSS) vulnerability in lib/LXR/Common.pm in LXR Cross Referencer before 0.9.8 allows remote attackers to inject arbitrary web script or HTML via vectors related to a string in the search page's TITLE element, a different vulnerability than CVE-2009-4497 and CVE-2010-1625.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lxr.cvs.sourceforge.net/viewvc/lxr/lxr/lib/LXR/Common.pm?r1=1.63&r2=1.64; http://lxr.cvs.sourceforge.net/viewvc/lxr/lxr/lib/LXR/Common.pm?view=log#rev1.64; http://marc.info/?l=oss-security&m=[PII_REDACTED]3005&w=2
CVE: CVE-2010-1625
Published: 2010-06-24
Description: Cross-site scripting (XSS) vulnerability in LXR Cross Referencer before 0.9.7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the search body and the results page for a search, a different vulnerability than CVE-2009-4497 and CVE-2010-1448.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]3005&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]9027&w=2; http://sourceforge.net/projects/lxr/files/stable/lxr-0.9.7/ChangeLog/download
CVE: CVE-2010-2065
Published: 2010-06-24
Description: Integer overflow in the TIFFroundup macro in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TIFF file that triggers a buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://blogs.sun.com/security/entry/cve_2010_2065_cve_2010; http://marc.info/?l=oss-security&m=[PII_REDACTED]2908&w=2; http://secunia.com/advisories/40181
CVE: CVE-2010-2067
Published: 2010-06-24
Description: Stack-based buffer overflow in the TIFFFetchSubjectDistance function in tif_dirread.c in LibTIFF before 3.9.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long EXIF SubjectDistance field in a TIFF file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugzilla.maptools.org/show_bug.cgi?id=2212; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=874; http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
CVE: CVE-2010-2225
Published: 2010-06-24
Description: Use-after-free vulnerability in the SplObjectStorage unserializer in PHP 5.2.x and 5.3.x through 5.3.2 allows remote attackers to execute arbitrary code or obtain sensitive information via serialized data, related to the PHP unserialize function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html
CVE: CVE-2010-0778
Published: 2010-06-24
Description: Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.33 and 7.0 before 7.0.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-1.ibm.com/support/docview.wss?uid=swg1PM11778; https://exchange.xforce.ibmcloud.com/vulnerabilities/59646; http://www-1.ibm.com/support/docview.wss?uid=swg1PM11778
CVE: CVE-2010-0779
Published: 2010-06-24
Description: Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.33, and 7.0 before 7.0.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-1.ibm.com/support/docview.wss?uid=swg1PM09250; https://exchange.xforce.ibmcloud.com/vulnerabilities/59647; http://www-1.ibm.com/support/docview.wss?uid=swg1PM09250
CVE: CVE-2010-2223
Published: 2010-06-24
Description: Virtual Desktop Server Manager (VDSM) in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H or rhev-hypervisor) before 5.5-2.2 does not properly perform VM post-zeroing after the removal of a virtual machine's data, which allows guest OS users to obtain sensitive information by examining the disk blocks associated with a deleted virtual machine.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://securitytracker.com/id?1024137; http://www.securityfocus.com/bid/41044; https://bugzilla.redhat.com/show_bug.cgi?id=604752
CVE: CVE-2010-2224
Published: 2010-06-24
Description: The snapshot merging functionality in Red Hat Enterprise Virtualization Manager (aka RHEV-M) before 2.2 does not properly pass the postzero parameter during operations on deleted volumes, which allows guest OS users to obtain sensitive information by examining the disk blocks associated with a deleted virtual machine.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.securityfocus.com/bid/41045; https://bugzilla.redhat.com/show_bug.cgi?id=606774; https://rhn.redhat.com/errata/RHSA-2010-0478.html
CVE: CVE-2010-2435
Published: 2010-06-24
Description: Weborf HTTP Server 0.12.1 and earlier allows remote attackers to cause a denial of service (crash) via Unicode characters in a Connection HTTP header, and possibly other headers.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://freshmeat.net/projects/weborf/releases/318531; http://secunia.com/advisories/40322; http://www.securityfocus.com/archive/1/511953/100/0/threaded
CVE: CVE-2010-2436
Published: 2010-06-24
Description: SQL injection vulnerability in modules/blog/index.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_anecms.html; http://www.securityfocus.com/archive/1/511812/100/0/threaded; http://www.securityfocus.com/bid/40840
CVE: CVE-2010-2437
Published: 2010-06-24
Description: Cross-site scripting (XSS) vulnerability in class/tools.class.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the comment variable to modules/blog/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.htbridge.ch/advisory/stored_xss_vulnerability_in_anecms_blog_module.html; http://www.securityfocus.com/archive/1/511816/100/0/threaded; http://www.securityfocus.com/bid/40838
CVE: CVE-2010-2438
Published: 2010-06-24
Description: SQL injection vulnerability in G.CMS generator allows remote attackers to execute arbitrary SQL commands via the lang parameter to the default URI, probably index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/13954; https://exchange.xforce.ibmcloud.com/vulnerabilities/59621; http://www.exploit-db.com/exploits/13954
CVE: CVE-2010-2439
Published: 2010-06-24
Description: Stack-based buffer overflow in MoreAmp allows remote attackers to execute arbitrary code via a long line in a song list (.maf file).
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/13934; http://www.exploit-db.com/exploits/13942; https://exchange.xforce.ibmcloud.com/vulnerabilities/59570