deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1991
Published: 2010-05-20
Description: Microsoft Internet Explorer 6.0.2900.2180, 7, and 8.0.7600.16385 executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many IFRAME elements.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://websecurity.com.ua/4206/; http://www.securityfocus.com/archive/1/511327/100/0/threaded; http://websecurity.com.ua/4206/
CVE: CVE-2010-1992
Published: 2010-05-20
Description: Google Chrome 1.0.154.48 executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many IFRAME elements.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://websecurity.com.ua/4206/; http://www.securityfocus.com/archive/1/511327/100/0/threaded; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11363
CVE: CVE-2010-1993
Published: 2010-05-20
Description: Opera 9.52 does not properly handle an IFRAME element with a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (resource consumption) via an HTML document with many IFRAME elements.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html; http://websecurity.com.ua/4206/; http://www.securityfocus.com/archive/1/511327/100/0/threaded
CVE: CVE-2010-1994
Published: 2010-05-20
Description: SQL injection vulnerability in index.php in TomatoCMS before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the q parameter in conjunction with a /news/search PATH_INFO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://holisticinfosec.org/content/view/141/45/; http://osvdb.org/64551; http://secunia.com/advisories/39320
CVE: CVE-2010-1995
Published: 2010-05-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with "Add new article" privileges, to inject arbitrary web script or HTML via the (1) title, (2) subTitle, and (3) author parameters in conjunction with a /admin/news/article/add PATH_INFO.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/141/45/; http://osvdb.org/64550; http://secunia.com/advisories/39320
CVE: CVE-2010-1996
Published: 2010-05-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain creation privileges, to inject arbitrary web script or HTML via the (1) content parameter in conjunction with a /admin/poll/add PATH_INFO, the (2) meta parameter in conjunction with a /admin/category/add PATH_INFO, and the (3) keyword parameter in conjunction with a /admin/tag/add PATH_INFO.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/141/45/; http://osvdb.org/64552; http://osvdb.org/64553
CVE: CVE-2010-1997
Published: 2010-05-20
Description: Cross-site scripting (XSS) vulnerability in admin/edit.php in Saurus CMS 4.7.0 allows remote authenticated users, with "Article list" edit privileges, to inject arbitrary web script or HTML via the pealkiri parameter.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://osvdb.org/64570; http://packetstormsecurity.org/1005-exploits/sauruscms-xss.txt; http://secunia.com/advisories/39773
CVE: CVE-2010-1998
Published: 2010-05-20
Description: Cross-site scripting (XSS) vulnerability in the CCK TableField module 6.x before 6.x-1.2 for Drupal allows remote authenticated users, with certain node creation or editing privileges, to inject arbitrary web script or HTML via table headers.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/790364; http://drupal.org/node/790998; http://secunia.com/advisories/39644
CVE: CVE-2010-1999
Published: 2010-05-20
Description: Directory traversal vulnerability in scr/soustab.php in OpenMairie Opencatalogue 1.024, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsn[phptype] parameter, a related issue to CVE-2007-2069.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1005-exploits/opencatalogue-lfi.txt; http://secunia.com/advisories/39688; http://www.exploit-db.com/exploits/12475
CVE: CVE-2010-2000
Published: 2010-05-20
Description: Cross-site scripting (XSS) vulnerability in the Bibliography (Biblio) module 5.x through 5.x-1.17 and 6.x through 6.x-1.9 for Drupal allows remote authenticated users, with "administer biblio" privileges, to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-1358.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/796498; http://drupal.org/node/796502; http://drupal.org/node/797192
CVE: CVE-2010-2001
Published: 2010-05-20
Description: Cross-site scripting (XSS) vulnerability in the CiviRegister module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the URI.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://drupal.org/node/797342; http://drupal.org/node/797352; http://secunia.com/advisories/39806
