deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-0789
Published: 2010-03-02
Description: fusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local users to unmount an arbitrary FUSE filesystem share via a symlink attack on a mountpoint.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567633; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034518.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034580.html
CVE: CVE-2010-0726
Published: 2010-03-02
Description: Cross-site scripting (XSS) vulnerability in the tb-send.rb (TrackBack transmission) plugin in tDiary 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly related to the (1) plugin_tb_url and (2) plugin_tb_excerpt parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN73331060/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2010-000005; http://osvdb.org/62562
CVE: CVE-2010-0795
Published: 2010-03-02
Description: SQL injection vulnerability in the JE Event Calendars (com_jeeventcalendar) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the event_id parameter in an event action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62038; http://secunia.com/advisories/38408; http://www.exploit-db.com/exploits/11292
CVE: CVE-2010-0796
Published: 2010-03-02
Description: SQL injection vulnerability in the JE Quiz (com_jequizmanagement) component 1.b01 for Joomla! allows remote attackers to execute arbitrary SQL commands via the eid parameter in a question action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62039; http://packetstormsecurity.org/1001-exploits/joomlajequiz-sql.txt; http://secunia.com/advisories/38412
CVE: CVE-2010-0797
Published: 2010-03-02
Description: Cross-site scripting (XSS) vulnerability in the T3BLOG extension 0.6.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38388; http://typo3.org/extensions/repository/view/t3blog/0.8.0/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-002/
CVE: CVE-2010-0798
Published: 2010-03-02
Description: SQL injection vulnerability in the T3BLOG extension 0.6.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/38388; http://typo3.org/extensions/repository/view/t3blog/0.8.0/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-002/
CVE: CVE-2010-0799
Published: 2010-03-02
Description: Directory traversal vulnerability in misc/tell_a_friend/tell.php in phpunity.newsmanager allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/62036; http://packetstormsecurity.org/1001-exploits/phpunity-lfi.txt; http://secunia.com/advisories/38409
CVE: CVE-2010-0800
Published: 2010-03-02
Description: SQL injection vulnerability in the Ossolution Team Documents Seller (aka DMS) (com_dms) component 2.5.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a view_category action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62040; http://secunia.com/advisories/38410; http://www.exploit-db.com/exploits/11289
CVE: CVE-2010-0801
Published: 2010-03-02
Description: Directory traversal vulnerability in the AutartiTarot (com_autartitarot) component 1.0.3 for Joomla! allows remote authenticated users, with "Public Back-end" group permissions, to read arbitrary files via directory traversal sequences in the controller parameter in an edit task to administrator/index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: http://osvdb.org/62041; http://packetstormsecurity.org/1001-exploits/joomlaautartitarot-traversal.txt; http://secunia.com/advisories/38434
CVE: CVE-2010-0802
Published: 2010-03-02
Description: SQL injection vulnerability in index.php in (nv2) Awards 1.1.0, a modification for Invision Power Board, allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1001-exploits/ipbawards-sql.txt; http://secunia.com/advisories/38407; http://www.exploit-db.com/exploits/11297
CVE: CVE-2010-0803
Published: 2010-03-02
Description: SQL injection vulnerability in the jVideoDirect (com_jvideodirect) component 1.1 RC3b for Joomla! allows remote attackers to execute arbitrary SQL commands via the v parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62042; http://packetstormsecurity.org/1001-exploits/joomlajvideodirect-sql.txt; http://secunia.com/advisories/38436
CVE: CVE-2010-0804
Published: 2010-03-02
Description: Cross-site scripting (XSS) vulnerability in index.php in iBoutique 4.0 allows remote attackers to inject arbitrary web script or HTML via the key parameter in a products action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1001-exploits/iboutique-xss.txt; http://secunia.com/advisories/31871; http://www.securityfocus.com/archive/1/509126/100/0/threaded
CVE: CVE-2010-0156
Published: 2010-03-03
Description: Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://groups.google.com/group/puppet-announce/browse_thread/thread/4401823f6cbf6087; http://groups.google.com/group/puppet-announce/browse_thread/thread/73cd1b2896d986c2; http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036083.html
CVE: CVE-2010-0205
Published: 2010-03-03
Description: The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: http://libpng.sourceforge.net/ADVISORY-1.4.1.html; http://libpng.sourceforge.net/decompression_bombs.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
CVE: CVE-2010-0483
Published: 2010-03-03
Description: vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, allows user-assisted remote attackers to execute arbitrary code by referencing a (1) local pathname, (2) UNC share pathname, or (3) WebDAV server with a crafted .hlp file in the fourth argument (aka helpfile argument) to the MsgBox function, leading to code execution involving winhlp32.exe when the F1 key is pressed, aka "VBScript Help Keypress Vulnerability."
