deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-4039
Published: 2010-10-21
Description: Google Chrome before 7.0.517.41 on Linux does not properly set the PATH environment variable, which has unspecified impact and attack vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://code.google.com/p/chromium/issues/detail?id=54132; http://googlechromereleases.blogspot.com/2010/10/stable-channel-update.html; http://secunia.com/advisories/41888
CVE: CVE-2010-4040
Published: 2010-10-21
Description: Google Chrome before 7.0.517.41 does not properly handle animated GIF images, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=54500; http://googlechromereleases.blogspot.com/2010/10/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-4041
Published: 2010-10-21
Description: The sandbox implementation in Google Chrome before 7.0.517.41 on Linux does not properly constrain worker processes, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://code.google.com/p/chromium/issues/detail?id=54794; http://googlechromereleases.blogspot.com/2010/10/stable-channel-update.html; http://secunia.com/advisories/41888
CVE: CVE-2010-4042
Published: 2010-10-21
Description: Google Chrome before 7.0.517.41 does not properly handle element maps, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to "stale elements."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=56451; http://googlechromereleases.blogspot.com/2010/10/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
CVE: CVE-2010-4043
Published: 2010-10-21
Description: Opera before 10.63 does not prevent interpretation of a cross-origin document as a CSS stylesheet when the document lacks a CSS token sequence, which allows remote attackers to obtain sensitive information via a crafted document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/41740; http://securitytracker.com/id?1024570; http://www.opera.com/docs/changelogs/mac/1063/
CVE: CVE-2010-4044
Published: 2010-10-21
Description: Opera before 10.63 does not ensure that the portion of a URL shown in the Address Bar contains the beginning of the URL, which allows remote attackers to spoof URLs by changing a window's size.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/41740; http://securitytracker.com/id?1024570; http://www.opera.com/docs/changelogs/mac/1063/
CVE: CVE-2010-4045
Published: 2010-10-21
Description: Opera before 10.63 does not properly restrict web script in unspecified circumstances involving reloads and redirects, which allows remote attackers to spoof the Address Bar, conduct cross-site scripting (XSS) attacks, and possibly execute arbitrary code by leveraging the ability of a script to interact with a web page from (1) a different domain or (2) a different security context.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/41740; http://securitytracker.com/id?1024570; http://www.opera.com/docs/changelogs/mac/1063/
CVE: CVE-2010-4046
Published: 2010-10-21
Description: Opera before 10.63 does not properly verify the origin of video content, which allows remote attackers to obtain sensitive information by using a video stream as HTML5 canvas content.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/41740; http://securitytracker.com/id?1024570; http://www.opera.com/docs/changelogs/mac/1063/
CVE: CVE-2010-4047
Published: 2010-10-21
Description: Opera before 10.63 does not properly select the security context of JavaScript code associated with an error page, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41740; http://securitytracker.com/id?1024570; http://www.opera.com/docs/changelogs/mac/1063/
CVE: CVE-2010-4048
Published: 2010-10-21
Description: Opera before 10.63 allows user-assisted remote web servers to cause a denial of service (application crash) by sending a redirect during the saving of a file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.opera.com/docs/changelogs/mac/1063/; http://www.opera.com/docs/changelogs/unix/1063/; http://www.opera.com/docs/changelogs/windows/1063/
CVE: CVE-2010-4049
Published: 2010-10-21
Description: Opera before 10.63 allows remote attackers to cause a denial of service (application crash) via a Flash movie with a transparent Window Mode (aka wmode) property, which is not properly handled during navigation away from the containing HTML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.opera.com/docs/changelogs/mac/1063/; http://www.opera.com/docs/changelogs/unix/1063/; http://www.opera.com/docs/changelogs/windows/1063/
CVE: CVE-2010-4050
Published: 2010-10-21
Description: Opera before 10.63 allows remote attackers to cause a denial of service (memory corruption) by referencing an SVG document in an IMG element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.opera.com/docs/changelogs/mac/1063/; http://www.opera.com/docs/changelogs/unix/1063/; http://www.opera.com/docs/changelogs/windows/1063/
CVE: CVE-2010-3288
Published: 2010-10-23
Description: Cross-site request forgery (CSRF) vulnerability in HP Systems Insight Manager (SIM) before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6686&w=2; http://www.securitytracker.com/id?1024622; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6686&w=2
