deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-0657
Published: 2010-02-18
Description: Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument in a desktop shortcut, which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.
CVSS Score: 9.3 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=23693; http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html; http://securitytracker.com/id?1023506
CVE: CVE-2010-0658
Published: 2010-02-18
Description: Multiple integer overflows in Skia, as used in Google Chrome before 4.0.249.78, allow remote attackers to execute arbitrary code in the Chrome sandbox or cause a denial of service (memory corruption and application crash) via vectors involving CANVAS elements.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://code.google.com/p/chromium/issues/detail?id=24071; http://code.google.com/p/chromium/issues/detail?id=24646; http://code.google.com/p/chromium/issues/detail?id=8864
CVE: CVE-2010-0659
Published: 2010-02-18
Description: The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not properly handle a failure of memory allocation, which allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed GIF file that specifies a large size.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=28566; http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-0660
Published: 2010-02-18
Description: Google Chrome before 4.0.249.78 sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=29920; http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html; http://securitytracker.com/id?1023506
CVE: CVE-2010-0661
Published: 2010-02-18
Description: WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp in WebKit before r52401, as used in Google Chrome before 4.0.249.78, allows remote attackers to bypass the Same Origin Policy via vectors involving the window.open method.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://code.google.com/p/chromium/issues/detail?id=30660; http://flock.com/security/; http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html
CVE: CVE-2010-0662
Published: 2010-02-18
Description: The ParamTraits<SkBitmap>::Read function in common/common_param_traits.cc in Google Chrome before 4.0.249.78 does not use the correct variables in calculations designed to prevent integer overflows, which allows attackers to leverage renderer access to cause a denial of service or possibly have unspecified other impact via bitmap data, related to deserialization.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://code.google.com/p/chromium/issues/detail?id=31307; http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html; http://securitytracker.com/id?1023506
CVE: CVE-2010-0663
Published: 2010-02-18
Description: The ParamTraits<SkBitmap>::Read function in common/common_param_traits.cc in Google Chrome before 4.0.249.78 does not initialize the memory locations that will hold bitmap data, which might allow remote attackers to obtain potentially sensitive information from process memory by providing insufficient data, related to use of a (1) thumbnail database or (2) HTML canvas.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=31307; http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html; http://securitytracker.com/id?1023506
CVE: CVE-2010-0664
Published: 2010-02-18
Description: Stack consumption vulnerability in the ChildProcessSecurityPolicy::CanRequestURL function in browser/child_process_security_policy.cc in Google Chrome before 4.0.249.78 allows remote attackers to cause a denial of service (memory consumption and application crash) via a URL that specifies multiple protocols, as demonstrated by a URL that begins with many repetitions of the view-source: substring.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=31517; http://exchange.kg/other/chrome3_0day-denial_of_service_crash.html; http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html
CVE: CVE-2010-0416
Published: 2010-02-18
Description: Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a URL argument containing a % (percent) character that is not followed by two hex digits.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.helixcommunity.org/pipermail/common-cvs/2007-July/014956.html; http://secunia.com/advisories/38450; http://www.redhat.com/support/errata/RHSA-2010-0094.html
CVE: CVE-2010-0417
Published: 2010-02-18
