deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-3093
Published: 2010-09-21
Description: The comment module in Drupal 5.x before 5.23 and 6.x before 6.18 allows remote authenticated users with certain privileges to bypass intended access restrictions and reinstate removed comments via a crafted URL, related to an "unpublishing bypass" issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://drupal.org/node/880476; http://marc.info/?l=oss-security&m=[PII_REDACTED]5305&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]4512&w=2
CVE: CVE-2010-3094
Published: 2010-09-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.18 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) an action description, (2) an action message, (3) a node, or (4) a taxonomy term, related to the actions feature and the trigger module.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/880476; http://marc.info/?l=oss-security&m=[PII_REDACTED]5305&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]4512&w=2
CVE: CVE-2010-3477
Published: 2010-09-21
Description: The tcf_act_police_dump function in net/sched/act_police.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc4 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel memory via vectors involving a dump operation.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2942.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=0f04cfd098fb81fded74e78ea1a1b86cc6c6c31e; http://secunia.com/advisories/42890; http://secunia.com/advisories/46397
CVE: CVE-2010-3301
Published: 2010-09-22
Description: The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register.  NOTE: this vulnerability exists because of a CVE-2007-4573 regression.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=36d001c70d8a0144ac1d038f6876c484849a74de; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=eefdca043e8391dcd[PII_REDACTED]92063030b55ac; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
CVE: CVE-2010-3313
Published: 2010-09-22
Description: phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) aspell_path or (2) spellchecker_lang parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.debian.org/security/2010/dsa-2013; http://www.egroupware.org/news?item=93; http://www.exploit-db.com/exploits/11777/
CVE: CVE-2010-3314
Published: 2010-09-22
Description: Cross-site scripting (XSS) vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2010/dsa-2013; http://www.egroupware.org/news?item=93; http://www.exploit-db.com/exploits/11777/
CVE: CVE-2010-3332
Published: 2010-09-22
Description: Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-209
References: http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx; http://isc.sans.edu/diary.html?storyid=9568; http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/
CVE: CVE-2009-5003
Published: 2010-09-22
Description: SQL injection vulnerability in click.php in e-soft24 Banner Exchange Script 1.0 allows remote attackers to execute arbitrary SQL commands via the targetid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/bes-sql.txt; http://www.exploit-db.com/exploits/9387; http://www.securityfocus.com/bid/43287
CVE: CVE-2010-3479
Published: 2010-09-22
Description: SQL injection vulnerability in list.php in BoutikOne 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1009-exploits/boutikone-sql.txt; http://www.exploit-db.com/exploits/15049; http://www.vupen.com/english/advisories/2010/2436
CVE: CVE-2010-3480
Published: 2010-09-22
Description: Directory traversal vulnerability in index.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/68074; http://secunia.com/advisories/41455; http://secunia.com/advisories/41491
CVE: CVE-2010-3481
Published: 2010-09-22
Description: Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) user_name and (2) password variables, possibly related to include/classes/Login.php. NOTE: some of these details are obtained from third party information. NOTE: the password vector might not be vulnerable.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/68073; http://secunia.com/advisories/41455; http://secunia.com/advisories/41492
CVE: CVE-2010-3482
Published: 2010-09-22
Description: Multiple SQL injection vulnerabilities in cms_write.php in Primitive CMS 1.0.9 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) title and (2) menutitle parameters. NOTE: this can be leveraged with CVE-2010-3483 to conduct attacks without authentication.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/1009-exploits/primitive-sqlxss.txt; http://www.exploit-db.com/exploits/15064; http://www.vupen.com/english/advisories/2010/2458
CVE: CVE-2010-3483
Published: 2010-09-22
