deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-0424
Published: 2010-02-25
Description: The edit_cmd function in crontab.c in (1) cronie before 1.4.4 and (2) Vixie cron (vixie-cron) allows local users to change the modification times of arbitrary files, and consequently cause a denial of service, via a symlink attack on a temporary file in the /tmp directory.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://git.fedorahosted.org/git/cronie.git?p=cronie.git%3Ba=commit%3Bh=9e4a8fa5f9171fb724981f53879c9b20264aeb61; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035762.html; http://secunia.com/advisories/38700
CVE: CVE-2010-0427
Published: 2010-02-25
Description: sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.9p21.patch.gz; http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html; http://secunia.com/advisories/38762
CVE: CVE-2010-0683
Published: 2010-02-25
Description: Unspecified vulnerability in TIBRepoServer5.jar in TIBCO Administrator 5.4.0 through 5.6.0, when JMS transport is used, allows remote authenticated users to execute arbitrary code on all domain nodes via vectors related to leveraging administrative credentials.
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/38732; http://www.securityfocus.com/bid/38396; http://www.tibco.com/multimedia/security_advisory_administrator_tcm8-10685.txt
CVE: CVE-2010-0708
Published: 2010-02-25
Description: Multiple unspecified vulnerabilities in (1) ns-slapd and (2) slapd.exe in Sun Directory Server Enterprise Edition 7.0, Sun Java System Directory Server 5.2, and Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 allow remote attackers to cause a denial of service (daemon crash) via a crafted LDAP search request.
CVSS Score: 5.0 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-143884-01-1; http://sunsolve.sun.com/search/document.do?assetkey=1-26-275711-1; http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021788.1-1
CVE: CVE-2010-0709
Published: 2010-02-25
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Limny 2.0 allow remote attackers to (1) hijack the authentication of users or administrators for requests that change the email address or password via the user action to index.php, and (2) hijack the authentication of the administrator for requests that create a new user via the admin/modules/user/new action to limny/index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/62389; http://secunia.com/advisories/38616; http://www.exploit-db.com/exploits/11477
CVE: CVE-2010-0710
Published: 2010-02-25
Description: SQL injection vulnerability in default.asp in ASPCode CMS 1.5.8, 2.0.0 Build 103, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the newsid parameter when the sec parameter is 26.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62358; http://secunia.com/advisories/38596; http://osvdb.org/62358
CVE: CVE-2010-0711
Published: 2010-02-25
Description: Cross-site request forgery (CSRF) vulnerability in default.asp in ASPCode CMS 1.5.8, 2.0.0 Build 103, and possibly other versions, allows remote attackers to hijack the authentication of an administrator for requests that (1) delete users via the delete action in the ma2 parameter or (2) create administrators via the update action in the ma2 parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/62357; http://packetstormsecurity.org/1002-exploits/aspcodecms-xssxsrf.txt; http://secunia.com/advisories/38596
CVE: CVE-2010-0712
Published: 2010-02-26
Description: Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote authenticated users to execute arbitrary SQL commands via the (1) severity, (2) state, (3) filter, (4) offset, and (5) count parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://dev.zenoss.org/trac/changeset/15257; http://osvdb.org/61804; http://secunia.com/advisories/38195
CVE: CVE-2010-0713
Published: 2010-02-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss 2.3.3, and other versions before 2.5, allow remote attackers to hijack the authentication of an administrator for (1) requests that reset user passwords via zport/dmd/ZenUsers/admin, and (2) requests that change user commands, which allows for remote execution of system commands via zport/dmd/userCommands/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/61805; http://secunia.com/advisories/38195; http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-002-zenoss-multiple-admin-csrf/
CVE: CVE-2009-4652
Published: 2010-02-26
Description: The (1) Conn_GetCipherInfo and (2) Conn_UsesSSL functions in src/ngircd/conn.c in ngIRCd 13 and 14, when SSL/TLS support is present and standalone mode is disabled, allow remote attackers to cause a denial of service (application crash) by sending the MOTD command from another server in the same IRC network, possibly related to an array index error.
