deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-2855
Published: 2010-07-25
Description: Multiple SQL injection vulnerabilities in modfile.php in Event Horizon (EVH) 1.1.10, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) YourEmail and (2) VerificationNumber parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/40517; http://www.securityfocus.com/bid/41580; http://secunia.com/advisories/40517
CVE: CVE-2010-2856
Published: 2010-07-25
Description: Cross-site scripting (XSS) vulnerability in admin/currencies.php in osCSS 1.2.2, and probably earlier versions, allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/66138; http://secunia.com/advisories/40502; http://www.htbridge.ch/advisory/xss_vulnerability_in_oscss.html
CVE: CVE-2010-2857
Published: 2010-07-25
Description: Directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the cid parameter to album.html.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1007-exploits/joomlamusicmanager-lfi.txt; http://www.exploit-db.com/exploits/14274; http://www.securityfocus.com/bid/41485
CVE: CVE-2010-2858
Published: 2010-07-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in news.php in SimpNews 2.47.03 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) layout and (2) sortorder parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1007-exploits/simpnews-xss.txt; http://secunia.com/advisories/40501; http://websecurity.com.ua/4245/
CVE: CVE-2010-2859
Published: 2010-07-25
Description: news.php in SimpNews 2.47.3 and earlier allows remote attackers to obtain sensitive information via an invalid lang parameter, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.org/1007-exploits/simpnews-xss.txt; http://www.securityfocus.com/archive/1/512271/100/0/threaded; http://packetstormsecurity.org/1007-exploits/simpnews-xss.txt
CVE: CVE-2010-0211
Published: 2010-07-28
Description: The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the slap_mods_free function, as demonstrated using the Codenomicon LDAPv3 test suite.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-252
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
CVE: CVE-2010-0212
Published: 2010-07-28
Description: OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schema_init.c, as demonstrated using the Codenomicon LDAPv3 test suite.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
CVE: CVE-2010-0213
Published: 2010-07-28
Description: BIND 9.7.1 and 9.7.1-P1, when a recursive validating server has a trust anchor that is configured statically or via DNSSEC Lookaside Validation (DLV), allows remote attackers to cause a denial of service (infinite loop) via a query for an RRSIG record whose answer is not in the cache, which causes BIND to repeatedly send RRSIG queries to the authoritative servers.
CVSS Score: 2.6 (LOW)
CWE: CWE-19
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044445.html; http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html; http://secunia.com/advisories/40652
CVE: CVE-2010-0833
Published: 2010-07-28
Description: The pam_lsass library in Likewise Open 5.4 and CIFS 5.4 before build 8046, and 6.0 before build 8234, as used in HP StorageWorks X9000 Network Storage Systems and possibly other products, uses "SetPassword logic" when running as part of a root service, which allows remote attackers to bypass authentication for a Likewise Security Authority (lsassd) account whose password is marked as expired.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6096&w=2; http://secunia.com/advisories/40725; http://secunia.com/advisories/40736
CVE: CVE-2010-1577
Published: 2010-07-28
Description: Directory traversal vulnerability in Cisco Internet Streamer, as used in Cisco Content Delivery System (CDS) 2.2.x, 2.3.x, 2.4.x, and 2.5.x before 2.5.7 allows remote attackers to read arbitrary files via a crafted URL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://osvdb.org/66508; http://secunia.com/advisories/40701; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b3bd1c.shtml
CVE: CVE-2010-2337
Published: 2010-07-28
Description: Open redirect vulnerability in RSA Federated Identity Manager 4.0 before 4.0.25 and 4.1 before 4.1.26 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2010-07/0187.html; http://osvdb.org/66504; http://secunia.com/advisories/40704
CVE: CVE-2010-2529
Published: 2010-07-28
Description: Unspecified vulnerability in ping.c in iputils 20020927, 20070202, 20071127, and 20100214 on Mandriva Linux allows remote attackers to cause a denial of service (hang) via a crafted echo response.