Description: cms_write.php in Primitive CMS 1.0.9 does not properly restrict access, which allows remote attackers to gain administrative privileges via a direct request.  NOTE: this vulnerability can be leveraged to conduct cross-site scripting attacks, as demonstrated using the (1) title, (2) content, and (3) menutitle parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.org/1009-exploits/primitive-sqlxss.txt; http://secunia.com/advisories/41515; http://www.exploit-db.com/exploits/15064
CVE: CVE-2010-3484
Published: 2010-09-22
Description: SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the handle parameter to LightNEasy.php, a different vector than CVE-2008-6593.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1009-exploits/lightneasy-sql.txt; http://secunia.com/advisories/41502; http://www.exploit-db.com/exploits/15060
CVE: CVE-2010-3485
Published: 2010-09-22
Description: SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the userhandle cookie to LightNEasy.php, a different vector than CVE-2008-6593.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/41502; http://secunia.com/advisories/41502
CVE: CVE-2010-3486
Published: 2010-09-22
Description: Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash), (2) %5C (encoded backslash), or (3) %255c (double-encoded backslash) in the name parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://cloudscan.blogspot.com/2010/09/smarter-stats-533819-file-fuzzing.html; http://packetstormsecurity.org/1009-exploits/smartermail-traversal.txt; http://www.exploit-db.com/exploits/15048
CVE: CVE-2010-3487
Published: 2010-09-22
Description: Directory traversal vulnerability in YelloSoft Pinky 1.0 for Windows allows remote attackers to read arbitrary files via a %5C (encoded backslash) in the URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1009-exploits/pinky10-traversal.txt; http://secunia.com/advisories/41538; http://www.johnleitch.net/Vulnerabilities/Pinky.1.0.Directory.Traversal/42
CVE: CVE-2010-3488
Published: 2010-09-22
Description: Directory traversal vulnerability in QuickShare 1.0 allows remote attackers to read arbitrary files via a ... (triple dot) in the URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/68089; http://packetstormsecurity.org/1009-exploits/quickshare10-traversal.txt; http://secunia.com/advisories/41474
CVE: CVE-2010-3489
Published: 2010-09-22
Description: Cross-site scripting (XSS) vulnerability in netautor/napro4/home/login2.php in CMS Digital Workroom (formerly Netautor Professional) 5.5.0 allows remote attackers to inject arbitrary web script or HTML via the goback parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1009-exploits/ZSL-2010-4964.txt; http://secunia.com/advisories/41475; http://www.osvdb.org/68128
CVE: CVE-2010-2828
Published: 2010-09-23
Description: Unspecified vulnerability in the H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 2.5.x before 2.5.2 and 2.6.x before 2.6.1, allows remote attackers to cause a denial of service (device reload) via crafted H.323 packets, aka Bug ID CSCtc73759.
CVSS Score: 7.8 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a300.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a300.shtml
CVE: CVE-2010-2829
Published: 2010-09-23
Description: Unspecified vulnerability in the H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 2.5.x before 2.5.2 and 2.6.x before 2.6.1, allows remote attackers to cause a denial of service (traceback and device reload) via crafted H.323 packets, aka Bug ID CSCtd33567.
CVSS Score: 7.8 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a300.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a300.shtml
CVE: CVE-2010-2830
Published: 2010-09-23
Description: The IGMPv3 implementation in Cisco IOS 12.2, 12.3, 12.4, and 15.0 and IOS XE 2.5.x before 2.5.2, when PIM is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed IGMP packet, aka Bug ID CSCte14603.
CVSS Score: 7.1 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a310.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a310.shtml
CVE: CVE-2010-2831
Published: 2010-09-23
Description: Unspecified vulnerability in the NAT for SIP implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 allows remote attackers to cause a denial of service (device reload) via transit traffic on UDP port 5060, aka Bug ID CSCtf17624.
CVSS Score: 7.8 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a311.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a311.shtml
CVE: CVE-2010-2832
Published: 2010-09-23
Description: Unspecified vulnerability in the NAT for H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 allows remote attackers to cause a denial of service (device reload) via transit traffic, aka Bug ID CSCtf91428.
