deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-4096
Published: 2010-10-27
Description: share/ma/keys_for_user in Monkeysphere 0.31 and 0.32 allows local users to execute arbitrary code via unknown manipulations related to the "monkeysphere-authentication keys-for-user" command.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/42067; http://web.monkeysphere.info/news/CVE-2010-4096/; https://lists.riseup.net/www/arc/monkeysphere/2010-10/msg00066.html
CVE: CVE-2010-4097
Published: 2010-10-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Aardvark Topsites PHP 5.2.0 and 5.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) mail, (2) title, (3) u, and (4) url parameters.  NOTE: the q parameter is already covered by CVE-2009-2302.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/514423/100/0/threaded; http://www.securityfocus.com/bid/44390; https://exchange.xforce.ibmcloud.com/vulnerabilities/62767
CVE: CVE-2010-4098
Published: 2010-10-27
Description: monotone before 0.48.1, when configured to allow remote commands, allows remote attackers to cause a denial of service (crash) via an empty argument to the mtn command.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050468.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050484.html; http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html
CVE: CVE-2010-4099
Published: 2010-10-27
Description: ess.pm in NitroSecurity NitroView ESM 8.4.0a, when ESSPMDebug is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the Request parameter to ess.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.exploit-db.com/exploits/15318; http://www.securityfocus.com/bid/44421; http://www.securitytracker.com/id?1024639
CVE: CVE-2010-2891
Published: 2010-10-28
Description: Buffer overflow in the smiGetNode function in lib/smi.c in libsmi 0.4.8 allows context-dependent attackers to execute arbitrary code via an Object Identifier (aka OID) represented as a numerical string containing many components separated by . (dot) characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/41841
CVE: CVE-2010-3711
Published: 2010-10-28
Description: libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://developer.pidgin.im/viewmtn/revision/info/b01c6a1f7fe4d86b83f5f10917b3cb713989cfcc; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050227.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050695.html
CVE: CVE-2010-3712
Published: 2010-10-28
Description: Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x before 1.5.21 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving "multiple encoded entities," as demonstrated by the query string to index.php in the com_weblinks or com_content component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/news/9-security/10-core-security/[PII_REDACTED]1-core-xss-vulnerabilities; http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_id=32&tracker_item_id=22767; http://www.openwall.com/lists/oss-security/2010/10/08/4
CVE: CVE-2010-3713
Published: 2010-10-28
Description: rss.php in UseBB before 1.0.11 does not properly handle forum configurations in which a user has the view permission but not the read permission, which allows remote attackers to bypass intended access restrictions by reading a forum feed in combination with a topic feed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2010/10/08/5; http://www.openwall.com/lists/oss-security/2010/10/11/5; http://www.usebb.net/community/topic-2495.html
CVE: CVE-2010-3765
Published: 2010-10-28
Description: Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-119
References: http://blog.mozilla.com/security/2010/10/26/critical-vulnerability-in-firefox-3-5-and-firefox-3-6/; http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://isc.sans.edu/diary.html?storyid=9817
CVE: CVE-2010-3842
Published: 2010-10-28
Description: Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \ (backslash) as a separator of path components within the Content-disposition HTTP header.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://curl.haxx.se/docs/adv_20101013.html; http://secunia.com/advisories/39532; http://securitytracker.com/id?1024583
CVE: CVE-2010-3933
Published: 2010-10-28
Description: Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/41930; http://securitytracker.com/id?1024624; http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0
CVE: CVE-2010-0112
Published: 2010-10-28
