deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-0740
Published: 2011-02-02
Description: Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in RSS Feed Reader 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/70644; http://secunia.com/advisories/43071; http://www.autosectools.com/Advisories/WordPress.RSS.Feed.Reader.for.WordPress.0.1_Reflected.Cross-site.Scripting_82.html
CVE: CVE-2011-0741
Published: 2011-02-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in ModX Evolution before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) installer or (2) image editor.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://modxcms.com/forums/index.php/topic%2C60045.0.html; http://www.securityfocus.com/bid/46154; https://exchange.xforce.ibmcloud.com/vulnerabilities/65164
CVE: CVE-2011-0742
Published: 2011-02-02
Description: Buffer overflow in ZfHIPCND.exe in Novell ZENworks Handheld Management 7.0 allows remote attackers to execute arbitrary code via a crafted IP Conduit packet to TCP port 2400.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/70694; http://secunia.com/advisories/43094; http://telussecuritylabs.com/threats/show/FSC20110125-06
CVE: CVE-2011-0752
Published: 2011-02-02
Description: The extract function in PHP before 5.2.15 does not prevent use of the EXTR_OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2507&w=2; http://www.openwall.com/lists/oss-security/2010/12/13/4; http://www.php.net/ChangeLog-5.php
CVE: CVE-2011-0753
Published: 2011-02-02
Description: Race condition in the PCNTL extension in PHP before 5.3.4, when a user-defined signal handler exists, might allow context-dependent attackers to cause a denial of service (memory corruption) via a large number of concurrent signals.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://bugs.php.net/52784; http://www.php.net/ChangeLog-5.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/65431
CVE: CVE-2011-0754
Published: 2011-02-02
Description: The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat structure, related to lack of a FILE_ATTRIBUTE_REPARSE_POINT check.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://bugs.php.net/51763; http://www.php.net/ChangeLog-5.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/65429
CVE: CVE-2011-0755
Published: 2011-02-02
Description: Integer overflow in the mt_rand function in PHP before 5.3.4 might make it easier for context-dependent attackers to predict the return values by leveraging a script's use of a large max parameter, as demonstrated by a value that exceeds mt_getrandmax.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://bugs.php.net/46587; http://www.php.net/ChangeLog-5.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/65426
CVE: CVE-2010-3041
Published: 2011-02-02
Description: Multiple buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted (1) .wrf or (2) .arf file, related to atas32.dll, a different vulnerability than CVE-2010-3042, CVE-2010-3043, and CVE-2010-3044.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securitytracker.com/id?1025016; http://tools.cisco.com/security/center/viewAlert.x?alertId=22016; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6913f.shtml
CVE: CVE-2010-3042
Published: 2011-02-02
Description: Multiple buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted (1) .wrf or (2) .arf file, a different vulnerability than CVE-2010-3041, CVE-2010-3043, and CVE-2010-3044.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securitytracker.com/id?1025016; http://tools.cisco.com/security/center/viewAlert.x?alertId=22016; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6913f.shtml
CVE: CVE-2010-3043
Published: 2011-02-02
Description: Multiple buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted (1) .wrf or (2) .arf file, a different vulnerability than CVE-2010-3041, CVE-2010-3042, and CVE-2010-3044.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securitytracker.com/id?1025016; http://tools.cisco.com/security/center/viewAlert.x?alertId=22016; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6913f.shtml
CVE: CVE-2010-3044
Published: 2011-02-02
Description: Multiple buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted (1) .wrf or (2) .arf file, related to atas32.dll, a different vulnerability than CVE-2010-3041, CVE-2010-3042, and CVE-2010-3043.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securitytracker.com/id?1025016; http://tools.cisco.com/security/center/viewAlert.x?alertId=22016; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6913f.shtml
CVE: CVE-2010-3269
Published: 2011-02-02
Description: Multiple stack-based buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to execute arbitrary code via a crafted (1) .wrf or (2) .arf file, related to use of a function pointer in a callback mechanism.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securitytracker.com/id?1025015; http://tools.cisco.com/security/center/viewAlert.x?alertId=22016; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6913f.shtml
CVE: CVE-2010-3270
Published: 2011-02-02
Description: Stack-based buffer overflow in Cisco WebEx Meeting Center T27LB before SP21 EP3 and T27LC before SP22 allows user-assisted remote authenticated users to execute arbitrary code by providing a crafted .atp file and then disconnecting from a meeting.  NOTE: since this is a site-specific issue with no expected action for consumers, it might be REJECTed.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://securitytracker.com/id?1025015; http://tools.cisco.com/security/center/viewAlert.x?alertId=22355; http://www.coresecurity.com/content/webex-atp-and-wrf-overflow-vulnerabilities
CVE: CVE-2011-0521
Published: 2011-02-02
Description: The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2 does not check the sign of a certain integer field, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a negative value.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=cb26a24ee9706473f31d34cc259f4dcf45cd0644; http://openwall.com/lists/oss-security/2011/01/24/2; http://openwall.com/lists/oss-security/2011/01/25/2
CVE: CVE-2011-0757
Published: 2011-02-02