Description: Buffer overflow in common/util/rlstate.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a RuleBook structure with a large number of rule-separator characters that trigger heap memory corruption.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.helixcommunity.org/pipermail/common-cvs/2008-January/015484.html; http://secunia.com/advisories/38450; http://www.redhat.com/support/errata/RHSA-2010-0094.html
CVE: CVE-2009-4644
Published: 2010-02-19
Description: Accellion Secure File Transfer Appliance before 8_0_105 allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command, as demonstrated by modifying the cli program.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: http://www.portcullis-security.com/338.php; http://www.securityfocus.com/bid/38176; https://exchange.xforce.ibmcloud.com/vulnerabilities/56248
CVE: CVE-2009-4645
Published: 2010-02-19
Description: Directory traversal vulnerability in web_client_user_guide.html in Accellion Secure File Transfer Appliance before 8_0_105 allows remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/38538; http://www.portcullis-security.com/340.php; http://www.securityfocus.com/bid/38176
CVE: CVE-2009-4646
Published: 2010-02-19
Description: Static code injection vulnerability in the administrative web interface in Accellion Secure File Transfer Appliance allows remote authenticated administrators to inject arbitrary shell commands by appending them to a request to update the SNMP public community string.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/38538; http://www.portcullis-security.com/339.php; http://secunia.com/advisories/38538
CVE: CVE-2009-4647
Published: 2010-02-19
Description: Cross-site scripting (XSS) vulnerability in Accellion Secure File Transfer Appliance before 7_0_296 allows remote attackers to inject arbitrary web script or HTML via the username parameter, which is not properly handled when the administrator views audit logs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38522; http://www.portcullis-security.com/339.php; http://www.securityfocus.com/bid/38176
CVE: CVE-2009-4648
Published: 2010-02-19
Description: Accellion Secure File Transfer Appliance before 8_0_105 does not properly restrict access to sensitive commands and arguments that run with extra sudo privileges, which allows local administrators to gain privileges via (1) arbitrary arguments in the --file_move action in /usr/local/bin/admin.pl, or a hard link attack in (2) chmod or (3) a certain cp command.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.portcullis-security.com/338.php; http://www.securityfocus.com/bid/38176; https://exchange.xforce.ibmcloud.com/vulnerabilities/56248
CVE: CVE-2010-0106
Published: 2010-02-19
Description: The on-demand scanning in Symantec AntiVirus 10.0.x and 10.1.x before MR9, AntiVirus 10.2.x, and Client Security 3.0.x and 3.1.x before MR9, when Tamper protection is disabled, allows remote attackers to cause a denial of service (prevention of on-demand scanning) via "specific events" that prevent the user from having read access to unspecified resources.
CVSS Score: 1.9 (LOW)
References: http://osvdb.org/62414; http://secunia.com/advisories/38653; http://www.securityfocus.com/bid/38219
CVE: CVE-2010-0108
Published: 2010-02-19
Description: Buffer overflow in the cliproxy.objects.1 ActiveX control in the Symantec Client Proxy (CLIproxy.dll) in Symantec AntiVirus 10.0.x, 10.1.x before MR9, and 10.2.x before MR4; and Symantec Client Security 3.0.x and 3.1.x before MR9 allows remote attackers to execute arbitrary code via a long argument to the SetRemoteComputerName function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://dsecrg.com/pages/vul/show.php?id=139; http://secunia.com/advisories/38651; http://www.securityfocus.com/archive/1/509681/100/0/threaded
CVE: CVE-2010-0149
Published: 2010-02-19
Description: Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.2 before 7.2(4.46), 8.0 before 8.0(4.38), 8.1 before 8.1(2.29), and 8.2 before 8.2(1.5); and Cisco PIX 500 Series Security Appliance; allows remote attackers to cause a denial of service (prevention of new connections) via crafted TCP segments during termination of the TCP connection that cause the connection to remain in CLOSEWAIT status, aka "TCP Connection Exhaustion Denial of Service Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/62433; http://secunia.com/advisories/38618; http://secunia.com/advisories/38636
