deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1955
Published: 2010-05-19
Description: Directory traversal vulnerability in the Deluxe Blog Factory (com_blogfactory) component 1.1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/63801; http://packetstormsecurity.org/1004-exploits/joomladeluxeblog-lfi.txt; http://secunia.com/advisories/39473
CVE: CVE-2010-1956
Published: 2010-05-19
Description: Directory traversal vulnerability in the Gadget Factory (com_gadgetfactory) component 1.0.0 and 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/63917; http://packetstormsecurity.org/1004-exploits/joomlagadgetfactory-lfi.txt; http://secunia.com/advisories/39522
CVE: CVE-2010-1957
Published: 2010-05-19
Description: Directory traversal vulnerability in the Love Factory (com_lovefactory) component 1.3.4 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/63803; http://packetstormsecurity.org/1004-exploits/joomlalovefactory-lfi.txt; http://secunia.com/advisories/39471
CVE: CVE-2010-1944
Published: 2010-05-19
Description: Multiple PHP remote file inclusion vulnerabilities in openMairie openCimetiere 2.01, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) autorisation.class.php, (2) courrierautorisation.class.php, (3) droit.class.php, (4) profil.class.php, (5) temp_defunt_sansemplacement.class.php, (6) utils.class.php, (7) cimetiere.class.php, (8) defunt.class.php, (9) emplacement.class.php, (10) tab_emplacement.class.php, (11) temp_emplacement.class.php, (12) voie.class.php, (13) collectivite.class.php, (14) defunttransfert.class.php, (15) entreprise.class.php, (16) temp_autorisation.class.php, (17) travaux.class.php, (18) zone.class.php, (19) courrier.class.php, (20) dossier.class.php, (21) plans.class.php, (22) temp_defunt.class.php, and (23) utilisateur.class.php in obj/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.org/1005-exploits/opencimetiere-rfi.txt; http://secunia.com/advisories/39687; http://www.exploit-db.com/exploits/12476
CVE: CVE-2010-1945
Published: 2010-05-19
Description: Multiple PHP remote file inclusion vulnerabilities in openMairie Openfoncier 2.00, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) action.class.php, (2) architecte.class.php, (3) avis.class.php, (4) bible.class.php, and (5) blocnote.class.php in obj/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.org/1004-exploits/openfoncier-rfilfi.txt; http://secunia.com/advisories/39607; http://www.exploit-db.com/exploits/12366
CVE: CVE-2010-1946
Published: 2010-05-19
Description: Multiple PHP remote file inclusion vulnerabilities in openMairie Openregistrecil 1.02, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) autorisation_normale.class.php, (2) collectivite.class.php, (3) dossier.class.php, (4) norme_simplifiee.class.php, (5) registre.class.php, (6) autorisation_unique.class.php, (7) demande_avis.class.php, (8) droit.class.php, (9) organisme.class.php, (10) service.class.php, (11) categorie_donnee.class.php, (12) destinataire.class.php, (13) profil.class.php, (14) tabdyn_visu.class.php, (15) categorie_personne.class.php, (16) dispense.class.php, (17) modificatif.class.php, (18) reference.class.php, and (19) utilisateur.class.php in obj/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.org/1004-exploits/openregistrecil-rfilfi.txt; http://secunia.com/advisories/39534; http://www.exploit-db.com/exploits/12313
CVE: CVE-2010-1947
Published: 2010-05-19
Description: Directory traversal vulnerability in scr/soustab.php in openMairie Openregistrecil 1.02, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsn[phptype] parameter.  NOTE: this may be related to CVE-2007-2069.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/openregistrecil-rfilfi.txt; http://secunia.com/advisories/39534; http://www.exploit-db.com/exploits/12313
CVE: CVE-2010-1948
Published: 2010-05-19
Description: Directory traversal vulnerability in scr/soustab.php in openMairie Openfoncier 2.00, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsn[phptype] parameter, a related issue to CVE-2007-2069.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/openfoncier-rfilfi.txt; http://secunia.com/advisories/39607; http://www.exploit-db.com/exploits/12366
CVE: CVE-2010-1941
Published: 2010-05-19
Description: Unspecified vulnerability in NEC WebSAM DeploymentManager 5.13 and earlier, as used in SigmaSystemCenter 2.1 Update2 and earlier, BladeSystemCenter, ExpressSystemCenter, and VirtualPCCenter 2.2 and earlier, allows remote attackers to cause a denial of service (OS shutdown or restart) via unknown vectors related to Client Service for DPM and crafted packets to port 56010.