Description: IBM DB2 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP2 on Linux, UNIX, and Windows does not properly revoke the DBADM authority, which allows remote authenticated users to execute non-DDL statements by leveraging previous possession of this authority.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/70773; http://secunia.com/advisories/43148; http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC66811
CVE: CVE-2011-0354
Published: 2011-02-03
Description: The default configuration of Cisco Tandberg C Series Endpoints, and Tandberg E and EX Personal Video units, with software before TC4.0.0 has a blank password for the root account, which makes it easier for remote attackers to obtain access via an unspecified login method.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/43158; http://securityreason.com/securityalert/8060; http://securitytracker.com/id?1025017
CVE: CVE-2011-0451
Published: 2011-02-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) data/Smarty/templates/default/list.tpl and (2) data/Smarty/templates/default/campaign/bloc/cart_tag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN84393059/index.html; http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000011.html; http://secunia.com/advisories/43153
CVE: CVE-2009-5052
Published: 2011-02-03
Description: Multiple unspecified vulnerabilities in Smarty before 3.0.0 beta 6 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt; http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt
CVE: CVE-2009-5053
Published: 2011-02-03
Description: Unspecified vulnerability in Smarty before 3.0.0 beta 6 allows remote attackers to execute arbitrary PHP code by injecting this code into a cache file.
CVSS Score: 7.5 (HIGH)
References: http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt; http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt
CVE: CVE-2009-5054
Published: 2011-02-03
Description: Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt; http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt
CVE: CVE-2010-4722
Published: 2011-02-03
Description: Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt; http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt
CVE: CVE-2010-4723
Published: 2011-02-03
Description: Smarty before 3.0.0, when security is enabled, does not prevent access to the (1) dynamic and (2) private object members of an assigned object, which has unspecified impact and remote attack vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt; http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt
CVE: CVE-2010-4724
Published: 2011-02-03
Description: Multiple unspecified vulnerabilities in the parser implementation in Smarty before 3.0.0 RC3 have unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt; http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt
CVE: CVE-2010-4725
Published: 2011-02-03
Description: Smarty before 3.0.0 RC3 does not properly handle an on value of the asp_tags option in the php.ini file, which has unspecified impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt; http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt
CVE: CVE-2010-4726
Published: 2011-02-03
Description: Unspecified vulnerability in the math plugin in Smarty before 3.0.0 RC1 has unknown impact and remote attack vectors.  NOTE: this might overlap CVE-2009-1669.
CVSS Score: 10.0 (HIGH)
References: http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt; http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt
CVE: CVE-2010-4727
Published: 2011-02-03
Description: Smarty before 3.0.0 beta 7 does not properly handle the <?php and ?> tags, which has unspecified impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt; http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt
CVE: CVE-2011-0720
Published: 2011-02-03
Description: Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/70753; http://plone.org/products/plone/security/advisories/cve-2011-0720; http://secunia.com/advisories/43146
CVE: CVE-2004-0694
Published: 2011-02-04
Description: Buffer overflow in LHA 1.14 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to "command line processing," a different vulnerability than CVE-2004-0771.  NOTE: this issue may be REJECTED if there are not any cases in which LHA is setuid or is otherwise used across security boundaries.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.redhat.com/support/errata/RHSA-2004-323.html; http://www.redhat.com/support/errata/RHSA-2004-440.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9981
CVE: CVE-2011-0047
Published: 2011-02-04
Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.2 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) comments, aka "CSS injection vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059235.html
CVE: CVE-2011-0049
Published: 2011-02-04
Description: Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/70762; http://secunia.com/advisories/43125; http://securityreason.com/securityalert/8061
CVE: CVE-2011-0537
Published: 2011-02-04
Description: Multiple directory traversal vulnerabilities in (1) languages/Language.php and (2) includes/StubObject.php in MediaWiki 1.8.0 and other versions before 1.16.2, when running on Windows and possibly Novell Netware, allow remote attackers to include and execute arbitrary local PHP files via vectors related to a crafted language file and the Language::factory function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.2.patch.gz; http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html; http://osvdb.org/70798
CVE: CVE-2011-0649
Published: 2011-02-04
Description: Multiple unspecified vulnerabilities in TIBCO Rendezvous 8.2.1 through 8.3.0, Enterprise Message Service (EMS) 5.1.0 through 6.0.0, Runtime Agent (TRA) 5.6.2 through 5.7.0, Silver BPM Service before 1.0.4, Silver CAP Service vebefore 1.0.2, and Silver BusinessWorks Service 1.0.0, when running on Unix systems, allow local users to gain root privileges via unknown vectors related to SUID and (1) Rendezvous Routing Daemon (rvrd), (2) Rendezvous Secure Daemon (rvsd), (3) Rendezvous Secure Routing Daemon (rvsrd), and (4) EMS Server (tibemsd).