CVSS Score: 2.6 (LOW)
References: http://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git%3Ba=blobdiff%3Bf=src/ngircd/conn.c%3Bh=c6095a31c613bc5ca127d55b8723e15b836f1cca%3Bhp=9752a6191c7e2da5b0df64779e9cc28ad1e6241c%3Bhb=627b0b713c52406e50c84bb9459e[PII_REDACTED]a2%3Bhpb=95428a72ffb5214826b61d5e77f860e7ef6a6c9e; http://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git%3Ba=commit%3Bh=627b0b713c52406e50c84bb9459e[PII_REDACTED]a2; http://ngircd.barton.de/doc/ChangeLog
CVE: CVE-2009-4653
Published: 2010-02-26
Description: Stack-based buffer overflow in the dhost module in Novell eDirectory 8.8 SP5 for Windows allows remote authenticated users to cause a denial of service (dhost.exe crash) and possibly execute arbitrary code via a long string to /dhost/modules?I:.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/507812/100/0/threaded; http://www.securityfocus.com/bid/37009; https://exchange.xforce.ibmcloud.com/vulnerabilities/54264
CVE: CVE-2009-4654
Published: 2010-02-26
Description: Stack-based buffer overflow in the dhost module in Novell eDirectory 8.8 SP5 for Windows allows remote authenticated users to execute arbitrary code via long sadminpwd and verifypwd parameters in a submit action to /dhost/httpstk.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://downloads.securityfocus.com/vulnerabilities/exploits/37042-2.pl; http://tcc.hellcode.net/advisories/hellcode-adv005.txt; http://tcc.hellcode.net/sploitz/httpstk.txt
CVE: CVE-2009-4655
Published: 2010-02-26
Description: The dhost web service in Novell eDirectory 8.8.5 uses a predictable session cookie, which makes it easier for remote attackers to hijack sessions via a modified cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://osvdb.org/60035; http://www.metasploit.com/modules/auxiliary/admin/edirectory/edirectory_dhost_cookie; http://www.metasploit.com/redmine/projects/framework/repository/entry/modules/auxiliary/admin/edirectory/edirectory_dhost_cookie.rb
CVE: CVE-2005-4886
Published: 2010-02-26
Description: The selinux_parse_skb_ipv6 function in security/selinux/hooks.c in the Linux kernel before 2.6.12-rc4 allows remote attackers to cause a denial of service (OOPS) via vectors associated with an incorrect call to the ipv6_skip_exthdr function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0d3d077cd4f1154e63a9858e47fe3fb1ad0c03e5; http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.12/ChangeLog-2.6.12-rc4; http://www.openwall.com/lists/oss-security/2010/02/22/3
CVE: CVE-2010-0667
Published: 2010-02-26
Description: MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://hg.moinmo.in/moin/1.9/raw-file/1.9.1/docs/CHANGES; http://hg.moinmo.in/moin/1.9/rev/04afdde50094; http://hg.moinmo.in/moin/1.9/rev/9d8e7ce3c3a2
CVE: CVE-2010-0668
Published: 2010-02-26
Description: Unspecified vulnerability in MoinMoin 1.5.x through 1.7.x, 1.8.x before 1.8.7, and 1.9.x before 1.9.2 has unknown impact and attack vectors, related to configurations that have a non-empty superuser list, the xmlrpc action enabled, the SyncPages action enabled, or OpenID configured.
CVSS Score: 6.8 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=569975; http://hg.moinmo.in/moin/1.8/raw-file/1.8.7/docs/CHANGES; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035374.html
CVE: CVE-2010-0669
Published: 2010-02-26
Description: MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://hg.moinmo.in/moin/1.8/raw-file/1.8.7/docs/CHANGES; http://moinmo.in/MoinMoinRelease1.8; http://moinmo.in/SecurityFixes
CVE: CVE-2010-0689
Published: 2010-02-26
Description: The ExecuteExe method in the DVBSExeCall Control ActiveX control 1.0.0.1 in DVBSExeCall.ocx in DATEV Base System (aka Grundpaket Basis) allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/62564; http://secunia.com/advisories/38716; http://sotiriu.de/adv/NSOADV-2010-003.txt
CVE: CVE-2010-0714
Published: 2010-02-26
Description: Cross-site scripting (XSS) vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0, 8.0.0.2, 8.1, 8.1.1, and 8.1.1.1 for WebSphere Portal; allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21421469; http://www-1.ibm.com/support/docview.wss?uid=swg1PM03233; http://www.hacktics.com/content/advisories/AdvIBM20100224.html
CVE: CVE-2010-0715
Published: 2010-02-26
Description: Open redirect vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0, 8.0.0.2, 8.1, 8.1.1, and 8.1.1.1 for WebSphere Portal; allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the query string.