CVSS Score: 7.8 (HIGH)
References: http://jvn.jp/en/jp/JVN90872372/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000019.html; http://osvdb.org/64700
CVE: CVE-2010-1942
Published: 2010-05-19
Description: Unspecified vulnerability in the Servlet service in Fujitsu Limited Interstage Application Server 3.0 through 7.0, as used in Interstage Application Framework Suite, Interstage Business Application Server, and Interstage List Manager, allows attackers to obtain sensitive information or force invalid requests to be processed via unknown vectors related to unspecified invalid requests and settings on the load balancing device.
CVSS Score: 6.4 (MEDIUM)
References: http://jvn.jp/en/jp/JVN90248889/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000018.html; http://osvdb.org/64703
CVE: CVE-2010-1943
Published: 2010-05-19
Description: Unspecified vulnerability in NEC CapsSuite Small Edition PatchMeister 2.0 Update2 and earlier allows remote attackers to cause a denial of service (OS shutdown or restart) via vectors related to Client Service for PTM and crafted packets to port 56015.
CVSS Score: 7.8 (HIGH)
References: http://jvn.jp/en/jp/JVN82749282/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000020.html; http://osvdb.org/64701
CVE: CVE-2010-0403
Published: 2010-05-19
Description: Directory traversal vulnerability in about.php in phpGroupWare (phpgw) before 0.9.16.016 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the app parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://download.phpgroupware.org/; http://forums.phpgroupware.org/index.php?t=msg&th=98662&start=0&rid=0; http://lists.gnu.org/archive/html/phpgroupware-users/2010-05/msg00004.html
CVE: CVE-2010-0404
Published: 2010-05-19
Description: Multiple SQL injection vulnerabilities in phpGroupWare (phpgw) before 0.9.16.016 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) class.sessions_db.inc.php, (2) class.translation_sql.inc.php, or (3) class.auth_sql.inc.php in phpgwapi/inc/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://download.phpgroupware.org/; http://forums.phpgroupware.org/index.php?t=msg&th=98662&start=0&rid=0; http://lists.gnu.org/archive/html/phpgroupware-users/2010-05/msg00004.html
CVE: CVE-2010-1584
Published: 2010-05-19
Description: Cross-site scripting (XSS) vulnerability in the Context module before 6.x-2.0-rc4 for Drupal allows remote authenticated users, with Administer Blocks privileges, to inject arbitrary web script or HTML via a block description.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://crackingdrupal.com/blog/greggles/mitigation-against-cve-2010-1584-drupal-context-module-xss; http://drupal.org/cvs?commit=365210; http://drupal.org/node/794718
CVE: CVE-2010-1169
Published: 2010-05-19
Description: PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 does not properly restrict PL/perl procedures, which allows remote authenticated users, with database-creation privileges, to execute arbitrary Perl code via a crafted script, related to the Safe module (aka Safe.pm) for Perl. NOTE: some sources report that this issue is the same as CVE-2010-1447.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041559.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041579.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041591.html
CVE: CVE-2010-1170
Published: 2010-05-19
Description: The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 loads Tcl code from the pltcl_modules table regardless of the table's ownership and permissions, which allows remote authenticated users, with database-creation privileges, to execute arbitrary Tcl code by creating this table and inserting a crafted Tcl script.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041559.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041579.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041591.html
CVE: CVE-2010-1321
Published: 2010-05-19
Description: The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-476
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041615.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041645.html
CVE: CVE-2010-1447
Published: 2010-05-19
Description: The Safe (aka Safe.pm) module 2.26, and certain earlier versions, for Perl, as used in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2, allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving subroutine references and delayed execution.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://osvdb.org/64756; http://secunia.com/advisories/39845
CVE: CVE-2010-1454
Published: 2010-05-19
Description: com.springsource.tcserver.serviceability.rmi.JmxSocketListener in VMware SpringSource tc Server Runtime 6.0.19 and 6.0.20 before 6.0.20.D, and 6.0.25.A before 6.0.25.A-SR01, does not properly enforce the requirement for an encrypted (aka s2enc) password, which allows remote attackers to obtain JMX interface access via a blank password.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/39778; http://www.securityfocus.com/archive/1/511307/100/0/threaded; http://www.securityfocus.com/bid/40205
CVE: CVE-2010-1974
