deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-3073
Published: 2010-09-17
Description: SSL_Cipher.cpp in EncFS before 1.7.0 does not properly handle integer data sizes when constructing headers intended for randomization of initialization vectors, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0316.html; http://code.google.com/p/encfs/source/detail?r=59; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047794.html
CVE: CVE-2010-3074
Published: 2010-09-17
Description: SSL_Cipher.cpp in EncFS before 1.7.0 uses an improper combination of an AES cipher and a CBC cipher mode for encrypted filesystems, which allows local users to obtain sensitive information via a watermark attack.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0316.html; http://bugs.gentoo.org/show_bug.cgi?id=335938; http://code.google.com/p/encfs/source/detail?r=59
CVE: CVE-2010-3075
Published: 2010-09-17
Description: EncFS before 1.7.0 encrypts multiple blocks by means of the CFB cipher mode with the same initialization vector, which makes it easier for local users to obtain sensitive information via calculations involving recovery of XORed data, as demonstrated by an attack on encrypted data in which the last block contains only one byte.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0316.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047794.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047798.html
CVE: CVE-2010-3324
Published: 2010-09-17
Description: The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) @import rule, aka "HTML Sanitization Vulnerability," a different vulnerability than CVE-2010-1257.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0179.html; http://support.avaya.com/css/P8/documents/100113324; http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE: CVE-2010-3012
Published: 2010-09-17
Description: Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this issue was originally assigned CVE-2010-3010 due to a CNA error.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41480; http://secunia.com/advisories/41490; http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995
CVE: CVE-2010-3455
Published: 2010-09-17
Description: Cross-site scripting (XSS) vulnerability in index.php in AChecker 1.0 allows remote attackers to inject arbitrary web script or HTML via the uri parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1009-exploits/achecker-xss.txt; http://secunia.com/advisories/41467; http://www.htbridge.ch/advisory/xss_vulnerability_in_achecker.html
CVE: CVE-2010-3456
Published: 2010-09-17
Description: Directory traversal vulnerability in download.php in EnergyScripts (ES) Simple Download 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1009-exploits/essimpledownload-lfi.txt; http://secunia.com/advisories/41359; http://www.exploit-db.com/exploits/14960
CVE: CVE-2010-3457
Published: 2010-09-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.0.7 and 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) fields[website] parameter in the post comments feature in articles/a-primer-to-symphony-2s-default-theme/ or (2) send-email[recipient] parameter to about/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1009-exploits/symphony-sqlxss.txt; http://secunia.com/advisories/41379; http://www.exploit-db.com/exploits/14968
CVE: CVE-2010-3458
Published: 2010-09-17
Description: SQL injection vulnerability in lib/toolkit/events/event.section.php in Symphony CMS 2.0.7 and 2.1.1 allows remote attackers to execute arbitrary SQL commands via the send-email[recipient] parameter to about/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1009-exploits/symphony-sqlxss.txt; http://secunia.com/advisories/41379; http://www.exploit-db.com/exploits/14968
CVE: CVE-2010-3459
Published: 2010-09-17
Description: Cross-site scripting (XSS) vulnerability in the Ajax WebMail interface in AXIGEN Mail Server before 7.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41430; http://www.axigen.com/press/product-releases/axigen-releases-version-742_74.html; http://www.osvdb.org/68026
CVE: CVE-2010-3460
Published: 2010-09-17
Description: Directory traversal vulnerability in the HTTP interface in AXIGEN Mail Server 7.4.1 for Windows allows remote attackers to read arbitrary files via a %5C (encoded backslash) in the URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1009-exploits/axigen741-traversal.txt; http://secunia.com/advisories/41430; http://www.acunetix.com/blog/news/directory-traversal-axigen/
CVE: CVE-2010-3461
Published: 2010-09-17