CVSS Score: 6.8 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21421469; http://www.hacktics.com/content/advisories/AdvIBM20100224.html; http://www.securityfocus.com/archive/1/509744/100/0/threaded
CVE: CVE-2010-0716
Published: 2010-02-26
Description: _layouts/Upload.aspx in the Documents module in Microsoft SharePoint before 2010 uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading TXT files, a related issue to CVE-2008-5026. NOTE: the vendor disputes the significance of this issue, because cross-domain isolation can be implemented when needed.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.hacktics.com/content/advisories/AdvMS20100222.html; http://www.securityfocus.com/archive/1/509683/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/56597
CVE: CVE-2010-0717
Published: 2010-02-26
Description: The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://hg.moinmo.in/moin/1.8/raw-file/1.8.7/docs/CHANGES; http://moinmo.in/MoinMoinRelease1.8; http://secunia.com/advisories/38903
CVE: CVE-2010-0718
Published: 2010-02-26
Description: Buffer overflow in Microsoft Windows Media Player 9 and 11.0.5721.5145 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted .mpg file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/11531; https://exchange.xforce.ibmcloud.com/vulnerabilities/56435; http://www.exploit-db.com/exploits/11531
CVE: CVE-2010-0719
Published: 2010-02-26
Description: An unspecified API in Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, and Windows 7 does not validate arguments, which allows local users to cause a denial of service (system crash) via a crafted application.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/62660; http://securitytracker.com/id?1023656; http://www.scmagazineus.com/malta-researchers-find-windows-bug-that-crashes-pcs/article/164439/
CVE: CVE-2010-0720
Published: 2010-02-26
Description: SQL injection vulnerability in news.php in Erotik Auktionshaus allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://4004securityproject.wordpress.com/2009/10/21/erotik-auktionshaus-sql-injection-news-php/; http://packetstormsecurity.org/1002-exploits/erotik-sql.txt; http://secunia.com/advisories/38614
CVE: CVE-2010-0721
Published: 2010-02-26
Description: SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1002-exploits/auktionshausgelb-sql.txt; http://www.exploit-db.com/exploits/11488; https://exchange.xforce.ibmcloud.com/vulnerabilities/56332
CVE: CVE-2010-0722
Published: 2010-02-26
Description: SQL injection vulnerability in news.php in Php Auktion Pro allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://4004securityproject.wordpress.com/2010/02/22/php-auktion-pro-sql-injection-news-php/; http://secunia.com/advisories/38679; http://www.exploit-db.com/exploits/11547
CVE: CVE-2010-0723
Published: 2010-02-26
Description: SQL injection vulnerability in news.php in Ero Auktion 2.0 and 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://4004securityproject.wordpress.com/2010/02/21/ero-auktion-2010-sql-injection-news-php/; http://4004securityproject.wordpress.com/2010/02/21/ero-auktion-v-2-0-sql-injection-news-php/; http://packetstormsecurity.org/1002-exploits/eroauktion20-sql.txt
CVE: CVE-2010-0724
Published: 2010-02-26
Description: SQL injection vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1002-exploits/arabcart-sqlxss.txt; http://www.exploit-db.com/exploits/11524; http://www.securityfocus.com/bid/38426
CVE: CVE-2010-0725
Published: 2010-02-26
Description: Cross-site scripting (XSS) vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1002-exploits/arabcart-sqlxss.txt; http://www.exploit-db.com/exploits/11524; http://www.securityfocus.com/bid/38426
CVE: CVE-2010-0752
Published: 2010-02-27
Description: The week_post_page function in the Weekly Archive by Node Type module 6.x before 6.x-2.7 for Drupal does not properly implement node access restrictions when constructing SQL queries, which allows remote attackers to read restricted node listings via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/723776; http://drupal.org/node/724286; http://osvdb.org/62565
CVE: CVE-2010-0753
Published: 2010-02-27
Description: SQL injection vulnerability in the SQL Reports (com_sqlreport) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter to ajax/print.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62534; http://secunia.com/advisories/38678; http://www.exploit-db.com/exploits/11549
CVE: CVE-2010-0754
Published: 2010-02-27
Description: Cross-site scripting (XSS) vulnerability in index.php/Special/Main/Templates in WikyBlog 1.7.2 and 1.7.3 rc2 allows remote attackers to inject arbitrary web script or HTML via the which parameter in a copy action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0067.html; http://osvdb.org/62558; http://packetstormsecurity.org/1002-exploits/wikyblog-rfishellxss.txt
CVE: CVE-2010-0755
Published: 2010-02-27
Description: PHP remote file inclusion vulnerability in include/WBmap.php in WikyBlog 1.7.3 rc2 allows remote attackers to execute arbitrary PHP code via a URL in the langFile parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/62647; http://packetstormsecurity.org/1002-exploits/wikyblog-rfishellxss.txt; http://www.exploit-db.com/exploits/11560
CVE: CVE-2010-0756
Published: 2010-02-27