Description: Multiple SQL injection vulnerabilities in the Administrative Interface in the IIS extension in Symantec IM Manager before 8.4.16 allow remote attackers to execute arbitrary SQL commands via (1) the rdReport parameter to rdpageimlogic.aspx, related to the sGetDefinition function in rdServer.dll, and SQL statements contained within a certain report file; (2) unspecified parameters in a DetailReportGroup (aka DetailReportGroup.lgx) action to rdpageimlogic.aspx; the (3) selclause, (4) whereTrendTimeClause, (5) TrendTypeForReport, (6) whereProtocolClause, or (7) groupClause parameter in a SummaryReportGroup (aka SummaryReportGroup.lgx) action to rdpageimlogic.aspx; the (8) loginTimeStamp, (9) dbo, (10) dateDiffParam, or (11) whereClause parameter in a LoggedInUsers (aka LoggedInUSers.lgx) action to (a) rdpageimlogic.aspx or (b) rdPage.aspx; the (12) selclause, (13) whereTrendTimeClause, (14) TrendTypeForReport, (15) whereProtocolClause, or (16) groupClause parameter to rdpageimlogic.aspx; (17) the groupList parameter to IMAdminReportTrendFormRun.asp; or (18) the email parameter to IMAdminScheduleReport.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/68901; http://osvdb.org/68902; http://osvdb.org/68903
CVE: CVE-2010-3987
Published: 2010-10-28
Description: Cross-site scripting (XSS) vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6540&w=2; http://www.securitytracker.com/id?1024641; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6540&w=2
CVE: CVE-2010-3988
Published: 2010-10-28
Description: Unspecified vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to bypass intended access restrictions and cause a denial of service via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6540&w=2; http://www.securitytracker.com/id?1024641; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6540&w=2
CVE: CVE-2010-3989
Published: 2010-10-28
Description: Cross-site request forgery (CSRF) vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6540&w=2; http://www.securityfocus.com/bid/44435; http://www.securitytracker.com/id?1024641
CVE: CVE-2010-3990
Published: 2010-10-28
Description: Unspecified vulnerability in HP Virtual Server Environment before 6.2 allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5961&w=2; http://osvdb.org/68909; http://securitytracker.com/id?1024640
CVE: CVE-2010-3991
Published: 2010-10-28
Description: Cross-site scripting (XSS) vulnerability in HP Insight Control Server Migration before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7551&w=2; http://www.securityfocus.com/bid/44433; http://www.securitytracker.com/id?1024643
CVE: CVE-2010-3992
Published: 2010-10-28
Description: Unspecified vulnerability in HP Insight Control Server Migration before 6.2 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7551&w=2; http://www.securitytracker.com/id?1024643; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7551&w=2
CVE: CVE-2010-3993
Published: 2010-10-28
Description: Unspecified vulnerability in HP Insight Control Server Migration before 6.2 allows remote attackers to obtain sensitive information or modify data via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7551&w=2; http://www.securitytracker.com/id?1024643; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7551&w=2
CVE: CVE-2010-3994
Published: 2010-10-28
Description: Cross-site scripting (XSS) vulnerability in HP Version Control Repository Manager (VCRM) before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3086&w=2; http://osvdb.org/68907; http://secunia.com/advisories/41998
CVE: CVE-2010-4023
Published: 2010-10-28
Description: Cross-site scripting (XSS) vulnerability in HP Insight Control Power Management before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6943&w=2; http://www.securitytracker.com/id?1024642; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6943&w=2
CVE: CVE-2010-4024
Published: 2010-10-28
Description: Cross-site request forgery (CSRF) vulnerability in HP Insight Control Power Management before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6943&w=2; http://www.securitytracker.com/id?1024642; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6943&w=2
CVE: CVE-2010-4025
Published: 2010-10-28
Description: Unspecified vulnerability in Doc Viewer in HP Palm webOS 1.4.1 allows remote attackers to execute arbitrary code via a crafted document, as demonstrated by a Word document.
CVSS Score: 9.3 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1677&w=2; http://secunia.com/advisories/42023; http://www.securitytracker.com/id?1024656
CVE: CVE-2010-4026
Published: 2010-10-28
Description: Unspecified vulnerability in the service API in HP Palm webOS 1.4.1 allows local users to gain privileges by leveraging the ability to perform certain service calls.