CVSS Score: 7.6 (HIGH)
CWE: CWE-94
References: http://blogs.technet.com/msrc/archive/2010/02/28/investigating-a-new-win32hlp-and-internet-explorer-issue.aspx; http://blogs.technet.com/msrc/archive/2010/03/01/security-advisory-981169-released.aspx; http://blogs.technet.com/srd/archive/2010/03/01/help-keypress-vulnerability-in-vbscript-enabling-remote-code-execution.aspx
CVE: CVE-2010-0766
Published: 2010-03-03
Description: Integer overflow in the Swap4 function in valet4.dll in Luxology Modo 401 allows user-assisted remote attackers to execute arbitrary code via a .LXO file containing a CHNL subchunk associated with an invalid length.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://osvdb.org/62669; http://secunia.com/advisories/38784; http://www.coresecurity.com/content/luxology-modo-lxo-vulnerability
CVE: CVE-2010-0917
Published: 2010-03-03
Description: Stack-based buffer overflow in VBScript in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, might allow user-assisted remote attackers to execute arbitrary code via a long string in the fourth argument (aka helpfile argument) to the MsgBox function, leading to code execution when the F1 key is pressed, a different vulnerability than CVE-2010-0483.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://blogs.technet.com/msrc/archive/2010/03/01/security-advisory-981169-released.aspx; http://isec.pl/vulnerabilities/isec-0027-msgbox-helpfile-ie.txt; http://isec.pl/vulnerabilities10.html
CVE: CVE-2010-0918
Published: 2010-03-03
Description: Multiple unspecified vulnerabilities in the UltraLite functionality in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg27018109; http://www.securityfocus.com/bid/38459; http://www.vupen.com/english/advisories/2010/0496
CVE: CVE-2010-0919
Published: 2010-03-03
Description: Stack-based buffer overflow in the Lotus Domino Web Access ActiveX control in IBM Lotus iNotes (aka Domino Web Access or DWA) 6.5, 7.0 before 7.0.4, 8.0, 8.0.2, and before 229.281 for Domino 8.0.2 FP4 allows remote attackers to execute arbitrary code via a long URL argument to an unspecified method, aka PRAD7JTNHJ.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=857; http://secunia.com/advisories/38681; http://secunia.com/advisories/38744
CVE: CVE-2010-0920
Published: 2010-03-03
Description: Cross-site scripting (XSS) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 allows remote attackers to inject arbitrary web script or HTML via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg27018109; http://www.securityfocus.com/bid/38459; http://www.vupen.com/english/advisories/2010/0496
CVE: CVE-2010-0921
Published: 2010-03-03
Description: Cross-site request forgery (CSRF) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 allows remote attackers to hijack the authentication of unspecified victims via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg27018109; http://www.securityfocus.com/bid/38459; http://www.vupen.com/english/advisories/2010/0496
CVE: CVE-2010-0922
Published: 2010-03-03
Description: Unspecified vulnerability in secldapclntd in IBM AIX 5.3 with SP 5300-11-02 allows attackers to cause a denial of service (LDAP login failure) via unknown vectors.  NOTE: some of these details are obtained from third party information.  NOTE: there may be no attacker role, and the issue may be triggered entirely by an administrator's installation of an official service pack.
CVSS Score: 7.8 (HIGH)
References: ftp://public.dhe.ibm.com/aix/efixes/iz69977/README.txt; http://www.ibm.com/support/docview.wss?uid=isg1IZ69977; http://www.securityfocus.com/bid/38444
CVE: CVE-2010-0923
Published: 2010-03-03
Description: Race condition in workspace/krunner/lock/lockdlg.cc in the KRunner lock module in kdebase in KDE SC 4.4.0 allows physically proximate attackers to bypass KScreenSaver screen locking and access an unattended workstation by pressing the Enter key at a certain time, related to multiple forked processes.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://bugs.kde.org/show_bug.cgi?id=226449; http://marc.info/?l=oss-security&m=[PII_REDACTED]2670&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]4401&w=2
CVE: CVE-2010-0924
Published: 2010-03-03
Description: cfnetwork.dll 1.450.5.0 in CFNetwork, as used by safari.exe 531.21.10 in Apple Safari 4.0.3 and 4.0.4 on Windows, allows remote attackers to cause a denial of service (application crash) via a long string in the BACKGROUND attribute of a BODY element.