CVSS Score: 7.8 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a311.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a311.shtml
CVE: CVE-2010-2833
Published: 2010-09-23
Description: Unspecified vulnerability in the NAT for H.225.0 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 allows remote attackers to cause a denial of service (device reload) via transit traffic, aka Bug ID CSCtd86472.
CVSS Score: 7.8 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a311.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a311.shtml
CVE: CVE-2010-2834
Published: 2010-09-23
Description: Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)SU1, 7.x before 7.1(5), and 8.0 before 8.0(2) allow remote attackers to cause a denial of service (device reload or voice-services outage) via crafted SIP registration traffic over UDP, aka Bug IDs CSCtf72678 and CSCtf14987.
CVSS Score: 7.8 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a30f.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a313.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a30f.shtml
CVE: CVE-2010-2835
Published: 2010-09-23
Description: Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5), 7.0 before 7.0(2a)su3, 7.1su before 7.1(3b)su2, 7.1 before 7.1(5), and 8.0 before 8.0(1) allow remote attackers to cause a denial of service (device reload or voice-services outage) via a SIP REFER request with an invalid Refer-To header, aka Bug IDs CSCta20040 and CSCta31358.
CVSS Score: 7.8 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a30f.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a313.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a30f.shtml
CVE: CVE-2010-2836
Published: 2010-09-23
Description: Memory leak in the SSL VPN feature in Cisco IOS 12.4, 15.0, and 15.1, when HTTP port redirection is enabled, allows remote attackers to cause a denial of service (memory consumption) by improperly disconnecting SSL sessions, leading to connections that remain in the CLOSE-WAIT state, aka Bug ID CSCtg21685.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a312.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a312.shtml
CVE: CVE-2010-3279
Published: 2010-09-23
Description: The default configuration of the CCAgent option before 9.0.8.4 in the management server (aka TSA) component in Alcatel-Lucent OmniTouch Contact Center Standard Edition enables maintenance access, which allows remote attackers to monitor or reconfigure Contact Center operations via vectors involving TSA_maintenance.exe.
CVSS Score: 7.6 (HIGH)
CWE: CWE-16
References: http://secunia.com/advisories/41509; http://www.alcatel-lucent.com/wps/DocumentStreamerServlet?LMSG_CABINET=Corporate&LMSG_CONTENT_FILE=Support/Security/2010001.pdf; http://www.nruns.com/_downloads/nruns-SA-2010-001.pdf
CVE: CVE-2010-3280
Published: 2010-09-23
Description: The CCAgent option 9.0.8.4 and earlier in the management server (aka TSA) component in Alcatel-Lucent OmniTouch Contact Center Standard Edition relies on client-side authorization checking, and unconditionally sends the SuperUser password to the client for use during an authorized session, which allows remote attackers to monitor or reconfigure Contact Center operations via a modified client application.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/41547; http://www.alcatel-lucent.com/wps/DocumentStreamerServlet?LMSG_CABINET=Corporate&LMSG_CONTENT_FILE=Support/Security/2010001.pdf; http://www.nruns.com/_downloads/nruns-SA-2010-001.pdf
CVE: CVE-2010-3281
Published: 2010-09-23
Description: Stack-based buffer overflow in the HTTP proxy service in Alcatel-Lucent OmniVista 4760 server before R5.1.06.03.c_Patch3 allows remote attackers to execute arbitrary code or cause a denial of service (service crash) via a long request.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/41508; http://www.alcatel-lucent.com/wps/DocumentStreamerServlet?LMSG_CABINET=Corporate&LMSG_CONTENT_FILE=Support/Security/2010002.pdf; http://www.nruns.com/_downloads/nruns-SA-2010-002.pdf
CVE: CVE-2010-1767
Published: 2010-09-24
Description: Cross-site request forgery (CSRF) vulnerability in loader/DocumentThreadableLoader.cpp in WebCore in WebKit before r57041, as used in Google Chrome before 4.1.249.1059, allows remote attackers to hijack the authentication of unspecified victims via a crafted synchronous preflight XMLHttpRequest operation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://code.google.com/p/chromium/issues/detail?id=39698; http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-1772
Published: 2010-09-24
Description: Use-after-free vulnerability in page/Geolocation.cpp in WebCore in WebKit before r59859, as used in Google Chrome before 5.0.375.70, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site, related to failure to stop timers associated with geolocation upon deletion of a document.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=44868; http://googlechromereleases.blogspot.com/2010/06/stable-channel-update.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044023.html
CVE: CVE-2010-1773
Published: 2010-09-24
Description: Off-by-one error in the toAlphabetic function in rendering/RenderListMarker.cpp in WebCore in WebKit before r59950, as used in Google Chrome before 5.0.375.70, allows remote attackers to obtain sensitive information, cause a denial of service (memory corruption and application crash), or possibly execute arbitrary code via vectors related to list markers for HTML lists, aka rdar problem 8009118.