CVE: CVE-2010-3289
Published: 2010-10-23
Description: Cross-site scripting (XSS) vulnerability in HP Systems Insight Manager (SIM) before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6686&w=2; http://www.securityfocus.com/bid/44262; http://www.securitytracker.com/id?1024622
CVE: CVE-2010-3290
Published: 2010-10-23
Description: Unspecified vulnerability in HP Systems Insight Manager (SIM) before 6.2 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6686&w=2; http://www.securityfocus.com/bid/44265; http://www.securitytracker.com/id?1024622
CVE: CVE-2010-4053
Published: 2010-10-23
Description: Stack-based buffer overflow in an unspecified logging function in oninit.exe in IBM Informix Dynamic Server (IDS) 11.10 before 11.10.xC2W2 and 11.50 before 11.50.xC1 allows remote authenticated users to execute arbitrary code via a crafted EXPLAIN directive, aka idsdb00154125 and idsdb00154243.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/41913; http://www.osvdb.org/68705; http://www.vupen.com/english/advisories/2010/2734
CVE: CVE-2010-4054
Published: 2010-10-23
Description: The gs_type2_interpret function in Ghostscript allows remote attackers to cause a denial of service (incorrect pointer dereference and application crash) via crafted font data in a compressed data stream, aka bug 691043.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://ghostscript.com/pipermail/gs-cvs/2010-January/010333.html; http://rhn.redhat.com/errata/RHSA-2012-0096.html; http://security.gentoo.org/glsa/glsa-201412-17.xml
CVE: CVE-2010-4055
Published: 2010-10-23
Description: Stack consumption vulnerability in solid.exe in IBM solidDB 6.5.0.3 and earlier allows remote attackers to cause a denial of service (memory consumption and daemon crash) by connecting to TCP port 1315 and sending a packet with many integer fields, which trigger many recursive calls of a certain function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/soliddb_1-adv.txt; http://secunia.com/advisories/41873; http://securitytracker.com/id?1024597
CVE: CVE-2010-4056
Published: 2010-10-23
Description: solid.exe in IBM solidDB 6.5.0.3 and earlier does not properly perform a recursive call to a certain function upon receiving packet data containing a single integer field, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a TCP session on port 1315.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/soliddb_1-adv.txt; http://secunia.com/advisories/41873; http://securitytracker.com/id?1024597
CVE: CVE-2010-4057
Published: 2010-10-23
Description: solid.exe in IBM solidDB 6.5.0.3 and earlier does not properly perform a recursive call to a certain function upon receiving packet data containing many integer fields with two different values, which allows remote attackers to cause a denial of service (invalid memory access and daemon crash) via a TCP session on port 1315.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/soliddb_1-adv.txt; http://secunia.com/advisories/41873; http://securitytracker.com/id?1024597
CVE: CVE-2010-3156
Published: 2010-10-25
Description: Untrusted search path vulnerability in K2 K2Editor before 1.5.9 allows local users to gain privileges via a Trojan horse executable file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://jvn.jp/en/jp/JVN36921800/index.html; http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000041.html; http://jvn.jp/en/jp/JVN36921800/index.html
CVE: CVE-2010-3159
Published: 2010-10-25
Description: Untrusted search path vulnerability in Explzh 5.67 and earlier allows local users to gain privileges via a Trojan horse executable file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN85599999/index.html; http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000043.html; http://www.ponsoftware.com/en/
CVE: CVE-2010-3160
Published: 2010-10-25
Description: Untrusted search path vulnerability in Archive Decoder 1.23 and earlier allows local users to gain privileges via a Trojan horse executable file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://jvn.jp/en/jp/JVN68536660/index.html; http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000044.html; http://www.ponsoftware.com/en/
CVE: CVE-2010-3161
Published: 2010-10-25
Description: Untrusted search path vulnerability in TeraPad before 1.00 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://jvn.jp/en/jp/JVN48097065/index.html; http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000045.html; http://www5f.biglobe.ne.jp/~t-susumu/dl/tpad/History.txt
CVE: CVE-2010-3162
Published: 2010-10-25
Description: Untrusted search path vulnerability in Apsaly before 3.74 allows local users to gain privileges via a Trojan horse executable file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://jvn.jp/en/jp/JVN71138390/index.html; http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000046.html; http://www.venus.dti.ne.jp/mw31/apsaly/Vulnerability.html
CVE: CVE-2010-3163
Published: 2010-10-25