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/43160; http://secunia.com/advisories/43174; http://www.securityfocus.com/bid/46104
CVE: CVE-2011-0771
Published: 2011-02-04
Description: The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded from an external login provider site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://drupal.org/node/1033154; http://osvdb.org/70623; http://secunia.com/advisories/42980
CVE: CVE-2011-0772
Published: 2011-02-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in PivotX 2.2.0, and possibly other versions before 2.2.2, allow remote attackers to inject arbitrary web script or HTML via the (1) color parameter to includes/blogroll.php or (2) src parameter to includes/timwrapper.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.pivotx.net/archive/2011/01/11/pivotx-222-released; http://pivot-weblog.svn.sf.net/viewvc/pivot-weblog?view=revision&revision=3409; http://pivot-weblog.svn.sf.net/viewvc/pivot-weblog?view=revision&revision=3410
CVE: CVE-2011-0773
Published: 2011-02-04
Description: Cross-site scripting (XSS) vulnerability in pivotx/modules/module_image.php in PivotX before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the image parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.pivotx.net/2011-01-31/pivotx-223-released; http://osvdb.org/70672; http://packetstormsecurity.org/files/view/97831/Pivotx222-xss.txt
CVE: CVE-2011-0774
Published: 2011-02-04
Description: PivotX before 2.2.2 allows remote attackers to obtain sensitive information via a direct request to (1) includes/ping.php and (2) includes/spamping.php, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://blog.pivotx.net/archive/2011/01/11/pivotx-222-released; http://pivot-weblog.svn.sf.net/viewvc/pivot-weblog?view=revision&revision=3410; http://www.htbridge.ch/advisory/path_disclousure_in_pivotx.html
CVE: CVE-2011-0775
Published: 2011-02-04
Description: pivotx/modules/module_image.php in PivotX 2.2.2 allows remote attackers to obtain sensitive information via a non-existent file in the image parameter, which reveals the installation path in an error message.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/70675; http://pivot-weblog.svn.sf.net/viewvc/pivot-weblog?view=revision&revision=3463; http://secunia.com/advisories/43041
CVE: CVE-2011-0776
Published: 2011-02-04
Description: The sandbox implementation in Google Chrome before 9.0.597.84 on Mac OS X might allow remote attackers to obtain potentially sensitive information about local files via vectors related to the stat system call.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=42989; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13895
CVE: CVE-2011-0777
Published: 2011-02-04
Description: Use-after-free vulnerability in Google Chrome before 9.0.597.84 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to image loading.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=55831; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html; http://secunia.com/advisories/43368
CVE: CVE-2011-0778
Published: 2011-02-04
Description: Google Chrome before 9.0.597.84 does not properly restrict drag and drop operations, which might allow remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://code.google.com/p/chromium/issues/detail?id=59081; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
CVE: CVE-2011-0779
Published: 2011-02-04
Description: Google Chrome before 9.0.597.84 does not properly handle a missing key in an extension, which allows remote attackers to cause a denial of service (application crash) via a crafted extension.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=62791; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html; http://secunia.com/advisories/43782
CVE: CVE-2011-0780
Published: 2011-02-04
Description: The PDF event handler in Google Chrome before 9.0.597.84 does not properly interact with print operations, which allows user-assisted remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=64051; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14530
CVE: CVE-2011-0781
Published: 2011-02-04
Description: Google Chrome before 9.0.597.84 does not properly handle autofill profile merging, which has unspecified impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14413; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html
CVE: CVE-2011-0782
Published: 2011-02-04
Description: Google Chrome before 9.0.597.84 on Mac OS X does not properly mitigate an unspecified flaw in the Mac OS X 10.5 SSL libraries, which allows remote attackers to cause a denial of service (application crash) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=66931; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14243
CVE: CVE-2011-0783
Published: 2011-02-04
Description: Unspecified vulnerability in Google Chrome before 9.0.597.84 allows user-assisted remote attackers to cause a denial of service (application crash) via vectors involving a "bad volume setting."
CVSS Score: 4.3 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=68244; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html; http://secunia.com/advisories/43368
CVE: CVE-2011-0784
Published: 2011-02-04
Description: Race condition in Google Chrome before 9.0.597.84 allows remote attackers to execute arbitrary code via vectors related to audio.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://code.google.com/p/chromium/issues/detail?id=69195; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14108
CVE: CVE-2011-0025
Published: 2011-02-04
Description: IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://blog.fuseyism.com/index.php/2011/02/01/security-icedtea6-178-185-195-released/; http://icedtea.classpath.org/hg/release/icedtea-web-1.0?cmd=changeset%3Bnode=3bd328e4b515; http://secunia.com/advisories/43135