CVE: CVE-2010-2002
Published: 2010-05-20
Description: Cross-site scripting (XSS) vulnerability in the Wordfilter module 5.x before 5.x-1.1 and 6.x before 6.x-1.1 for Drupal allows remote authenticated users, with "administer words filtered" privileges, to inject arbitrary web script or HTML via the word list.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/796618; http://drupal.org/node/796620; http://drupal.org/node/797208
CVE: CVE-2010-2003
Published: 2010-05-20
Description: Cross-site scripting (XSS) vulnerability in misc/get_admin.php in Advanced Poll 2.08 allows remote attackers to inject arbitrary web script or HTML via the mysql_host parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/64524; http://packetstormsecurity.org/1005-exploits/advancedpoll208-xss.txt; http://secunia.com/advisories/39768
CVE: CVE-2010-1145
Published: 2010-05-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-4498.  Reason: This candidate is a duplicate of CVE-2009-4498.  Notes: All CVE users should reference CVE-2009-4498 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-2004
Published: 2010-05-20
Description: Stack-based buffer overflow in BS.Global BS.Player 2.51 Build 1022 Free, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via the Skin parameter in the Options section of a skins file (.bsi), a different vulnerability than CVE-2009-1068.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38221; http://www.exploit-db.com/exploits/11154; http://www.mertsarica.com/?p=511
CVE: CVE-2010-2005
Published: 2010-05-20
Description: Multiple PHP remote file inclusion vulnerabilities in DataLife Engine (DLE) 8.3 allow remote attackers to execute arbitrary PHP code via a URL in (1) the selected_language parameter to engine/inc/include/init.php, (2) the config[langs] parameter to engine/inc/help.php, (3) the config[lang] parameter to engine/ajax/pm.php, (4) and the _REQUEST[skin] parameter to engine/ajax/addcomments.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.packetstormsecurity.com/1001-exploits/datalifeengine83-rfi.txt; http://www.securityfocus.com/bid/37851; https://exchange.xforce.ibmcloud.com/vulnerabilities/55757
CVE: CVE-2010-2006
Published: 2010-05-20
Description: Directory traversal vulnerability in op/op.Login.php in LetoDMS (formerly MyDMS) 1.7.2 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/61834; http://secunia.com/advisories/38237; http://secunia.com/advisories/42900
CVE: CVE-2010-2007
Published: 2010-05-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) 1.7.2 and earlier allow remote attackers to hijack the authentication of administrators for requests that use (1) op/op.EditUserData.php, (2) op/op.UsrMgr.php, (3) out/out.RemoveVersion.php, (4) op/op.RemoveFolder.php, (5) op/op.DefaultKeywords.php, (6) op/op.GroupMgr.php, (7) op/op.FolderAccess.php, (8) op/op.FolderNotify.php, or (9) op.MoveFolder.php in mydms.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/61835; http://secunia.com/advisories/38237; http://www.securityfocus.com/archive/1/508947/100/0/threaded
CVE: CVE-2010-1436
Published: 2010-05-21
Description: gfs2 in the Linux kernel 2.6.18, and possibly other versions, does not properly handle when the gfs2_quota struct occupies two separate pages, which allows local users to cause a denial of service (kernel panic) via certain manipulations that cause an out-of-bounds write, as demonstrated by writing from an ext3 file system to a gfs2 file system.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/43315; http://www.openwall.com/lists/oss-security/2010/04/27/1; http://www.openwall.com/lists/oss-security/2010/04/28/1
CVE: CVE-2010-1446
Published: 2010-05-21
Description: arch/powerpc/mm/fsl_booke_mmu.c in KGDB in the Linux kernel 2.6.30 and other versions before 2.6.33, when running on PowerPC, does not properly perform a security check for access to a kernel page, which allows local users to overwrite arbitrary kernel memory, related to Fsl booke.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00006.html; http://lkml.org/lkml/2010/5/10/458; http://secunia.com/advisories/39830
CVE: CVE-2010-1626
Published: 2010-05-21
Description: MySQL before 5.1.46 allows local users to delete the data and index files of another user's MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.