Description: Session fixation vulnerability in WikyBlog 1.7.3 rc2 allows remote attackers to hijack web sessions by setting the jsessionid parameter to (1) index.php/Comment/Main, (2) index.php/Comment/Main/Home_Wiky, or (3) index.php/Edit/Main.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://packetstormsecurity.org/1002-exploits/wikyblog-rfishellxss.txt; http://www.exploit-db.com/exploits/11560; http://www.securityfocus.com/bid/38386
CVE: CVE-2010-0757
Published: 2010-02-27
Description: Unrestricted file upload vulnerability in index.php/Attach in WikyBlog 1.7.3rc2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension using the uploadform action, then accessing it via a direct request to the file in userfiles/[username]/uploaded/.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/62648; http://packetstormsecurity.org/1002-exploits/wikyblog-rfishellxss.txt; http://www.exploit-db.com/exploits/11560
CVE: CVE-2010-0758
Published: 2010-02-27
Description: SQL injection vulnerability in news_desc.php in Softbiz Jobs allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1002-exploits/softbizjobs-sql.txt; http://www.exploit-db.com/exploits/11518; http://www.securityfocus.com/bid/38344
CVE: CVE-2010-0759
Published: 2010-02-27
Description: Directory traversal vulnerability in plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allows remote attackers to read, and possibly include and execute, arbitrary files via directory traversal sequences in the files[] parameter, a different vector than CVE-2010-0760.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1002-exploits/joomlascriptegrator-lfi.txt; http://secunia.com/advisories/38637; http://www.exploit-db.com/exploits/11498
CVE: CVE-2010-0760
Published: 2010-02-27
Description: Multiple directory traversal vulnerabilities in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) file parameter to libraries/jquery/js/ui/jsloader.php and the (2) files[] parameter to libraries/jquery/js/jsloader.php, a different vector than CVE-2010-0759.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/38637; http://www.osvdb.org/62484; http://www.osvdb.org/62485
CVE: CVE-2009-3297
Published: 2010-03-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-0787, CVE-2010-0788, CVE-2010-0789.  Reason: this candidate was intended for one issue in Samba, but it was used for multiple distinct issues, including one in FUSE and one in ncpfs.  Notes: All CVE users should consult CVE-2010-0787 (Samba), CVE-2010-0788 (ncpfs), and CVE-2010-0789 (FUSE) to determine which ID is appropriate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-0761
Published: 2010-03-02
Description: SQL injection vulnerability in index.php in CommodityRentals Books/eBooks Rentals Script allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a gamecatalog action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62277; http://packetstormsecurity.org/1002-exploits/ebooksrental-sql.txt; http://secunia.com/advisories/38520
CVE: CVE-2010-0762
Published: 2010-03-02
Description: SQL injection vulnerability in index.php in CommodityRentals CD Rental Software allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a catalog action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1002-exploits/cdrentals-sql.txt; http://secunia.com/advisories/38519; http://www.exploit-db.com/exploits/11401
CVE: CVE-2010-0763
Published: 2010-03-02
Description: SQL injection vulnerability in index.php in CommodityRentals Vacation Rental Software allows remote attackers to execute arbitrary SQL commands via the rental_id parameter in a CalendarView action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/38552; http://www.exploit-db.com/exploits/11410; http://www.securityfocus.com/bid/38208
CVE: CVE-2010-0764
Published: 2010-03-02
Description: SQL injection vulnerability in index.php in KuwaitPHP eSmile allows remote attackers to execute arbitrary SQL commands via the cid parameter in a show action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62272; http://packetstormsecurity.org/1002-exploits/esmile-sql.txt; http://secunia.com/advisories/38548
CVE: CVE-2010-0765
Published: 2010-03-02
Description: fipsForum 2.6 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for _database/forumFips.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.org/1001-exploits/fipsforum-disclose.txt; http://www.exploit-db.com/exploits/11361; https://exchange.xforce.ibmcloud.com/vulnerabilities/56183
CVE: CVE-2010-0787
Published: 2010-03-02
Description: client/mount.cifs.c in mount.cifs in smbfs in Samba 3.0.22, 3.0.28a, 3.2.3, 3.3.2, 3.4.0, and 3.4.5 allows local users to mount a CIFS share on an arbitrary mountpoint, and gain privileges, via a symlink attack on the mountpoint directory file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://git.samba.org/?p=samba.git%3Ba=commit%3Bh=3ae5dac462c4ed0fb2cd94553583c56fce2f9d80; http://git.samba.org/?p=samba.git%3Ba=commit%3Bh=a0c31ec1c8d1220a5884e40d9ba6b191a04a24d5; http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034444.html
CVE: CVE-2010-0788
Published: 2010-03-02
Description: ncpfs 2.2.6 allows local users to cause a denial of service, obtain sensitive information, or possibly gain privileges via symlink attacks involving the (1) ncpmount and (2) ncpumount programs.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034403.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034422.html; http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html