Description: SQL injection vulnerability in the Publisher module in eNdonesia 8.4 allows remote attackers to execute arbitrary SQL commands via the artid parameter in a printarticle action to mod.php, a different vector than CVE-2007-3394.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/15006; https://exchange.xforce.ibmcloud.com/vulnerabilities/61809; http://www.exploit-db.com/exploits/15006
CVE: CVE-2010-3462
Published: 2010-09-17
Description: Cross-site scripting (XSS) vulnerability in backend/plugin/Registration/index.php in Mollify 1.6, 1.6.5.5, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the confirm parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1009-exploits/mollify16-xss.txt; http://secunia.com/advisories/41472; http://www.johnleitch.net/Vulnerabilities/Mollify.1.6.Reflected.Cross-site.Scripting/36
CVE: CVE-2010-3463
Published: 2010-09-17
Description: Cross-site scripting (XSS) vulnerability in modules/search/search.class.php in SantaFox 2.02, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the search parameter to search.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1009-exploits/santafox-xssxsrf.txt; http://secunia.com/advisories/41465; http://www.htbridge.ch/advisory/xss_vulnerability_in_santafox_search_module.html
CVE: CVE-2010-3464
Published: 2010-09-17
Description: Cross-site request forgery (CSRF) vulnerability in admin/manager_users.class.php in SantaFox 2.02, and possibly earlier, allows remote attackers to hijack the authentication of administrators for requests, as demonstrated by adding administrative users via the save_admin action to admin/index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.org/1009-exploits/santafox-xssxsrf.txt; http://secunia.com/advisories/41465; http://www.htbridge.ch/advisory/xsrf_csrf_in_santafox.html
CVE: CVE-2010-3465
Published: 2010-09-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in XSE Shopping Cart 1.5.2.1 and 1.5.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to Default.aspx and the (2) type parameter to SearchResults.aspx.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/68029; http://osvdb.org/68030; http://pridels-team.blogspot.com/2010/09/xse-shopping-cart-xss-vuln.html
CVE: CVE-2010-3466
Published: 2010-09-17
Description: Cross-site scripting (XSS) vulnerability in index.php in the hosted_signup module in NetArt Media iBoutique.MALL 1.2 allows remote attackers to inject arbitrary web script or HTML via the tmpl parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://pridels-team.blogspot.com/2010/09/iboutiquemall-12-xss-vuln.html; http://secunia.com/advisories/36726; http://www.securityfocus.com/bid/43146
CVE: CVE-2010-3467
Published: 2010-09-17
Description: SQL injection vulnerability in modules/sections/index.php in E-Xoopport Samsara 3.1 and earlier, when the Tutorial module is enabled, allows remote attackers to execute arbitrary SQL commands via the secid parameter in a listarticles action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/1009-exploits/exoopport-sql.txt; http://secunia.com/advisories/41397; http://www.exploit-db.com/exploits/15004
CVE: CVE-2010-2080
Published: 2010-09-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html; http://otrs.org/advisory/OSA-2010-02-en/; http://secunia.com/advisories/41381
CVE: CVE-2010-3072
Published: 2010-09-20
Description: The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047787.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047820.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
CVE: CVE-2010-3200
Published: 2010-09-20
Description: MSO.dll in Microsoft Word 2003 SP3 11.8326.11.8324 allows remote attackers to cause a denial of service (NULL pointer dereference and multiple-instance application crash) via a crafted buffer in a Word document, as demonstrated by word_crash_11.8326.8324_poc.doc.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/513679/100/0/threaded; http://www.securityfocus.com/archive/1/513679/100/0/threaded
CVE: CVE-2010-3262
Published: 2010-09-20
Description: Cross-site scripting (XSS) vulnerability in Flock Browser 3.x before 3.0.0.4114 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://flock.com/security/; http://www.securityfocus.com/archive/1/513701/100/0/threaded; http://www.securityfocus.com/bid/43225
CVE: CVE-2006-7241
Published: 2010-09-20
Description: The Image Viewer component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-002 removes a user from an ACL when the user is denied all permissions for an annotation, which might allow remote authenticated users to bypass intended access restrictions in opportunistic circumstances.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://download2.boulder.ibm.com/sar/CMA/IMA/00yrk/0/readme-ae351-021.htm; http://download2.boulder.ibm.com/sar/CMA/IMA/00yrk/0/readme-ae351-021.htm
CVE: CVE-2006-7242
Published: 2010-09-20