CVE: CVE-2010-0150
Published: 2010-02-19
Description: Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.0 before 7.0(8.10), 7.2 before 7.2(4.45), 8.0 before 8.0(5.2), 8.1 before 8.1(2.37), and 8.2 before 8.2(1.16); and Cisco PIX 500 Series Security Appliance; allows remote attackers to cause a denial of service (device reload) via malformed SIP messages, aka Bug ID CSCsy91157.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/62434; http://secunia.com/advisories/38618; http://secunia.com/advisories/38636
CVE: CVE-2010-0151
Published: 2010-02-19
Description: The Cisco Firewall Services Module (FWSM) 4.0 before 4.0(8), as used in for the Cisco Catalyst 6500 switches, Cisco 7600 routers, and ASA 5500 Adaptive Security Appliances, allows remote attackers to cause a denial of service (crash) via a malformed Skinny Client Control Protocol (SCCP) message.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/62432; http://secunia.com/advisories/38621; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1910c.shtml
CVE: CVE-2010-0565
Published: 2010-02-19
Description: Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.2 before 7.2(4.45), 8.0 before 8.0(4.44), 8.1 before 8.1(2.35), and 8.2 before 8.2(1.10), allows remote attackers to cause a denial of service (page fault and device reload) via a malformed DTLS message, aka Bug ID CSCtb64913 and "WebVPN DTLS Denial of Service Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/62430; http://secunia.com/advisories/38618; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1910c.shtml
CVE: CVE-2010-0566
Published: 2010-02-19
Description: Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.0 before 7.0(8.10), 7.2 before 7.2(4.45), 8.0 before 8.0(4.44), 8.1 before 8.1(2.35), and 8.2 before 8.2(1.10) allows remote attackers to cause a denial of service (device reload) via a malformed TCP segment when certain NAT translation and Cisco AIP-SSM configurations are used, aka Bug ID CSCtb37219.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/62431; http://secunia.com/advisories/38618; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1910c.shtml
CVE: CVE-2010-0567
Published: 2010-02-19
Description: Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.0 before 7.0(8.10), 7.2 before 7.2(4.45), 8.0 before 8.0(5.1), 8.1 before 8.1(2.37), and 8.2 before 8.2(1.15); and Cisco PIX 500 Series Security Appliance; allows remote attackers to cause a denial of service (active IPsec tunnel loss and prevention of new tunnels) via a malformed IKE message through an existing tunnel to UDP port 4500, aka Bug ID CSCtc47782.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/62436; http://secunia.com/advisories/38618; http://secunia.com/advisories/38636
CVE: CVE-2010-0568
Published: 2010-02-19
Description: Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.0 before 7.0(8.10), 7.2 before 7.2(4.45), 8.0 before 8.0(5.7), 8.1 before 8.1(2.40), and 8.2 before 8.2(2.1); and Cisco PIX 500 Series Security Appliance; allows remote attackers to bypass NTLMv1 authentication via a crafted username, aka Bug ID CSCte21953.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/62437; http://secunia.com/advisories/38618; http://secunia.com/advisories/38636
CVE: CVE-2010-0569
Published: 2010-02-19
Description: Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.0 before 7.0(8.10), 7.2 before 7.2(4.45), 8.0 before 8.0(5.2), 8.1 before 8.1(2.37), and 8.2 before 8.2(1.16); and Cisco PIX 500 Series Security Appliance; allows remote attackers to cause a denial of service (device reload) via malformed SIP messages, aka Bug ID CSCtc96018.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/62435; http://secunia.com/advisories/38618; http://secunia.com/advisories/38636
CVE: CVE-2010-0665
Published: 2010-02-19
Description: JAG (Just Another Guestbook) 1.14 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request for jag/database.sql.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/11406; https://exchange.xforce.ibmcloud.com/vulnerabilities/56228; http://www.exploit-db.com/exploits/11406
CVE: CVE-2010-0666
Published: 2010-02-19
Description: Unspecified vulnerability in eMBox in Novell eDirectory 8.8 SP5 Patch 2 and earlier allows remote attackers to cause a denial of service (crash) via unknown a crafted SOAP request, a different issue than CVE-2008-0926.