CVSS Score: 5.0 (MEDIUM)
References: http://www.mandriva.com/security/advisories?name=MDVSA-2010:138; http://www.securityfocus.com/bid/41911; http://www.vupen.com/english/advisories/2010/1890
CVE: CVE-2010-2534
Published: 2010-07-28
Description: The NetworkSyncCommandQueue function in network/network_command.cpp in OpenTTD before 1.0.3 does not properly clear a pointer in a linked list, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted request, related to the client command queue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.openttd.org/task/3909; http://bugs.openttd.org/task/3909/getfile/6237/loop_fix.patch; http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044516.html
CVE: CVE-2010-2703
Published: 2010-07-28
Description: Stack-based buffer overflow in the execvp_nc function in the ov.dll module in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53, when running on Windows, allows remote attackers to execute arbitrary code via a long HTTP request to webappmon.exe.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9749&w=2; http://osvdb.org/66514; http://secunia.com/advisories/40686
CVE: CVE-2010-2704
Published: 2010-07-28
Description: Buffer overflow in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long HTTP request to nnmrptconfig.exe.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8707&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7645&w=2; http://secunia.com/advisories/40697
CVE: CVE-2009-4958
Published: 2010-07-28
Description: SQL injection vulnerability in video.php in EMO Breeder Manager (aka EMO Breader Manager) allows remote attackers to execute arbitrary SQL commands via the idd parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36464; http://www.exploit-db.com/exploits/9518; http://secunia.com/advisories/36464
CVE: CVE-2009-4959
Published: 2010-07-28
Description: SQL injection vulnerability in the T3M E-Mail Marketing Tool (t3m) extension 0.2.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-012; http://www.securityfocus.com/bid/36140; http://www.vupen.com/english/advisories/2009/2410
CVE: CVE-2009-4960
Published: 2010-07-28
Description: Directory traversal vulnerability in modules/backup/download.php in Lanai Core 0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the f parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9490; http://www.vupen.com/english/advisories/2009/2402; https://exchange.xforce.ibmcloud.com/vulnerabilities/52718
CVE: CVE-2009-4961
Published: 2010-07-28
Description: Lanai Core 0.6 allows remote attackers to obtain configuration information via a direct request to info.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.exploit-db.com/exploits/9490; http://www.exploit-db.com/exploits/9490
CVE: CVE-2009-4962
Published: 2010-07-28
Description: Stack-based buffer overflow in Fat Player 0.6b allows remote attackers to execute arbitrary code via a long string in a .wav file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/57343; http://secunia.com/advisories/36441; http://www.exploit-db.com/exploits/9495
CVE: CVE-2009-4963
Published: 2010-07-28
Description: Cross-site scripting (XSS) vulnerability in the Commerce extension before 0.9.9 for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-011/; http://www.securityfocus.com/bid/36133; http://www.vupen.com/english/advisories/2009/2409
CVE: CVE-2009-4964
Published: 2010-07-28
Description: Stack-based buffer overflow in KSP 2006 FINAL allows remote attackers to execute arbitrary code via a long string in a .M3U playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9486; http://www.vupen.com/english/advisories/2009/2393; https://exchange.xforce.ibmcloud.com/vulnerabilities/52710
CVE: CVE-2009-4965
Published: 2010-07-28
Description: SQL injection vulnerability in the AIRware Lexicon (air_lexicon) extension 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-013/; http://www.securityfocus.com/bid/36130; http://www.vupen.com/english/advisories/2009/2411
CVE: CVE-2009-4966
Published: 2010-07-28
Description: SQL injection vulnerability in the AST ZipCodeSearch (ast_addresszipsearch) extension 0.5.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-013/; http://www.securityfocus.com/bid/36135; http://www.vupen.com/english/advisories/2009/2411
CVE: CVE-2009-4967
Published: 2010-07-28
Description: SQL injection vulnerability in the Car (car) extension before 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-013/; http://www.securityfocus.com/bid/36131; http://www.vupen.com/english/advisories/2009/2411
CVE: CVE-2009-4968
Published: 2010-07-28