Published: 2010-05-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-1168.  Reason: This candidate is a duplicate of CVE-2010-1168.  Notes: All CVE users should reference CVE-2010-1168 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-1975
Published: 2010-05-19
Description: PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1119&w=2; http://secunia.com/advisories/39939
CVE: CVE-2010-1976
Published: 2010-05-19
Description: Cross-site scripting (XSS) vulnerability in the Taxonomy Breadcrumb module 6.x before 6.x-1.1 for Drupal allows remote authenticated users, with administer taxonomy permissions, to inject arbitrary web script or HTML via the node title in a Breadcrumb display.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/757974; http://drupal.org/node/757980; http://drupal.org/node/758456
CVE: CVE-2010-1977
Published: 2010-05-19
Description: Directory traversal vulnerability in the J!WHMCS Integrator (com_jwhmcs) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/39356; http://www.exploit-db.com/exploits/12083; http://www.securityfocus.com/bid/39243
CVE: CVE-2010-1978
Published: 2010-05-19
Description: PHP remote file inclusion vulnerability in default_theme.php in FreePHPBlogSoftware 1.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the phpincdir parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/39321; http://www.exploit-db.com/exploits/12063; http://www.osvdb.org/63558
CVE: CVE-2010-1979
Published: 2010-05-19
Description: Directory traversal vulnerability in the Affiliate Datafeeds (com_datafeeds) component build 880 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/39360; http://www.exploit-db.com/exploits/12088; http://www.securityfocus.com/bid/39246
CVE: CVE-2010-1980
Published: 2010-05-19
Description: Directory traversal vulnerability in joomlaflickr.php in the Joomla Flickr (com_joomlaflickr) component 1.0.3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://bitbucket.org/roberto.aloi/joomla-flickr/changeset/64ebf6b25030; http://packetstormsecurity.org/1004-exploits/joomlaflickr-lfi.txt; http://secunia.com/advisories/39358
CVE: CVE-2010-1981
Published: 2010-05-19
Description: Directory traversal vulnerability in the Fabrik (com_fabrik) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlafabrik-lfi.txt; http://www.exploit-db.com/exploits/12087; https://exchange.xforce.ibmcloud.com/vulnerabilities/57571
CVE: CVE-2010-1982
Published: 2010-05-19
Description: Directory traversal vulnerability in the JA Voice (com_javoice) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlajavoice-lfi.txt; http://secunia.com/advisories/39202; http://www.exploit-db.com/exploits/12121
CVE: CVE-2010-1983
Published: 2010-05-19
Description: Directory traversal vulnerability in the redTWITTER (com_redtwitter) component 1.0.x including 1.0b11 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://evilc0de.blogspot.com/2010/04/joomla-component-redtwitter-lfi-vuln.html; http://osvdb.org/63533; http://packetstormsecurity.org/1004-exploits/joomlaredtwitter-lfi.txt
CVE: CVE-2010-1984
Published: 2010-05-19
Description: Cross-site scripting (XSS) vulnerability in the Taxonomy Breadcrumb module 5.x before 5.x-1.5 and 6.x before 6.x-1.1 for Drupal allows remote authenticated users, with administer taxonomy permissions, to inject arbitrary web script or HTML via the taxonomy term name in a Breadcrumb display.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/757974; http://drupal.org/node/757980; http://drupal.org/node/758456
CVE: CVE-2010-1456
Published: 2010-05-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-1455.  Reason: This candidate is a duplicate of CVE-2010-1455.  Notes: All CVE users should reference CVE-2010-1455 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-1627
Published: 2010-05-19
Description: feed.php in phpBB 3.0.7 before 3.0.7-PL1 does not properly check permissions for feeds, which allows remote attackers to bypass intended access restrictions via unspecified attack vectors related to permission settings on a private forum.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2010/05/16/1; http://www.openwall.com/lists/oss-security/2010/05/18/6; http://www.phpbb.com/community/viewtopic.php?f=14&t=2014195
CVE: CVE-2010-1628
Published: 2010-05-19
Description: Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited recursive procedure invocations, which trigger memory corruption in the stack of the interpreter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://bugs.ghostscript.com/show_bug.cgi?id=691295; http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html; http://seclists.org/fulldisclosure/2010/May/134
CVE: CVE-2010-1629
Published: 2010-05-19
Description: Cross-site scripting (XSS) vulnerability in Phorum before 5.2.15 allows remote attackers to inject arbitrary web script or HTML via an invalid email address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/64759; http://www.facebook.com/note.php?note_id=[PII_REDACTED]81; http://www.openwall.com/lists/oss-security/2010/05/16/2
CVE: CVE-2010-1630
Published: 2010-05-19
Description: Unspecified vulnerability in posting.php in phpBB before 3.0.5 has unknown impact and attack vectors related to the use of a "forum id" in circumstances related to a "global announcement."