Description: The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-001 does not ensure that the AE Administrator role is present for Site Preferences modifications, which allows remote authenticated users to bypass intended access restrictions via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://download2.boulder.ibm.com/sar/CMA/IMA/00yrk/0/readme-ae351-021.htm; http://download2.boulder.ibm.com/sar/CMA/IMA/00yrk/0/readme-ae351-021.htm
CVE: CVE-2008-7261
Published: 2010-09-20
Description: The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-010 records DEBUG messages containing user credentials in the log4j.xml file, which might allow local users to obtain sensitive information by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://download2.boulder.ibm.com/sar/CMA/IMA/00yrk/0/readme-ae351-021.htm; http://download2.boulder.ibm.com/sar/CMA/IMA/00yrk/0/readme-ae351-021.htm
CVE: CVE-2009-4998
Published: 2010-09-20
Description: The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-019 and 4.0.2.x before 4.0.2.7-P8AE-FP007, in certain FileTracker configurations, does not apply a security policy to the first document added during a session, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://download2.boulder.ibm.com/sar/CMA/IMA/00y3y/0/readme-4027-P8AE-FP007.htm; http://download2.boulder.ibm.com/sar/CMA/IMA/00yrk/0/readme-ae351-021.htm; http://www-01.ibm.com/support/docview.wss?uid=swg1PJ36552
CVE: CVE-2009-4999
Published: 2010-09-20
Description: Cross-site scripting (XSS) vulnerability in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-016 allows remote attackers to inject arbitrary web script or HTML via the Name field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://download2.boulder.ibm.com/sar/CMA/IMA/00yrk/0/readme-ae351-021.htm; http://www-01.ibm.com/support/docview.wss?uid=swg1PJ34852; http://download2.boulder.ibm.com/sar/CMA/IMA/00yrk/0/readme-ae351-021.htm
CVE: CVE-2009-5000
Published: 2010-09-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 4.0.2.x before 4.0.2.3-P8AE-FP003 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to .jsp pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://download2.boulder.ibm.com/sar/CMA/IMA/00y3y/0/readme-4027-P8AE-FP007.htm; http://www-01.ibm.com/support/docview.wss?uid=swg1PJ35679; http://download2.boulder.ibm.com/sar/CMA/IMA/00y3y/0/readme-4027-P8AE-FP007.htm
CVE: CVE-2009-5001
Published: 2010-09-20
Description: The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 4.0.2.x before 4.0.2.2-P8AE-FP002 grants a document's Creator-Owner full control over an annotation object, even if the default instance security has changed, which might allow remote authenticated users to bypass intended access restrictions in opportunistic circumstances.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://download2.boulder.ibm.com/sar/CMA/IMA/00y3y/0/readme-4027-P8AE-FP007.htm; http://www-01.ibm.com/support/docview.wss?uid=swg1PJ35547; http://download2.boulder.ibm.com/sar/CMA/IMA/00y3y/0/readme-4027-P8AE-FP007.htm
CVE: CVE-2009-5002
Published: 2010-09-20
Description: The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 4.0.2.x before 4.0.2.1-P8AE-FP001 does not record Get Content Failure Audit events, which might allow remote attackers to attempt content access without detection.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://download2.boulder.ibm.com/sar/CMA/IMA/00y3y/0/readme-4027-P8AE-FP007.htm; http://www-01.ibm.com/support/docview.wss?uid=swg1PJ34853; http://download2.boulder.ibm.com/sar/CMA/IMA/00y3y/0/readme-4027-P8AE-FP007.htm
CVE: CVE-2010-3470
Published: 2010-09-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-021 and 4.0.2.x before 4.0.2.7-P8AE-FP007 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://download2.boulder.ibm.com/sar/CMA/IMA/00y3y/0/readme-4027-P8AE-FP007.htm; http://download2.boulder.ibm.com/sar/CMA/IMA/00yrk/0/readme-ae351-021.htm; http://secunia.com/advisories/41458
CVE: CVE-2010-3471
Published: 2010-09-20
Description: Session fixation vulnerability in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 4.0.2.x before 4.0.2.7-P8AE-FP007 allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://download2.boulder.ibm.com/sar/CMA/IMA/00y3y/0/readme-4027-P8AE-FP007.htm; http://secunia.com/advisories/41460; http://www-01.ibm.com/support/docview.wss?uid=swg1PJ37346
CVE: CVE-2010-3472
Published: 2010-09-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-021 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://download2.boulder.ibm.com/sar/CMA/IMA/00yrk/0/readme-ae351-021.htm; http://secunia.com/advisories/41458; http://www-01.ibm.com/support/docview.wss?uid=swg1PJ37466
CVE: CVE-2010-3473
Published: 2010-09-20