Description: SQL injection vulnerability in the Event Registration (event_registr) extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-013/; http://www.securityfocus.com/bid/36136; http://www.vupen.com/english/advisories/2009/2411
CVE: CVE-2009-4969
Published: 2010-07-28
Description: SQL injection vulnerability in the Solidbase Bannermanagement (SBbanner) extension 1.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-013/; http://www.securityfocus.com/bid/36137; http://www.vupen.com/english/advisories/2009/2411
CVE: CVE-2009-4970
Published: 2010-07-28
Description: SQL injection vulnerability in the t3m_affiliate extension 0.5.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-013/; http://www.securityfocus.com/bid/36138; http://www.vupen.com/english/advisories/2009/2411
CVE: CVE-2009-4971
Published: 2010-07-28
Description: SQL injection vulnerability in the AJAX Chat (vjchat) extension before 0.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-013/; http://www.securityfocus.com/bid/36141; http://www.vupen.com/english/advisories/2009/2411
CVE: CVE-2009-4972
Published: 2010-07-28
Description: Cross-site scripting (XSS) vulnerability in index.php (aka the log in page) in SimpleID before 0.6.5 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.n0where.org/post/171292151; http://osvdb.org/57327; http://simpleid.sourceforge.net/advisories/sa-2009-1
CVE: CVE-2009-4973
Published: 2010-07-28
Description: SQL injection vulnerability in rss.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary SQL commands via the selectedCal parameter in a SwitchCal action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9524; http://www.exploit-db.com/exploits/9524
CVE: CVE-2009-4974
Published: 2010-07-28
Description: Directory traversal vulnerability in box_display.php in TotalCalendar 2.4 allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the box parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9524; http://www.exploit-db.com/exploits/9524
CVE: CVE-2010-1452
Published: 2010-07-28
Description: The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.
CVSS Score: 5.0 (MEDIUM)
References: http://blogs.sun.com/security/entry/cve_2010_1452_mod_dav; http://httpd.apache.org/security/vulnerabilities_22.html; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2010-2896
Published: 2010-07-28
Description: IBM FileNet Content Manager (CM) 4.0.0, 4.0.1, 4.5.0, and 4.5.1 before FP4 does not properly manage the InheritParentPermissions setting during an upgrade from 3.x, which might allow attackers to bypass intended folder permissions via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/40614; http://www-01.ibm.com/support/docview.wss?uid=swg21441225; http://www.vupen.com/english/advisories/2010/1847
CVE: CVE-2010-2897
Published: 2010-07-28
Description: Google Chrome before 5.0.375.125 does not properly mitigate an unspecified flaw in the Windows kernel, which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=48283; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update_26.html; http://secunia.com/advisories/40743
CVE: CVE-2010-2898
Published: 2010-07-28
Description: Google Chrome before 5.0.375.125 does not properly mitigate an unspecified flaw in the GNU C Library, which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=48733; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update_26.html; http://secunia.com/advisories/40743
CVE: CVE-2010-2899
Published: 2010-07-28
Description: Unspecified vulnerability in the layout implementation in Google Chrome before 5.0.375.125 allows remote attackers to obtain sensitive information from process memory via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=42736; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update_26.html; http://secunia.com/advisories/40743
CVE: CVE-2010-2900
Published: 2010-07-28
Description: Google Chrome before 5.0.375.125 does not properly handle a large canvas, which has unspecified impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=43813; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update_26.html; http://secunia.com/advisories/40743
CVE: CVE-2010-2901
Published: 2010-07-28
Description: The rendering implementation in Google Chrome before 5.0.375.125 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=47866; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update_26.html; http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
CVE: CVE-2010-2902
Published: 2010-07-28
Description: The SVG implementation in Google Chrome before 5.0.375.125 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=48284; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update_26.html; http://secunia.com/advisories/40743