Description: Untrusted search path vulnerability in Fenrir Sleipnir before 2.9.5 and Grani before 4.4 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://jvn.jp/en/jp/JVN50610528/index.html; http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000047.html; http://www.fenrir.co.jp/blog/2010/10/sleipnirsleipnir_295.html
CVE: CVE-2010-3164
Published: 2010-10-25
Description: Untrusted search path vulnerability in Fenrir Sleipnir 2.9.4 and earlier and Grani 4.3 and earlier allows local users to gain privileges via a Trojan horse executable file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://jvn.jp/en/jp/JVN89272705/index.html; http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000048.html; http://www.fenrir.co.jp/blog/2010/10/sleipnirsleipnir_295.html
CVE: CVE-2010-3165
Published: 2010-10-25
Description: Untrusted search path vulnerability in Yokka NoEditor 1.33.1.1 and earlier, OuiEditor 1.6.1.1 and earlier, UnEditor 1.10.1.2 and earlier, DeuxEditor 1.7.1.2 and earlier, SQLEditorXP 3.14.1.2 and earlier, SQLEditorTE 1.9.1.3 and earlier, SQLEditor8 3.8.1.2 and earlier, and SQLEditorClassic 1.8.1.3 and earlier allows local users to gain privileges via a Trojan horse executable file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://jvn.jp/en/jp/JVN07497935/index.html; http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000049.html; http://jvn.jp/en/jp/JVN07497935/index.html
CVE: CVE-2010-3710
Published: 2010-10-25
Description: Stack consumption vulnerability in the filter_var function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://bugs.php.net/bug.php?id=52929; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html
CVE: CVE-2010-3714
Published: 2010-10-25
Description: The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://blog.nibblesec.org/2010/12/typo3-sa-2010-020-typo3-sa-2010-022.html; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-020/; http://www.debian.org/security/2010/dsa-2121
CVE: CVE-2010-3715
Published: 2010-10-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the RemoveXSS function, and allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (2) the backend.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-020/; http://www.debian.org/security/2010/dsa-2121; http://www.securityfocus.com/bid/43786
CVE: CVE-2010-3716
Published: 2010-10-25
Description: The be_user_creation task in TYPO3 4.2.x before 4.2.15 and 4.3.x before 4.3.7 allows remote authenticated users to gain privileges via a crafted POST request that creates a user account with arbitrary group memberships.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-020/; http://www.debian.org/security/2010/dsa-2121; http://www.securityfocus.com/bid/43786
CVE: CVE-2010-3717
Published: 2010-10-25
Description: The t3lib_div::validEmail function in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly restrict input to filter_var FILTER_VALIDATE_EMAIL operations in PHP, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string, a related issue to CVE-2010-3710.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-020/; http://www.debian.org/security/2010/dsa-2121; http://www.securityfocus.com/bid/43786
CVE: CVE-2010-4068
Published: 2010-10-25
Description: Unspecified vulnerability in the Extension Manager in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allows remote authenticated administrators to read and possibly modify arbitrary files via a crafted parameter, a different vulnerability than CVE-2010-3714.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-020/; http://www.debian.org/security/2010/dsa-2121; http://www.securityfocus.com/bid/43786
CVE: CVE-2010-4069
Published: 2010-10-25
Description: Stack-based buffer overflow in IBM Informix Dynamic Server (IDS) 7.x through 7.31, 9.x through 9.40, 10.00 before 10.00.xC10, 11.10 before 11.10.xC3, and 11.50 before 11.50.xC3 allows remote authenticated users to execute arbitrary code via long DBINFO keyword arguments in a SQL statement, aka idsdb00165017, idsdb00165019, idsdb00165021, idsdb00165022, and idsdb00165023.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/41914; http://www.osvdb.org/68707; http://www.vupen.com/english/advisories/2010/2735
CVE: CVE-2010-4070
Published: 2010-10-25
Description: Integer overflow in librpc.dll in portmap.exe (aka the ISM Portmapper service) in ISM before 2.20.TC1.117 in IBM Informix Dynamic Server (IDS) 7.x before 7.31.xD11, 9.x before 9.40.xC10, 10.00 before 10.00.xC8, and 11.10 before 11.10.xC2 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted parameter size, aka idsdb00146931, idsdb00146930, idsdb00146929, and idsdb00138308.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/41915; http://www.osvdb.org/68706; http://www.vupen.com/english/advisories/2010/2733
CVE: CVE-2010-3653
Published: 2010-10-26
Description: The Director module (dirapi.dll) in Adobe Shockwave Player before 11.5.9.615 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie with a crafted rcsL chunk containing a field whose value is used as a pointer offset, as exploited in the wild in October 2010. NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.abysssec.com/blog/2010/10/adobe-shockwave-player-rcsl-chunk-memory-corruption-0day/; http://www.adobe.com/support/security/bulletins/apsb10-25.html; http://www.exploit-db.com/exploits/15296