CVSS Score: 8.8 (HIGH)
CWE: CWE-193
References: http://code.google.com/p/chromium/issues/detail?id=44955; http://googlechromereleases.blogspot.com/2010/06/stable-channel-update.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044023.html
CVE: CVE-2010-1823
Published: 2010-09-24
Description: Use-after-free vulnerability in WebKit before r65958, as used in Google Chrome before 6.0.472.59, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger use of document APIs such as document.close during parsing, as demonstrated by a Cascading Style Sheets (CSS) file referencing an invalid SVG font, aka rdar problem 8442098.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=50250; http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_14.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2010-1824
Published: 2010-09-24
Description: Use-after-free vulnerability in WebKit, as used in Apple iTunes before 10.2 on Windows, Apple Safari, and Google Chrome before 6.0.472.59, allows remote attackers to execute arbitrary code or cause a denial of service via vectors related to SVG styles, the DOM tree, and error messages.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=50712; http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_14.html; http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html
CVE: CVE-2010-1825
Published: 2010-09-24
Description: Use-after-free vulnerability in WebKit, as used in Google Chrome before 6.0.472.59, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to nested SVG elements.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=51252; http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_14.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-2491
Published: 2010-09-24
Description: Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the template argument to the /issue program.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.gentoo.org/show_bug.cgi?id=326395; http://issues.roundup-tracker.org/issue2550654; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/048018.html
CVE: CVE-2010-3261
Published: 2010-09-24
Description: Directory traversal vulnerability in RSA Authentication Agent 7.0 before P2 for Web allows remote attackers to read unspecified data via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/513908/100/0/threaded; http://www.securityfocus.com/bid/43406; http://www.securityfocus.com/archive/1/513908/100/0/threaded
CVE: CVE-2010-3283
Published: 2010-09-24
Description: Open redirect vulnerability in HP System Management Homepage (SMH) before 6.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9241&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9241&w=2
CVE: CVE-2010-3284
Published: 2010-09-24
Description: Unspecified vulnerability in HP System Management Homepage (SMH) before 6.2 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1328&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1328&w=2
CVE: CVE-2010-3285
Published: 2010-09-24
Description: Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9838&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9838&w=2
CVE: CVE-2010-3294
Published: 2010-09-24
Description: Cross-site scripting (XSS) vulnerability in apc.php in the Alternative PHP Cache (APC) extension before 3.1.4 for PHP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://pecl.php.net/package-changelog.php?package=APC&release=3.1.4; http://rhn.redhat.com/errata/RHSA-2012-0811.html; http://www.openwall.com/lists/oss-security/2010/09/14/1
CVE: CVE-2010-3304
Published: 2010-09-24
Description: The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html; http://secunia.com/advisories/43220; http://www.dovecot.org/list/dovecot-news/2010-July/000163.html