CVSS Score: 5.0 (MEDIUM)
References: http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=InfoDocument-patchbuilder-readme5067743&sliceId=&docTypeID=DT_SUSESDB_PSDB_1_1&dialogID=122457794&stateId=0%200%[PII_REDACTED]1; http://www.novell.com/support/viewContent.do?externalId=3426981; http://www.securitytracker.com/id?1023558
CVE: CVE-2009-1571
Published: 2010-02-22
Description: Use-after-free vulnerability in the HTML parser in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, Thunderbird before 3.0.2, and SeaMonkey before 2.0.3 allows remote attackers to execute arbitrary code via unspecified method calls that attempt to access freed objects in low-memory situations.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html
CVE: CVE-2009-3988
Published: 2010-02-22
Description: Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html
CVE: CVE-2010-0159
Published: 2010-02-22
Description: The browser engine in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, Thunderbird before 3.0.2, and SeaMonkey before 2.0.3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the nsBlockFrame::StealFrame function in layout/generic/nsBlockFrame.cpp, and unspecified other vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html
CVE: CVE-2010-0160
Published: 2010-02-22
Description: The Web Worker functionality in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly handle array data types for posted messages, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html
CVE: CVE-2010-0162
Published: 2010-02-22
Description: Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly support the application/octet-stream content type as a protection mechanism against execution of web script in certain circumstances involving SVG and the EMBED element, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via an embedded SVG document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html
CVE: CVE-2010-0188
Published: 2010-02-22
Description: Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html; http://secunia.com/advisories/38639; http://secunia.com/advisories/38915
CVE: CVE-2010-0283
Published: 2010-02-22
Description: The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2, and 1.8 alpha, allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid (1) AS-REQ or (2) TGS-REQ request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035222.html; http://secunia.com/advisories/38598
CVE: CVE-2010-0410
Published: 2010-02-22
Description: drivers/connector/connector.c in the Linux kernel before 2.6.32.8 allows local users to cause a denial of service (memory consumption and system crash) by sending the kernel many NETLINK_CONNECTOR messages.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f98bfbd78c37c5946cc53089da32a5f741efdeb7; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035070.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035159.html
CVE: CVE-2010-0286
Published: 2010-02-22
Description: Unspecified vulnerability in the OpenID Identity Authentication extension in TYPO3 4.3.0 allows remote attackers to bypass authentication and gain access to a backend user account via unknown attack vectors in which both the attacker and victim have an OpenID provider that discards identities during authentication.
CVSS Score: 5.1 (MEDIUM)
References: http://osvdb.org/61680; http://secunia.com/advisories/38206; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-001/
CVE: CVE-2010-0299
Published: 2010-02-22
Description: openSUSE 11.2 installs the devtmpfs root directory with insecure permissions (1777), which allows local users to gain privileges via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.html
CVE: CVE-2010-0670
Published: 2010-02-22
Description: Unspecified vulnerability in the IP-Tech JQuarks (com_jquarks) Component before 0.2.4 for Joomla! allows attackers to obtain the installation path for Joomla! via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.iptechinside.com/labs/news/show/6; https://exchange.xforce.ibmcloud.com/vulnerabilities/56523; http://www.iptechinside.com/labs/news/show/6
CVE: CVE-2009-4649
Published: 2010-02-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in geccBBlite 0.1 allow remote attackers to inject arbitrary web script or HTML via the postatoda parameter to (1) rispondi.php and (2) scrivi.php, which is not properly handled in forum.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://groups.csail.mit.edu/pag/ardilla/; http://groups.csail.mit.edu/pag/ardilla/geccbblite-XSS2-lenient-T.txt; http://groups.csail.mit.edu/pag/ardilla/geccbblite-XSS2-strict-T.txt
CVE: CVE-2010-0671
Published: 2010-02-22
Description: SQL injection vulnerability in index.php in KR MEDIA Pogodny CMS allows remote attackers to execute arbitrary SQL commands via the id parameter in a niusy action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://ariko-security.com/feb2010/ad439.html; http://packetstormsecurity.org/1002-exploits/pogodnycms-sql.txt; http://secunia.com/advisories/38571
CVE: CVE-2010-0672
Published: 2010-02-22
Description: SQL injection vulnerability in index.php in WSN Guest 1.02 allows remote attackers to execute arbitrary SQL commands via the orderlinks parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1002-exploits/wsnguest102-sql.txt; http://www.exploit-db.com/exploits/11436; http://www.securityfocus.com/bid/38236
CVE: CVE-2010-0673
Published: 2010-02-22
Description: SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitrary SQL commands via the postid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62346; http://packetstormsecurity.org/1002-exploits/wpcopperleaf-sql.txt; http://secunia.com/advisories/38579
CVE: CVE-2010-0674
Published: 2010-02-22
Description: StatCounteX 3.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for path/stats.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.org/1002-exploits/statcountex-disclose.txt; http://www.exploit-db.com/exploits/11434; https://exchange.xforce.ibmcloud.com/vulnerabilities/56264