CVSS Score: 5.0 (MEDIUM)
References: http://nobytes.com/exploits/Safari_4.0.4_background_DoS_pl.txt; http://www.securityfocus.com/bid/38447; http://nobytes.com/exploits/Safari_4.0.4_background_DoS_pl.txt
CVE: CVE-2010-0925
Published: 2010-03-03
Description: cfnetwork.dll 1.450.5.0 in CFNetwork, as used by safari.exe 531.21.10 in Apple Safari 4.0.4 on Windows, allows remote attackers to cause a denial of service (application crash) via a long string in the SRC attribute of a (1) IMG or (2) IFRAME element.
CVSS Score: 5.0 (MEDIUM)
References: http://nobytes.com/exploits/Safari_4.0.4_background_DoS_pl.txt; http://nobytes.com/exploits/Safari_4.0.4_background_DoS_pl.txt
CVE: CVE-2009-4656
Published: 2010-03-03
Description: Stack-based buffer overflow in E-Soft DJ Studio Pro 4.2 including 4.2.2.7.5, and 5.x including 5.1.4.3.1, allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a playlist file (.pls) containing a long string.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/36728; http://www.exploit-db.com/exploits/9691; http://www.vupen.com/english/advisories/2009/2681
CVE: CVE-2009-4657
Published: 2010-03-03
Description: The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter application settings by connecting to the application on port 32123, as demonstrated by setting the action option to wizardStep1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.exploit-db.com/exploits/9717; http://www.securityfocus.com/bid/36454; http://www.exploit-db.com/exploits/9717
CVE: CVE-2009-4658
Published: 2010-03-03
Description: Xerver 4.32 allows remote authenticated users to cause a denial of service (daemon crash) via a non-numeric web port assignment in the management interface.  NOTE: this can be leveraged by non-authenticated attackers using CVE-2009-4657.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www.exploit-db.com/exploits/9717; https://exchange.xforce.ibmcloud.com/vulnerabilities/53351; http://www.exploit-db.com/exploits/9717
CVE: CVE-2009-4659
Published: 2010-03-03
Description: Unspecified vulnerability in MP3-Cutter Ease Audio Cutter 1.20 allows user-assisted remote attackers to cause a denial of service (application crash) via a long string in a WAV file.
CVSS Score: 4.3 (MEDIUM)
References: http://www.exploit-db.com/exploits/9707; https://exchange.xforce.ibmcloud.com/vulnerabilities/53333; http://www.exploit-db.com/exploits/9707
CVE: CVE-2009-4660
Published: 2010-03-03
Description: Stack-based buffer overflow in the AntServer Module (AntServer.exe) in BigAnt IM Server 2.50 allows remote attackers to execute arbitrary code via a long GET request to TCP port 6660.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/36704; http://www.attrition.org/pipermail/vim/2009-September/002271.html; http://www.exploit-db.com/exploits/9673
CVE: CVE-2009-4661
Published: 2010-03-03
Description: Multiple buffer overflows in BigAnt Server 2.50 SP6 and earlier allow user-assisted remote attackers to cause a denial of service (application crash) via a crafted ZIP file that is not properly handled when the victim uses the (1) Update or (2) Plug-In console menu item.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9695; http://www.exploit-db.com/exploits/9734; http://www.exploit-db.com/exploits/9695
CVE: CVE-2009-4662
Published: 2010-03-03
Description: Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 7.0 before 7.03 HP4 and 8.0 before 8.0 SP1 allows remote attackers to inject arbitrary web script or HTML via the User.Theme.index parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/36746; http://www.novell.com/support/viewContent.do?externalId=7004410&sliceId=1; http://www.securityfocus.com/bid/36437
CVE: CVE-2009-4663
Published: 2010-03-03
Description: Heap-based buffer overflow in the Quiksoft EasyMail Objects 6 ActiveX control allows remote attackers to execute arbitrary code via a long argument to the AddAttachment method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0220.html; http://www.bmgsec.com.au/advisories/easymail-6-activex-exploit.txt; http://www.exploit-db.com/exploits/9705
CVE: CVE-2009-4664
Published: 2010-03-03
Description: Firewall Builder 3.0.4, 3.0.5, and 3.0.6, when running on Linux, allows local users to gain privileges via a symlink attack on an unspecified temporary file that is created by the iptables script.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://blog.fwbuilder.org/2009/09/firewall-builder-v307-released.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035112.html; http://osvdb.org/58247
CVE: CVE-2009-2753
Published: 2010-03-05
Description: Multiple buffer overflows in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3, allow remote attackers to execute arbitrary code via a crafted parameter size.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38731; http://securitytracker.com/id?1023669; http://www.ibm.com/support/docview.wss?uid=swg1IC55329
CVE: CVE-2009-2754
Published: 2010-03-05
Description: Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 and EMC Legato NetWorker, allows remote attackers to execute arbitrary code via a crafted parameter size that triggers a stack-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://knowledgebase.emc.com/emcice/login.do?sType=ax1990&sName=1204&id=emc183834; http://secunia.com/advisories/38731; http://www.ibm.com/support/docview.wss?uid=swg1IC55329
CVE: CVE-2010-0408
Published: 2010-03-05
Description: The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.