CVE: CVE-2010-3986
Published: 2010-10-26
Description: Unspecified vulnerability in HP Virtual Connect Enterprise Manager (VCEM) 6.0 and 6.1 allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4107&w=2; http://secunia.com/advisories/41926; http://www.securitytracker.com/id?1024631
CVE: CVE-2010-4094
Published: 2010-10-26
Description: The Tomcat server in IBM Rational Quality Manager and Rational Test Lab Manager has a default password for the ADMIN account, which makes it easier for remote attackers to execute arbitrary code by leveraging access to the manager role.  NOTE: this might overlap CVE-2009-3548.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://download4.boulder.ibm.com/sar/CMA/RAA/013m6/0/UpdateLog.txt; http://osvdb.org/69008; http://secunia.com/advisories/41784
CVE: CVE-2010-1693
Published: 2010-10-26
Description: openibd in OpenFabrics Enterprise Distribution (OFED) 1.5.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/ib_set_node_desc.sh temporary file.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59
References: http://lists.openfabrics.org/pipermail/ewg/2010-October/015886.html; http://secunia.com/advisories/41937; http://www.openwall.com/lists/oss-security/2010/10/22/1
CVE: CVE-2010-2584
Published: 2010-10-26
Description: The Upload method in the RealPage Module Upload ActiveX control in Realpage.dll 1.0.0.9 in RealPage Module ActiveX Controls does not properly restrict certain property values, which allows remote attackers to read arbitrary files via a filename in the SourceFile property in conjunction with an http URL in the DestURL property.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/41392; http://secunia.com/secunia_research/2010-118/; http://www.osvdb.org/68813
CVE: CVE-2010-2585
Published: 2010-10-26
Description: Multiple buffer overflows in the RealPage Module Upload ActiveX control in Realpage.dll 1.0.0.9 in RealPage Module ActiveX Controls allow remote attackers to execute arbitrary code via a long (1) DestURL or (2) SourceFile property value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/41392; http://secunia.com/secunia_research/2010-119/; http://www.osvdb.org/68814
CVE: CVE-2010-2885
Published: 2010-10-26
Description: Cross-site scripting (XSS) vulnerability in Adobe RoboHelp 7 and 8, and RoboHelp Server 7 and 8, allows remote attackers to inject arbitrary web script or HTML via vectors related to WebHelp generation with RoboHelp for Word.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41870; http://securitytracker.com/id?1024611; http://www.adobe.com/support/security/bulletins/apsb10-23.html
CVE: CVE-2010-2886
Published: 2010-10-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Adobe RoboHelp 7 and 8, and RoboHelp Server 7 and 8, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41870; http://securitytracker.com/id?1024611; http://www.adobe.com/support/security/bulletins/apsb10-23.html
CVE: CVE-2010-3491
Published: 2010-10-26
Description: The (1) ActiveMatrix Runtime and (2) ActiveMatrix Administrator components in TIBCO ActiveMatrix Service Grid before 2.3.1, ActiveMatrix Service Bus before 2.3.1, ActiveMatrix BusinessWorks Service Engine before 5.8.1, and ActiveMatrix Service Performance Manager before 1.3.2 do not properly handle JMX connections, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/41891; http://www.securityfocus.com/bid/44254; http://www.tibco.com/multimedia/activematrix_advisory_tcm8-12488.txt
CVE: CVE-2010-3985
Published: 2010-10-26
Description: Cross-site scripting (XSS) vulnerability in HP Operations Orchestration before 9.0, when Internet Explorer 6.0 is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02541822; http://osvdb.org/68906; http://secunia.com/advisories/41983
CVE: CVE-2010-4095
Published: 2010-10-26
Description: Directory traversal vulnerability in the FTP client in Serengeti Systems Incorporated Robo-FTP 3.7.3, and probably other versions before 3.7.5, allows remote FTP servers to write arbitrary files via a .. (dot dot) in a filename in a server response.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://kb.robo-ftp.com/change_log/show/77; http://secunia.com/advisories/41809; http://www.htbridge.ch/advisory/directory_traversal_vulnerability_in_robo_ftp.html
CVE: CVE-2010-3227
Published: 2010-10-26
Description: Stack-based buffer overflow in the UpdateFrameTitleForDocument method in the CFrameWnd class in mfc42.dll in the Microsoft Foundation Class (MFC) Library in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows context-dependent attackers to execute arbitrary code via a long window title that this library attempts to create at the request of an application, as demonstrated by the Trident PowerZip 7.2 Build 4010 application, aka "Windows MFC Document Title Updating Buffer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker/2010/20100705-%281%29; http://www.exploit-db.com/exploits/13921/; http://www.securitytracker.com/id?1024557