CVSS Score: 6.2 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4237&w=2; http://secunia.com/advisories/42023; http://www.securitytracker.com/id?1024647
CVE: CVE-2010-4027
Published: 2010-10-28
Description: Unspecified vulnerability in the camera application in HP Palm webOS 1.4.1 allows local users to overwrite arbitrary files via unknown vectors.
CVSS Score: 5.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7721&w=2; http://secunia.com/advisories/42023; http://www.securitytracker.com/id?1024658
CVE: CVE-2010-4028
Published: 2010-10-28
Description: Unspecified vulnerability in LoadRunner Web Tours 9.10 in HP LoadRunner 9.1 and earlier allows remote attackers to cause a denial of service, and possibly obtain sensitive information or modify data, via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1749&w=2; http://www.securitytracker.com/id?1024657; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1749&w=2
CVE: CVE-2010-4029
Published: 2010-10-28
Description: Unspecified vulnerability in HP Storage Essentials before 6.3.0, when LDAP authentication is enabled, allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0873&w=2; http://osvdb.org/68923; http://secunia.com/advisories/42022
CVE: CVE-2010-4120
Published: 2010-10-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in the TAM console in IBM Tivoli Access Manager for e-business 6.1.0 before 6.1.0-TIV-TAM-FP0006 allow remote attackers to inject arbitrary web script or HTML via (1) the parm1 parameter to ivt/ivtserver, or the method parameter to (2) acl, (3) domain, (4) group, (5) gso, (6) gsogroup, (7) os, (8) pop, (9) rule, (10) user, or (11) webseal in ibm/wpm/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/68884; http://osvdb.org/68885; http://osvdb.org/68886
CVE: CVE-2010-4121
Published: 2010-10-28
Description: The TCP-to-ODBC gateway in IBM Tivoli Provisioning Manager for OS Deployment 7.1.1.3 does not require authentication for SQL statements, which allows remote attackers to modify, create, or read database records via a session on TCP port 2020.  NOTE: the vendor disputes this issue, stating that the "default Microsoft Access database is not password protected because it is intended to be used for evaluation purposes only.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://publib.boulder.ibm.com/infocenter/tivihelp/v3r1/index.jsp?topic=%2Fcom.ibm.tivoli.tpm.osd.doc%2Finstall%2Ftosd_setmsacessdbpwd.html; http://securitytracker.com/id?1024539; http://www.zerodayinitiative.com/advisories/ZDI-10-194
CVE: CVE-2010-2581
Published: 2010-10-29
Description: dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director file containing a crafted pamm chunk with an invalid (1) size and (2) number of sub-chunks, a different vulnerability than CVE-2010-4084, CVE-2010-4085, CVE-2010-4086, and CVE-2010-4088.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/secunia_research/2010-113/; http://www.adobe.com/support/security/bulletins/apsb10-25.html; http://www.securityfocus.com/archive/1/514559/100/0/threaded
CVE: CVE-2010-2582
Published: 2010-10-29
Description: An unspecified function in TextXtra.x32 in Adobe Shockwave Player before 11.5.9.615 does not properly reallocate a buffer when processing a DEMX chunk in a Director file, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/secunia_research/2010-114/; http://www.adobe.com/support/security/bulletins/apsb10-25.html; http://www.securityfocus.com/archive/1/514560/100/0/threaded
CVE: CVE-2010-3036
Published: 2010-10-29
Description: Multiple buffer overflows in the authentication functionality in the web-server module in Cisco CiscoWorks Common Services before 4.0 allow remote attackers to execute arbitrary code via a session on TCP port (1) 443 or (2) 1741, aka Bug ID CSCti41352.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/68927; http://secunia.com/advisories/42011; http://securitytracker.com/id?1024646
CVE: CVE-2010-3654
Published: 2010-10-29
Description: Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted SWF content, as exploited in the wild in October 2010.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1; http://contagiodump.blogspot.com/2010/10/potential-new-adobe-flash-player-zero.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
CVE: CVE-2010-3655
Published: 2010-10-29
Description: Stack-based buffer overflow in dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb10-25.html; http://www.securitytracker.com/id?1024664; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12077
