deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1552
Published: 2010-05-13
Description: Stack-based buffer overflow in the doLoad function in snmpviewer.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via the act and app parameters.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4351&w=2; http://securityreason.com/securityalert/8157; http://www.securityfocus.com/archive/1/511248/100/0/threaded
CVE: CVE-2010-1553
Published: 2010-05-13
Description: Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via an invalid MaxAge parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4351&w=2; http://securityreason.com/securityalert/8153; http://www.securityfocus.com/archive/1/511241/100/0/threaded
CVE: CVE-2010-1554
Published: 2010-05-13
Description: Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via an invalid iCount parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4351&w=2; http://securityreason.com/securityalert/8154; http://www.exploit-db.com/exploits/14181
CVE: CVE-2010-1555
Published: 2010-05-13
Description: Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via an invalid Hostname parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4351&w=2; http://www.securityfocus.com/archive/1/511250/100/0/threaded; http://www.securityfocus.com/bid/40072
CVE: CVE-2010-1284
Published: 2010-05-13
Description: Adobe Shockwave Player before 11.5.7.609 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-1286, CVE-2010-1287, CVE-2010-1289, CVE-2010-1290, and CVE-2010-1291.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38751; http://www.adobe.com/support/security/bulletins/apsb10-12.html; http://www.securityfocus.com/bid/40091
CVE: CVE-2010-1286
Published: 2010-05-13
Description: Adobe Shockwave Player before 11.5.7.609 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-1284, CVE-2010-1287, CVE-2010-1289, CVE-2010-1290, and CVE-2010-1291.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38751; http://www.adobe.com/support/security/bulletins/apsb10-12.html; http://www.vupen.com/english/advisories/2010/1128
CVE: CVE-2010-1287
Published: 2010-05-13
Description: Adobe Shockwave Player before 11.5.7.609 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-1284, CVE-2010-1286, CVE-2010-1289, CVE-2010-1290, and CVE-2010-1291.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38751; http://www.adobe.com/support/security/bulletins/apsb10-12.html; http://www.vupen.com/english/advisories/2010/1128
CVE: CVE-2010-1288
Published: 2010-05-13
Description: Buffer overflow in Adobe Shockwave Player before 11.5.7.609 might allow attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38751; http://www.adobe.com/support/security/bulletins/apsb10-12.html; http://www.vupen.com/english/advisories/2010/1128
CVE: CVE-2010-1289
Published: 2010-05-13
Description: Adobe Shockwave Player before 11.5.7.609 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-1284, CVE-2010-1286, CVE-2010-1287, CVE-2010-1290, and CVE-2010-1291.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38751; http://www.adobe.com/support/security/bulletins/apsb10-12.html; http://www.securityfocus.com/bid/40087
CVE: CVE-2010-1290
Published: 2010-05-13
Description: Adobe Shockwave Player before 11.5.7.609 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-1284, CVE-2010-1286, CVE-2010-1287, CVE-2010-1289, and CVE-2010-1291.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38751; http://www.adobe.com/support/security/bulletins/apsb10-12.html; http://www.vupen.com/english/advisories/2010/1128
CVE: CVE-2010-1291
Published: 2010-05-13
Description: Adobe Shockwave Player before 11.5.7.609 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-1284, CVE-2010-1286, CVE-2010-1287, CVE-2010-1289, and CVE-2010-1290.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38751; http://www.adobe.com/support/security/bulletins/apsb10-12.html; http://www.vupen.com/english/advisories/2010/1128
CVE: CVE-2010-1939
Published: 2010-05-13
Description: Use-after-free vulnerability in Apple Safari 4.0.5 on Windows allows remote attackers to execute arbitrary code by using window.open to create a popup window for a crafted HTML document, and then calling the parent window's close method, which triggers improper handling of a deleted window object.