CVSS Score: 3.6 (LOW)
CWE: CWE-59, CWE-264
References: http://bugs.mysql.com/bug.php?id=40980; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html
CVE: CVE-2010-2009
Published: 2010-05-21
Description: Stack-based buffer overflow in the media library in BS.Global BS.Player 2.51 build 1022, 2.41 build 1003, and possibly other versions allows user-assisted remote attackers to execute arbitrary code via a long ID3 tag in a .MP3 file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38221; http://www.packetstormsecurity.org/1003-advisories/bsplayerml-overflow.txt; http://www.securityfocus.com/bid/38568
CVE: CVE-2010-0538
Published: 2010-05-21
Description: Apple Java for Mac OS X 10.5 before Update 7 and Java for Mac OS X 10.6 before Update 2 do not properly handle mediaLibImage objects, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted applet, related to the com.sun.medialib.mlib package.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html; http://secunia.com/advisories/39819
CVE: CVE-2010-0539
Published: 2010-05-21
Description: Integer signedness error in the window drawing implementation in Apple Java for Mac OS X 10.5 before Update 7 and Java for Mac OS X 10.6 before Update 2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted applet.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html; http://secunia.com/advisories/39819
CVE: CVE-2010-1546
Published: 2010-05-21
Description: Multiple eval injection vulnerabilities in the import functionality in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with "administer page manager" privileges, to execute arbitrary PHP code via input to a text area, related to (1) the page_manager_page_import_subtask_validate function in page_manager/plugins/tasks/page.admin.inc and (2) the page_manager_handler_import_validate function in page_manager/page_manager.admin.inc.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://drupal.org/node/803944; http://drupalcode.org/viewvc/drupal/contributions/modules/ctools/page_manager/page_manager.admin.inc?r1=1.27.2.9&r2=1.27.2.10; http://drupalcode.org/viewvc/drupal/contributions/modules/ctools/page_manager/page_manager.admin.inc?view=log
CVE: CVE-2010-1547
Published: 2010-05-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable a page via a q=admin/build/pages/nojs/enable/ value or (2) disable a page via a q=admin/build/pages/nojs/disable/ value.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/803944; http://seclists.org/fulldisclosure/2010/May/272; http://secunia.com/advisories/39884
CVE: CVE-2010-1548
Published: 2010-05-21
Description: The auto-complete functionality in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal does not follow access restrictions, which allows remote authenticated users, with "access content" privileges, to read the title of an unpublished node via a q=ctools/autocomplete/node/ value accompanied by the first character of the node's title.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://drupal.org/node/803944; http://seclists.org/fulldisclosure/2010/May/272; http://secunia.com/advisories/39884
CVE: CVE-2010-2010
Published: 2010-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote attackers to inject arbitrary web script or HTML via a node title.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/803944; http://secunia.com/advisories/39884; http://www.securityfocus.com/bid/40285
CVE: CVE-2010-2011
Published: 2010-05-21
Description: Microsoft Dynamics GP uses a substitution cipher to encrypt the system password field and unspecified other fields, which makes it easier for remote authenticated users to obtain sensitive information by decrypting a field's contents.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://blogs.msdn.com/developingfordynamicsgp/archive/2008/10/02/why-does-microsoft-dynamics-gp-encrypt-passwords.aspx; http://slashdot.org/story/10/05/21/1437227; http://www.christopherkois.com/?p=448
CVE: CVE-2010-2012
Published: 2010-05-24
Description: SQL injection vulnerability in function.php in MigasCMS 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the categorie parameter in a catalogo action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/64732; http://packetstormsecurity.org/1005-exploits/migascms-sql.txt; http://secunia.com/advisories/39878
CVE: CVE-2010-2013
Published: 2010-05-24
Description: Cross-site scripting (XSS) vulnerability in cp/edit_email.php in LiSK CMS 4.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/39912; http://www.htbridge.ch/advisory/xss_vulnerability_in_product.html; http://www.securityfocus.com/archive/1/511379/100/0/threaded
CVE: CVE-2010-2014
Published: 2010-05-24
Description: Cross-site scripting (XSS) vulnerability in cp/list_content.php in LiSK CMS 4.4 allows remote attackers to inject arbitrary web script or HTML via the cl or possibly id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/39912; http://www.htbridge.ch/advisory/xss_vulnerability_in_lisk_cms.html; http://secunia.com/advisories/39912
CVE: CVE-2010-2015
Published: 2010-05-24
Description: Multiple SQL injection vulnerabilities in LiSK CMS 4.4 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in a view_inbox action to cp/cp_messages.php or (2) the id parameter to cp/edit_email.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/39912; http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_lisk_cms.html; http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_lisk_cms_1.html
CVE: CVE-2010-2016
Published: 2010-05-24