CVE: CVE-2010-2903
Published: 2010-07-28
Description: Google Chrome before 5.0.375.125 performs unexpected truncation and improper eliding of hostnames, which has unspecified impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=48597; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update_26.html; http://secunia.com/advisories/40743
CVE: CVE-2010-2904
Published: 2010-07-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in the System Landscape Directory (SLD) component 6.4 through 7.02 in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter to testsdic and the (2) helpstring parameter to paramhelp.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dsecrg.com/pages/vul/show.php?id=168; http://packetstormsecurity.org/1007-advisories/DSECRG-09-068.txt; http://secunia.com/advisories/40712
CVE: CVE-2010-2905
Published: 2010-07-28
Description: SQL injection vulnerability in info.php in ScriptsFeed and BrotherScripts (BS) Scripts Directory allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/40463; http://www.exploit-db.com/exploits/14370; http://www.securityfocus.com/bid/41733
CVE: CVE-2010-2906
Published: 2010-07-28
Description: SQL injection vulnerability in articlesdetails.php in ScriptsFeed and BrotherScripts (BS) Scripts Directory allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2010-2905.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/40463; http://www.exploit-db.com/exploits/14371; https://exchange.xforce.ibmcloud.com/vulnerabilities/60073
CVE: CVE-2010-2907
Published: 2010-07-28
Description: SQL injection vulnerability in the Huru Helpdesk (com_huruhelpdesk) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a detail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/joomlahuruhelpdesk-sql.txt; http://www.exploit-db.com/exploits/14449; http://www.securityfocus.com/bid/39366
CVE: CVE-2010-2908
Published: 2010-07-28
Description: SQL injection vulnerability in the Joomdle (com_joomdle) component 0.24 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the course_id parameter in a detail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/joomlajoomdle-sql.txt; http://www.exploit-db.com/exploits/14466; http://www.vupen.com/english/advisories/2010/1923
CVE: CVE-2010-2909
Published: 2010-07-28
Description: SQL injection vulnerability in ttvideo.php in the TTVideo (com_ttvideo) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter in a video action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://adv.salvatorefresta.net/TTVideo_1.0_Joomla_Component_SQL_Injection_Vulnerability-27072010.txt; http://osvdb.org/66630; http://secunia.com/advisories/40716
CVE: CVE-2010-2910
Published: 2010-07-28
Description: SQL injection vulnerability in the Ozio Gallery (com_oziogallery) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/joomlaoziogallery-sql.txt; http://www.exploit-db.com/exploits/14462; https://exchange.xforce.ibmcloud.com/vulnerabilities/60618
CVE: CVE-2010-2911
Published: 2010-07-28
Description: SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a viewnews action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/kayakoesupport37002-sql.txt; http://www.exploit-db.com/exploits/14392; http://www.securityfocus.com/bid/41779
CVE: CVE-2010-2912
Published: 2010-07-28
Description: SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL commands via the _a parameter in a downloads action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/kayakoesupport-sql.txt; http://www.exploit-db.com/exploits/14404; http://www.securityfocus.com/bid/41756
CVE: CVE-2010-1777
Published: 2010-07-30
Description: Buffer overflow in Apple iTunes before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted itpc: URL.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Jul/msg00000.html; http://support.apple.com/kb/HT4263; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6988
CVE: CVE-2010-2528
Published: 2010-07-30
Description: The clientautoresp function in family_icbm.c in the oscar protocol plugin in libpurple in Pidgin before 2.7.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via an X-Status message that lacks the expected end tag for a (1) desc or (2) title element.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://developer.pidgin.im/viewmtn/revision/diff/fcb70f7c12120206d30ad33223ff85be7b226d1c/with/8e8ff246492e45af8f8d0808296d6f2906794dc0/libpurple/protocols/oscar/family_icbm.c; http://developer.pidgin.im/viewmtn/revision/info/8e8ff246492e45af8f8d0808296d6f2906794dc0; http://secunia.com/advisories/40699