CVSS Score: 7.6 (HIGH)
CWE: CWE-399
References: http://h07.w.interia.pl/Safari.rar; http://reviews.cnet.com/8301-13727_7-20004709-263.html; http://secunia.com/advisories/39670
CVE: CVE-2009-3678
Published: 2010-05-14
Description: Integer overflow in cdd.dll in the Canonical Display Driver (CDD) in Microsoft Windows Server 2008 R2 and Windows 7 on 64-bit platforms, when the Windows Aero theme is installed, allows context-dependent attackers to cause a denial of service (reboot) or possibly execute arbitrary code via a crafted image file that triggers incorrect data parsing after user-mode data is copied to kernel mode, as demonstrated using "Browse with Irfanview" and certain actions on a folder containing a large number of thumbnail images in Resample mode, possibly related to the ATI graphics driver or win32k.sys, aka "Canonical Display Driver Integer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://blogs.technet.com/msrc/archive/2010/05/18/security-advisory-2028859-released.aspx; http://blogs.technet.com/srd/archive/2010/05/18/cdd-dll-vulnerability-difficult-to-exploit.aspx; http://en.irfanview-forum.de/vb/showthread.php?5647-V4-25-bluescreen-with-Windows-7-cdd-dll-win32k-sys
CVE: CVE-2010-0475
Published: 2010-05-14
Description: Cross-site scripting (XSS) vulnerability in esp/editUser.esp in the Palo Alto Networks firewall 3.0.x before 3.0.9 and 3.1.x before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the role parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2010-05/0086.html; http://www.jeromiejackson.com/index.php?view=article&id=83:palo-alto-cross-site-scripting-vulnerability&tmpl=component&print=1&layout=default&page=; http://www.securityfocus.com/bid/40113
CVE: CVE-2010-1509
Published: 2010-05-14
Description: IrfanView before 4.27 does not properly handle an unspecified integer variable during processing of PSD images, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow, related to a "sign-extension error."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://irfanview.com/main_history.htm; http://osvdb.org/64627; http://secunia.com/advisories/39036
CVE: CVE-2010-1510
Published: 2010-05-14
Description: Heap-based buffer overflow in IrfanView before 4.27 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PSD image with RLE compression.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://irfanview.com/main_history.htm; http://osvdb.org/64628; http://secunia.com/advisories/39036
CVE: CVE-2010-1558
Published: 2010-05-14
Description: Unspecified vulnerability in HP Multifunction Peripheral (MFP) Digital Sending Software before 4.18.3 allows local users to bypass intended restrictions on the MFP "Send to e-mail" feature, and obtain sensitive information, via unknown vectors.
CVSS Score: 4.7 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3422&w=2; http://osvdb.org/64661; http://www.securityfocus.com/bid/40147
CVE: CVE-2010-1621
Published: 2010-05-14
Description: The mysql_uninstall_plugin function in sql/sql_plugin.cc in MySQL 5.1 before 5.1.46 does not check privileges before uninstalling a plugin, which allows remote attackers to uninstall arbitrary plugins via the UNINSTALL PLUGIN command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://bugs.mysql.com/bug.php?id=51770; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-46.html; http://www.mandriva.com/security/advisories?name=MDVSA-2010:093
CVE: CVE-2010-1624
Published: 2010-05-14
Description: The msn_emoticon_msg function in slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.7.0 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a custom emoticon in a malformed SLP message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://developer.pidgin.im/viewmtn/revision/diff/884d44222e8c81ecec51c25e07d005e002a5479b/with/894460d22c434e73d60b71ec031611988e687c8b/libpurple/protocols/msn/slp.c; http://developer.pidgin.im/viewmtn/revision/info/894460d22c434e73d60b71ec031611988e687c8b; http://secunia.com/advisories/39801
CVE: CVE-2010-0601
Published: 2010-05-14
Description: The MGCP implementation on the Cisco PGW 2200 Softswitch with software before 9.7(3)S11 allows remote attackers to cause a denial of service (device crash) via a malformed packet, aka Bug ID CSCsl39126.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/64680; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c519.shtml; http://www.securityfocus.com/bid/40117
CVE: CVE-2010-0602
Published: 2010-05-14
Description: The SIP implementation on the Cisco PGW 2200 Softswitch with software before 9.7(3)S11 allows remote attackers to cause a denial of service (device crash) via a malformed packet, aka Bug ID CSCsk32606.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/64688; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c519.shtml; http://www.securityfocus.com/bid/40120
CVE: CVE-2010-0603
Published: 2010-05-14
Description: The SIP implementation on the Cisco PGW 2200 Softswitch with software before 9.7(3)S10 allows remote attackers to cause a denial of service (device crash) via a malformed session attribute, aka Bug ID CSCsk40030.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c519.shtml; http://www.securityfocus.com/bid/40121; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c519.shtml