Description: SQL injection vulnerability in details.php in Iceberg CMS allows remote attackers to execute arbitrary SQL commands via the p_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1005-exploits/iceberg-sql.txt; http://secunia.com/advisories/39833; http://www.exploit-db.com/exploits/12620
CVE: CVE-2010-2017
Published: 2010-05-24
Description: Cross-site scripting (XSS) vulnerability in hasil-pencarian.html in Lokomedia CMS 1.4.1 and 2.0 allows remote attackers to inject arbitrary web script or HTML via the kata parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/64748; http://packetstormsecurity.org/1005-exploits/lokomediacms-xss.txt; http://secunia.com/advisories/39863
CVE: CVE-2010-2018
Published: 2010-05-24
Description: Directory traversal vulnerability in downlot.php in Lokomedia CMS 1.4.1 and 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/64747; http://packetstormsecurity.org/1005-exploits/lokomediacms-disclose.txt; http://secunia.com/advisories/39863
CVE: CVE-2010-2019
Published: 2010-05-24
Description: SQL injection vulnerability in downlot.php in Lokomedia CMS 1.4.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the file parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/39863; http://secunia.com/advisories/39863
CVE: CVE-2006-7239
Published: 2010-05-24
Description: The _gnutls_x509_oid2mac_algorithm function in lib/gnutls_algorithms.c in GnuTLS before 1.4.2 allows remote attackers to cause a denial of service (crash) via a crafted X.509 certificate that uses a hash algorithm that is not supported by GnuTLS, which triggers a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://lists.gnupg.org/pipermail/gnutls-dev/2006-August/001190.html; http://lists.gnupg.org/pipermail/gnutls-dev/2006-August/001192.html; http://www.gnu.org/software/gnutls/security.html
CVE: CVE-2010-1688
Published: 2010-05-24
Description: Stack-based buffer overflow in 2BrightSparks SyncBack Freeware 3.2.20.0, and possibly other versions before 3.2.21, allows user-assisted remote attackers to execute arbitrary code via a long filename in a (1) .sps or (2) zip profile.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/64752; http://secunia.com/advisories/39865; http://www.2brightsparks.com/freeware/changes.html
CVE: CVE-2010-2027
Published: 2010-05-24
Description: Mathematica 7, when running on Linux, allows local users to overwrite arbitrary files via a symlink attack on (1) files within /tmp/MathLink/ or (2) /tmp/fonts$$.conf.
CVSS Score: 1.9 (LOW)
CWE: CWE-59
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1760&w=2; http://secunia.com/advisories/39805; http://www.securityfocus.com/archive/1/511298/100/0/threaded
CVE: CVE-2010-2028
Published: 2010-05-24
Description: Buffer overflow in k23productions TFTPUtil GUI (aka TFTPGUI) 1.4.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long transport mode.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/12482; http://www.exploit-db.com/exploits/12530; http://www.securityfocus.com/bid/39872
CVE: CVE-2010-2029
Published: 2010-05-24
Description: Cybozu Office 7 Ktai and Dotsales do not properly restrict access to the login page, which allows remote attackers to bypass authentication and obtain or modify sensitive information by using the unique ID of the user's cell phone.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://cybozu.co.jp/products/dl/notice/detail/0034.html; http://jvn.jp/en/jp/JVN87730223/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000016.html
CVE: CVE-2010-2030
Published: 2010-05-24
Description: Cross-site scripting (XSS) vulnerability in the External Link Page module 5.x before 5.x-1.0 and 6.x before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to the administration and redirect pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/803766; http://osvdb.org/64762; http://secunia.com/advisories/39888
CVE: CVE-2010-2031
Published: 2010-05-24
Description: KAVSafe.sys 2010.4.14.609 and earlier, as used in Kingsoft Webshield 3.5.1.2 and earlier, allows local users to overwrite arbitrary kernel memory via a crafted request to IOCTL 0x830020d4 on the KAVSafe device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/39916; http://www.exploit-db.com/exploits/12710; http://www.securityfocus.com/bid/40342
CVE: CVE-2010-2032
Published: 2010-05-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in resin-admin/digest.php in Caucho Technology Resin Professional 3.1.5, 3.1.10, 4.0.6, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the (1) digest_realm or (2) digest_username parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1005-exploits/cauchoresin312-xss.txt; http://secunia.com/advisories/39839; http://www.securityfocus.com/archive/1/511341/100/0/threaded
CVE: CVE-2010-2033
Published: 2010-05-25
Description: Directory traversal vulnerability in the Percha Multicategory Article (com_perchacategoriestree) component 0.6 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1005-exploits/joomlaperchact-lfi.txt; http://secunia.com/advisories/39873; http://www.securityfocus.com/bid/40244
CVE: CVE-2010-2034
Published: 2010-05-25
Description: Directory traversal vulnerability in the Percha Image Attach (com_perchaimageattach) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1005-exploits/joomlaperchaia-lfi.txt; http://www.securityfocus.com/bid/40244; http://packetstormsecurity.org/1005-exploits/joomlaperchaia-lfi.txt
CVE: CVE-2010-2035
Published: 2010-05-25
Description: Directory traversal vulnerability in the Percha Gallery (com_perchagallery) component 1.6 Beta for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1005-exploits/joomlaperchagl-lfi.txt; http://www.securityfocus.com/bid/40244; http://packetstormsecurity.org/1005-exploits/joomlaperchagl-lfi.txt