CVE: CVE-2010-3700
Published: 2010-10-29
Description: VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/68931; http://secunia.com/advisories/42024; http://www.securityfocus.com/archive/1/514517/100/0/threaded
CVE: CVE-2010-4084
Published: 2010-10-29
Description: dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2581, CVE-2010-4085, CVE-2010-4086, and CVE-2010-4088.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb10-25.html; http://www.securitytracker.com/id?1024664; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12265
CVE: CVE-2010-4085
Published: 2010-10-29
Description: dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2581, CVE-2010-4084, CVE-2010-4086, and CVE-2010-4088.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb10-25.html; http://www.securitytracker.com/id?1024664; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11518
CVE: CVE-2010-4086
Published: 2010-10-29
Description: dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Director (.dir) media file with an invalid element size, a different vulnerability than CVE-2010-2581, CVE-2010-2880, CVE-2010-4084, CVE-2010-4085, and CVE-2010-4088.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb10-25.html; http://www.securityfocus.com/archive/1/514578/100/0/threaded; http://www.securitytracker.com/id?1024664
CVE: CVE-2010-4087
Published: 2010-10-29
Description: IML32.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a .dir file with a crafted mmap record containing an invalid length of a VSWV entry, a different vulnerability than CVE-2010-4089.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb10-25.html; http://www.securityfocus.com/archive/1/514581/100/0/threaded; http://www.securitytracker.com/id?1024664
CVE: CVE-2010-4088
Published: 2010-10-29
Description: dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a .dir file with "duplicated references to the same KEY* chunk," a different vulnerability than CVE-2010-2581, CVE-2010-4084, CVE-2010-4085, and CVE-2010-4086.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb10-25.html; http://www.securityfocus.com/archive/1/514580/100/0/threaded; http://www.securitytracker.com/id?1024664
CVE: CVE-2010-4089
Published: 2010-10-29
Description: IML32.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a .dir file containing "duplicated LCSM entries in mmap record," a different vulnerability than CVE-2010-4087.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb10-25.html; http://www.securityfocus.com/archive/1/514582/100/0/threaded; http://www.securitytracker.com/id?1024664
CVE: CVE-2010-4090
Published: 2010-10-29
Description: Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb10-25.html; http://www.securitytracker.com/id?1024664; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12199
CVE: CVE-2010-4143
Published: 2010-11-02
Description: SQL injection vulnerability in chart.php in phpCheckZ 1.1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/15284; http://www.exploit-db.com/exploits/15284
CVE: CVE-2010-4144
Published: 2010-11-02
Description: SQL injection vulnerability in radyo.asp in Kisisel Radyo Script allows remote attackers to execute arbitrary SQL commands via the Id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1010-exploits/kisiselradyoscript-disclose.txt; http://secunia.com/advisories/41816; http://www.exploit-db.com/exploits/15270
CVE: CVE-2010-4145
Published: 2010-11-02
Description: Kisisel Radyo Script stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for sevvo/eco23.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.org/1010-exploits/kisiselradyoscript-disclose.txt; http://secunia.com/advisories/41816; http://www.exploit-db.com/exploits/15270
CVE: CVE-2010-4146
Published: 2010-11-02
Description: Cross-site scripting (XSS) vulnerability in Attachmate Reflection for the Web 2008 R2 (builds 10.1.569 and earlier), 2008 R1, and 9.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/68637; http://secunia.com/advisories/41869; http://support.attachmate.com/techdocs/1704.html
CVE: CVE-2010-4147
Published: 2010-11-02
Description: Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header to (1) index.php and (2) product-list.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://holisticinfosec.org/content/view/159/45/; http://secunia.com/advisories/41764; http://www.avactis.com/forums/index.php?showtopic=5317