CVE: CVE-2010-0604
Published: 2010-05-14
Description: Unspecified vulnerability in the SIP implementation on the Cisco PGW 2200 Softswitch with software before 9.7(3)S10 allows remote attackers to cause a denial of service (device crash) via unknown SIP traffic, as demonstrated by "SIP testing," aka Bug ID CSCsk38165.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/64686; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c519.shtml; http://www.securityfocus.com/bid/40122
CVE: CVE-2010-1556
Published: 2010-05-14
Description: Unspecified vulnerability in HP Systems Insight Manager (SIM) 5.3, 5.3 Update 1, and 6.0 allows remote attackers to obtain sensitive information and modify data via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8940&w=2; http://www.securityfocus.com/bid/40111; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8940&w=2
CVE: CVE-2010-1557
Published: 2010-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in HP Insight Control Server Migration before 6.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7932&w=2; http://osvdb.org/64615; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7932&w=2
CVE: CVE-2010-1561
Published: 2010-05-14
Description: The SIP implementation on the Cisco PGW 2200 Softswitch with software 9.7(3)S before 9.7(3)S11 and 9.7(3)P before 9.7(3)P11 allows remote attackers to cause a denial of service (device crash) via a long message, aka Bug ID CSCsk44115.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/64685; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c519.shtml; http://www.securityfocus.com/bid/40123
CVE: CVE-2010-1562
Published: 2010-05-14
Description: The SIP implementation on the Cisco PGW 2200 Softswitch with software 9.7(3)S before 9.7(3)S9 and 9.7(3)P before 9.7(3)P9 allows remote attackers to cause a denial of service (device crash) via a malformed Contact header, aka Bug ID CSCsj98521.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/64684; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c519.shtml; http://osvdb.org/64684
CVE: CVE-2010-1563
Published: 2010-05-14
Description: The SIP implementation on the Cisco PGW 2200 Softswitch with software 9.7(3)S before 9.7(3)S9 and 9.7(3)P before 9.7(3)P9 allows remote attackers to cause a denial of service (device crash) via a malformed header, aka Bug ID CSCsk04588.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/64683; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c519.shtml; http://www.securityfocus.com/bid/40125
CVE: CVE-2010-1565
Published: 2010-05-14
Description: Unspecified vulnerability in the SIP implementation on the Cisco PGW 2200 Softswitch with software 9.7(3)S before 9.7(3)S9 and 9.7(3)P before 9.7(3)P9 allows remote attackers to cause a denial of service (TCP socket exhaustion) via unknown vectors, aka Bug ID CSCsk13561.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/64682; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c519.shtml; http://www.securityfocus.com/bid/40128
CVE: CVE-2010-1567
Published: 2010-05-14
Description: The SIP implementation on the Cisco PGW 2200 Softswitch with software before 9.8(1)S5 allows remote attackers to cause a denial of service (device crash) via a malformed header, aka Bug ID CSCsz13590.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/64681; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c519.shtml; http://www.securityfocus.com/bid/40126
CVE: CVE-2010-1568
Published: 2010-05-14
Description: The Send Secure functionality in the Cisco IronPort Desktop Flag Plug-in for Outlook before 6.5.0-006 does not properly handle simultaneously composed messages, which might allow remote attackers to obtain cleartext contents of e-mail messages that were intended to be encrypted, aka bug 65623.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.cisco.com/en/US/products/products_security_response09186a0080b2c505.html; http://www.cisco.com/en/US/products/products_security_response09186a0080b2c505.html
CVE: CVE-2010-1940
Published: 2010-05-14
Description: Apple Safari 4.0.5 on Windows sends the "Authorization: Basic" header appropriate for one web site to a different web site named in a Location header received from the first site, which allows remote web servers to obtain sensitive information by logging HTTP requests. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://secunia.com/advisories/39670; https://exchange.xforce.ibmcloud.com/vulnerabilities/58620; http://secunia.com/advisories/39670
CVE: CVE-2010-0998
Published: 2010-05-17
Description: Multiple stack-based buffer overflows in Free Download Manager (FDM) before 3.0.852 allow remote attackers to execute arbitrary code via vectors involving (1) the folders feature in Site Explorer, (2) the websites feature in Site Explorer, (3) an FTP URI, or (4) a redirect.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/64671; http://osvdb.org/64672; http://osvdb.org/64673
CVE: CVE-2010-0999
Published: 2010-05-17