CVSS Score: 7.5 (HIGH)
References: http://github.com/phpbb/phpbb3/commit/4ea3402f9363c9259881bc8ea6ce7fc6cb212657; http://www.openwall.com/lists/oss-security/2010/05/16/1; http://www.openwall.com/lists/oss-security/2010/05/18/12
CVE: CVE-2010-1985
Published: 2010-05-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in Six Apart Movable Type 5.0 and 5.01 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN92854093/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000017.html; http://secunia.com/advisories/39741
CVE: CVE-2010-0745
Published: 2010-05-20
Description: Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU consumption) via long headers in an e-mail message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://dovecot.org/list/dovecot-news/2010-March/000152.html; http://dovecot.org/pipermail/dovecot/2010-February/047190.html; http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
CVE: CVE-2010-1039
Published: 2010-05-20
Description: Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11, B.11.23, and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code via an RPC request containing format string specifiers in an invalid directory name.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://aix.software.ibm.com/aix/efixes/security/pcnfsd_advisory.asc; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9933&w=2; http://osvdb.org/64729
CVE: CVE-2010-1986
Published: 2010-05-20
Description: Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption and application crash) via JavaScript code that creates multiple arrays containing elements with long string values, and then appends long strings to the content of a P element, related to the gfxWindowsFontGroup::MakeTextRun function in xul.dll, a different vulnerability than CVE-2009-1571.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.exploit-db.com/exploits/12678; http://www.osvdb.org/64791; http://www.securityfocus.com/archive/1/511329/100/0/threaded
CVE: CVE-2010-1987
Published: 2010-05-20
Description: Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption, out-of-bounds read, and application crash) via JavaScript code that appends long strings to the content of a P element, and performs certain other string concatenation and substring operations, related to the DoubleWideCharMappedString class in USP10.dll and the gfxWindowsFontGroup::GetUnderlineOffset function in xul.dll, a different vulnerability than CVE-2009-1571.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/64790; http://www.exploit-db.com/exploits/12678; http://www.securityfocus.com/archive/1/511329/100/0/threaded
CVE: CVE-2010-1988
Published: 2010-05-20
Description: Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via JavaScript code that performs certain string concatenation and substring operations, a different vulnerability than CVE-2009-1571.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/64789; http://www.exploit-db.com/exploits/12678; http://www.securityfocus.com/archive/1/511329/100/0/threaded
CVE: CVE-2010-1989
Published: 2010-05-20
Description: Opera 9.52 executes a mail application in situations where an IMG element has a SRC attribute that is a redirect to a mailto: URL, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many images, a related issue to CVE-2010-0181.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://websecurity.com.ua/4206/; http://www.securityfocus.com/archive/1/511327/100/0/threaded; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11664
CVE: CVE-2010-1990
Published: 2010-05-20
Description: Mozilla Firefox 3.6.x, 3.5.x, 3.0.19, and earlier, and SeaMonkey, executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many IFRAME elements.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://websecurity.com.ua/4206/; http://www.securityfocus.com/archive/1/511327/100/0/threaded; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12386