CVSS Score: 5.0 (MEDIUM)
References: http://httpd.apache.org/security/vulnerabilities_22.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html
CVE: CVE-2010-0419
Published: 2010-03-05
Description: The x86 emulator in KVM 83, when a guest is configured for Symmetric Multiprocessing (SMP), does not properly restrict writing of segment selectors to segment registers, which might allow guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, and replacing an instruction in between emulator entry and instruction fetch.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://securitytracker.com/id?1023663; http://www.redhat.com/support/errata/RHSA-2010-0126.html; http://www.securityfocus.com/bid/38467
CVE: CVE-2010-0587
Published: 2010-03-05
Description: Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x before 4.3(2)SR2, 6.x before 6.1(5), 7.x before 7.1(3a)su1, and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SCCP StationCapabilitiesRes message with an invalid MaxCap field, aka Bug ID CSCtc38985.
CVSS Score: 7.8 (HIGH)
References: http://securitytracker.com/id?1023670; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1b924.shtml; http://www.securityfocus.com/bid/38496
CVE: CVE-2010-0588
Published: 2010-03-05
Description: Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5), 7.x before 7.1(3a)su1, and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SCCP (1) RegAvailableLines or (2) FwdStatReq message with an invalid Line number, aka Bug ID CSCtc47823.
CVSS Score: 7.8 (HIGH)
References: http://securitytracker.com/id?1023670; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1b924.shtml; http://www.securityfocus.com/bid/38501
CVE: CVE-2010-0590
Published: 2010-03-05
Description: The CMSIPUtility component in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 7.x before 7.1(3a)su1 and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SIP Register message, aka Bug ID CSCtc37188.
CVSS Score: 7.8 (HIGH)
References: http://securitytracker.com/id?1023670; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1b924.shtml; http://www.securityfocus.com/bid/38495
CVE: CVE-2010-0591
Published: 2010-03-05
Description: Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5), 7.x before 7.1(3b)SU2, and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SIP REG message, related to an overflow of the Telephone-URL field, aka Bug ID CSCtc62362.
CVSS Score: 7.8 (HIGH)
References: http://securitytracker.com/id?1023670; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1b924.shtml; http://www.securityfocus.com/bid/38498
CVE: CVE-2010-0592
Published: 2010-03-05
Description: The CTI Manager service in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x before 4.3(2)sr1a, 6.x before 6.1(3), 7.0x before 7.0(2), 7.1x before 7.1(2), and 8.x before 8.0(1) allows remote attackers to cause a denial of service (service failure) via a malformed message, aka Bug ID CSCsu31800.
CVSS Score: 7.8 (HIGH)
References: http://securitytracker.com/id?1023670; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1b924.shtml; http://www.securityfocus.com/bid/38497
CVE: CVE-2010-0927
Published: 2010-03-05
Description: Cross-site scripting (XSS) vulnerability in help/readme.nsf/Header in the Help component in IBM Lotus Domino 7.x before 7.0.4 and 8.x before 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the BaseTarget parameter in an OpenPage action.  NOTE: this may overlap CVE-2010-0920.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.cybsec.com/vuln/CYBSEC_Advisory_2010_0301_IBM_%20Lotus_Dominio_Readme_nsf_Reflected_XSS.pdf; http://www.securityfocus.com/bid/38481; http://www.cybsec.com/vuln/CYBSEC_Advisory_2010_0301_IBM_%20Lotus_Dominio_Readme_nsf_Reflected_XSS.pdf
CVE: CVE-2009-4665
Published: 2010-03-05
Description: Directory traversal vulnerability in CuteSoft_Client/CuteEditor/Load.ashx in CuteSoft Components Cute Editor for ASP.NET allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/8785; http://www.securityfocus.com/bid/35085; https://exchange.xforce.ibmcloud.com/vulnerabilities/50727