Description: Directory traversal vulnerability in Free Download Manager (FDM) before 3.0.852 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: http://osvdb.org/64670; http://secunia.com/secunia_research/2010-67/; http://www.securityfocus.com/archive/1/511284/100/0/threaded
CVE: CVE-2010-1000
Published: 2010-05-17
Description: Directory traversal vulnerability in KGet in KDE SC 4.0.0 through 4.4.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051692.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058580.html; http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
CVE: CVE-2010-1511
Published: 2010-05-17
Description: KGet 2.4.2 in KDE SC 4.0.0 through 4.4.3 does not properly request download confirmation from the user, which makes it easier for remote attackers to overwrite arbitrary files via a crafted metalink file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051692.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]8426&w=2; http://osvdb.org/64689
CVE: CVE-2010-1512
Published: 2010-05-17
Description: Directory traversal vulnerability in aria2 before 1.9.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://downloads.sourceforge.net/project/aria2/stable/aria2-1.9.3/NEWS; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041753.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041754.html
CVE: CVE-2010-0774
Published: 2010-05-17
Description: The (1) JAX-RPC WS-Security 1.0 and (2) JAX-WS runtime implementations in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 do not properly handle WebServices PKCS#7 and PKIPath tokens, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PK96427; https://exchange.xforce.ibmcloud.com/vulnerabilities/58554; http://www-01.ibm.com/support/docview.wss?uid=swg1PK96427
CVE: CVE-2010-0775
Published: 2010-05-17
Description: Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 allows remote attackers to cause a denial of service (memory consumption and daemon crash) via a crafted request, related to the nodeagent and Deployment Manager components.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM05663; https://exchange.xforce.ibmcloud.com/vulnerabilities/58555; http://www-01.ibm.com/support/docview.wss?uid=swg1PM05663
CVE: CVE-2010-0776
Published: 2010-05-17
Description: The Web Container in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 does not properly handle chunked transfer encoding during a call to response.sendRedirect, which allows remote attackers to cause a denial of service via a GET request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM08760; https://exchange.xforce.ibmcloud.com/vulnerabilities/58556; http://www-01.ibm.com/support/docview.wss?uid=swg1PM08760
CVE: CVE-2010-0777
Published: 2010-05-17
Description: The Web Container in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 does not properly handle long filenames and consequently sends an incorrect file in some responses, which allows remote attackers to obtain sensitive information by reading the retrieved file.
CVSS Score: 2.6 (LOW)
CWE: CWE-20
References: http://secunia.com/advisories/39838; http://www-01.ibm.com/support/docview.wss?uid=swg1PM06111; http://www-01.ibm.com/support/docview.wss?uid=swg27007951
CVE: CVE-2010-1949
Published: 2010-05-19
Description: SQL injection vulnerability in the Online News Paper Manager (com_jnewspaper) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter to index.php. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/39536; http://www.exploit-db.com/exploits/12305; http://secunia.com/advisories/39536
CVE: CVE-2010-1950
Published: 2010-05-19
Description: SQL injection vulnerability in the Online News Paper Manager (com_jnewspaper) component 1.0 for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the date_info parameter to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/39536; http://secunia.com/advisories/39536
CVE: CVE-2010-1951
Published: 2010-05-19
Description: Multiple directory traversal vulnerabilities in 60cycleCMS allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the DOCUMENT_ROOT parameter to (1) news.php, (2) submitComment.php, and (3) sqlConnect.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/12249; http://www.securityfocus.com/archive/1/510721/100/0/threaded; http://www.securityfocus.com/bid/39473
CVE: CVE-2010-1952
Published: 2010-05-19
Description: Directory traversal vulnerability in the BeeHeard (com_beeheard) and BeeHeard Lite (com_beeheardlite) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlabeeheardlite-lfi.txt; http://secunia.com/advisories/39475; http://www.exploit-db.com/exploits/12239
CVE: CVE-2010-1953
Published: 2010-05-19
Description: Directory traversal vulnerability in the iNetLanka Multiple Map (com_multimap) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/39530; http://www.exploit-db.com/exploits/12288; http://www.securityfocus.com/bid/39551
CVE: CVE-2010-1954
Published: 2010-05-19
Description: Directory traversal vulnerability in the iNetLanka Multiple root (com_multiroot) component 1.0 and 1.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/39531; http://www.exploit-db.com/exploits/12287; http://www.securityfocus.com/bid/39552