Description: Open redirect vulnerability in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-021 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://download2.boulder.ibm.com/sar/CMA/IMA/00yrk/0/readme-ae351-021.htm; http://secunia.com/advisories/41458; http://www-01.ibm.com/support/docview.wss?uid=swg1PJ37180
CVE: CVE-2010-3474
Published: 2010-09-20
Description: IBM DB2 9.7 before FP3 does not perform the expected drops or invalidations of dependent functions upon a loss of privileges by the functions' owners, which allows remote authenticated users to bypass intended access restrictions via calls to these functions, a different vulnerability than CVE-2009-3471.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/68121; http://secunia.com/advisories/41444; http://www-01.ibm.com/support/docview.wss?uid=swg1IC68015
CVE: CVE-2010-3475
Published: 2010-09-20
Description: IBM DB2 9.7 before FP3 does not properly enforce privilege requirements for execution of entries in the dynamic SQL cache, which allows remote authenticated users to bypass intended access restrictions by leveraging the cache to execute an UPDATE statement contained in a compiled compound SQL statement.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/68122; http://secunia.com/advisories/41444; http://www-01.ibm.com/support/docview.wss?uid=swg1IC70406
CVE: CVE-2010-3476
Published: 2010-09-20
Description: Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages, which allows remote attackers to cause a denial of service (CPU consumption) via a large message, a different vulnerability than CVE-2010-2080.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html; http://otrs.org/advisory/OSA-2010-02-en/; http://secunia.com/advisories/41381
CVE: CVE-2010-2942
Published: 2010-09-21
Description: The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations, which allows local users to obtain potentially sensitive information from kernel memory via vectors related to (1) the tcf_gact_dump function in net/sched/act_gact.c, (2) the tcf_mirred_dump function in net/sched/act_mirred.c, (3) the tcf_nat_dump function in net/sched/act_nat.c, (4) the tcf_simp_dump function in net/sched/act_simple.c, and (5) the tcf_skbedit_dump function in net/sched/act_skbedit.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=1c40be12f7d8ca1d387510d39787b12e512a7ce8; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html
CVE: CVE-2010-3067
Published: 2010-09-21
Description: Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-190
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=75e1c70fc31490ef8a373ea2a4bea2524099b478; http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.html
CVE: CVE-2010-3078
Published: 2010-09-21
Description: The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an ioctl call.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a122eb2fdfd78b58c6dd992d6f4b1aaef667eef9; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html
CVE: CVE-2010-3080
Published: 2010-09-21
Description: Double free vulnerability in the snd_seq_oss_open function in sound/core/seq/oss/seq_oss_init.c in the Linux kernel before 2.6.36-rc4 might allow local users to cause a denial of service or possibly have unspecified other impact via an unsuccessful attempt to open the /dev/sequencer device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-415
References: http://git.kernel.org/?p=linux/kernel/git/tiwai/sound-2.6.git%3Ba=commit%3Bh=c598337660c21c0afaa9df5a65bb4a7a0cf15be8; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=27f7ad53829f79e799a253285318bff79ece15bd; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html
CVE: CVE-2010-0781
Published: 2010-09-21
Description: Unspecified vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.33 allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted URL.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/41722; http://www-01.ibm.com/support/docview.wss?uid=swg1PM11807; http://www-01.ibm.com/support/docview.wss?uid=swg27007951
CVE: CVE-2010-1820
Published: 2010-09-21
Description: Apple Filing Protocol (AFP) Server in Apple Mac OS X 10.6.x through 10.6.4 does not properly handle errors, which allows remote attackers to bypass the password requirement for shared-folder access by leveraging knowledge of a valid account name.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://lists.apple.com/archives/security-announce/2010/Sep/msg00004.html; http://support.apple.com/kb/HT4361; http://www.securityfocus.com/bid/43341
CVE: CVE-2010-3092
Published: 2010-09-21
Description: The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different file with a similar name.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/880476; http://marc.info/?l=oss-security&m=[PII_REDACTED]5305&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]4512&w=2