deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-0073
Published: 2010-04-14
Description: Unspecified vulnerability in the WebLogic Server in Oracle WebLogic Server 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, and 10.3.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/39439; http://www.oracle.com/technology/deploy/security/alerts/alert-cve-2010-0073.html; http://www.us-cert.gov/cas/techalerts/TA10-103B.html
CVE: CVE-2010-0881
Published: 2010-04-14
Description: Unspecified vulnerability in the User Interface Components in Oracle Collaboration Suite 10.1.2.4 allows remote attackers to affect integrity via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/39440; http://www.oracle.com/technetwork/topics/security/cpuapr2010-099504.html; http://www.securityfocus.com/bid/39447
CVE: CVE-2010-1564
Published: 2010-04-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-1564.  Reason: This candidate is a duplicate of CVE-2009-1564.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2009-1564 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-0432
Published: 2010-04-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://svn.apache.org/viewvc?view=revision&revision=920369; http://svn.apache.org/viewvc?view=revision&revision=920370; http://svn.apache.org/viewvc?view=revision&revision=920371
CVE: CVE-2010-0436
Published: 2010-04-15
Description: Race condition in backend/ctrl.c in KDM in KDE Software Compilation (SC) 2.2.0 through 4.4.2 allows local users to change the permissions of arbitrary files, and consequently gain privileges, by blocking the removal of a certain directory that contains a control socket, related to improper interaction with ksm.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: ftp://ftp.kde.org/pub/kde/security_patches/kdebase-workspace-4.3.5-CVE-2010-0436.diff; http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039533.html; http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html
CVE: CVE-2010-0589
Published: 2010-04-15
Description: The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securitytracker.com/id?1023881; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml; http://www.securityfocus.com/bid/39478
CVE: CVE-2010-1329
Published: 2010-04-15
Description: Imperva SecureSphere Web Application Firewall and Database Firewall 5.0.0.5082 through 7.0.0.7078 allow remote attackers to bypass intrusion-prevention functionality via a request that has an appended long string containing an unspecified manipulation.
CVSS Score: 7.8 (HIGH)
References: http://www.clearskies.net/documents/css-advisory-css1001-imperva.php; http://www.imperva.com/resources/adc/adc_advisories_response_clearskies.html; http://www.securityfocus.com/archive/1/510709/100/0/threaded
CVE: CVE-2010-0994
Published: 2010-04-15
Description: Multiple buffer overflows in src/vl/vlDAT.cpp in Visualization Library 2009.08.812 allow user-assisted remote attackers to execute arbitrary code via a crafted DAT file, related to the (1) vl::loadDAT and (2) vl::isDAT functions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/38162; http://secunia.com/secunia_research/2010-02/; http://www.securityfocus.com/archive/1/510710/100/0/threaded
CVE: CVE-2010-1423
Published: 2010-04-15
Description: Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://lists.grok.org.uk/pipermail/full-disclosure/2010-April/074036.html; http://osvdb.org/63648; http://secunia.com/advisories/39260
CVE: CVE-2010-1424
Published: 2010-04-15
Description: Unspecified vulnerability in JustSystems Ichitaro and Ichitaro Government 2006 through 2010 allows user-assisted remote attackers to execute arbitrary code via a crafted font file.
CVSS Score: 9.3 (HIGH)
References: http://jvn.jp/en/jp/JVN98467259/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000015.html; http://osvdb.org/63651
CVE: CVE-2010-1425
Published: 2010-04-15
Description: F-Secure Internet Security 2010 and earlier; Anti-Virus for Microsoft Exchange 9 and earlier, and for MIMEsweeper 5.61 and earlier; Internet Gatekeeper for Windows 6.61 and earlier, and for Linux 4.02 and earlier; Anti-Virus 2010 and earlier; Home Server Security 2009; Protection Service for Consumers 9 and earlier, for Business - Workstation security 9 and earlier, for Business - Server Security 8 and earlier, and for E-mail and Server security 9 and earlier; Mac Protection build 8060 and earlier; Client Security 9 and earlier; and various Anti-Virus products for Windows, Linux, and Citrix; does not properly detect malware in crafted (1) 7Z, (2) GZIP, (3) CAB, or (4) RAR archives, which makes it easier for remote attackers to avoid detection.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/39396; http://www.f-secure.com/en_EMEA/support/security-advisory/fsc-2010-1.html; http://www.securitytracker.com/id?1023841
CVE: CVE-2010-1426
Published: 2010-04-15
Description: SQL injection vulnerability in MODx Evolution before 1.0.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors related to WebLogin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN19774883/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000012.html; http://modxcms.com/forums/index.php/topic%2C47759.msg280304.html#msg280304
CVE: CVE-2010-1427
Published: 2010-04-15
Description: Cross-site scripting (XSS) vulnerability in the SearchHighlight plugin in MODx Evolution before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to AjaxSearch.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN46669729/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000013.html; http://modxcms.com/forums/index.php/topic%2C47759.msg280304.html#msg280304
CVE: CVE-2010-0739
Published: 2010-04-16
Description: Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX Live and (2) teTeX might allow user-assisted remote attackers to execute arbitrary code via a crafted DVI file that triggers a heap-based buffer overflow.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-stable.git%3Ba=blob%3Bf=source/xapps-extra/tetex/texlive-CVE-2010-0739-int-overflow.patch; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041573.html; http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
CVE: CVE-2010-1460
Published: 2010-04-16
Description: The IBM BladeCenter with Advanced Management Module (AMM) firmware before bpet50g does not properly perform interrupt sharing for USB and iSCSI, which allows remote attackers to cause a denial of service (management module reboot) via TCP packets with malformed application data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://dsecrg.com/pages/vul/show.php?id=149; http://www-947.ibm.com/systems/support/supportsite.wss/docdisplay?lndocid=MIGR-5083945&brandind=5000020; http://www.securityfocus.com/archive/1/510744/100/0/threaded
CVE: CVE-2010-1155
Published: 2010-04-16
Description: Irssi before 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://github.com/ensc/irssi-proxy/commit/85bbc05b21678e80423815d2ef1dfe26208491ab; http://irssi.org/news; http://irssi.org/news/ChangeLog
CVE: CVE-2010-1156
Published: 2010-04-16
Description: core/nicklist.c in Irssi before 0.8.15 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to an attempted fuzzy nick match at the instant that a victim leaves a channel.
CVSS Score: 4.3 (MEDIUM)
References: http://irssi.org/news; http://irssi.org/news/ChangeLog; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041054.html
CVE: CVE-2010-1160
Published: 2010-04-16
Description: GNU nano before 2.2.4 does not verify whether a file has been changed before it is overwritten in a file-save operation, which allows local user-assisted attackers to overwrite arbitrary files via a symlink attack on an attacker-owned file that is being edited by the victim.
CVSS Score: 1.9 (LOW)
CWE: CWE-59
References: http://drosenbe.blogspot.com/2010/03/nano-as-root.html; http://lists.gnu.org/archive/html/nano-devel/2010-04/msg00000.html; http://secunia.com/advisories/39444
CVE: CVE-2010-1161
Published: 2010-04-16
Description: Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-assisted attackers to change the ownership of arbitrary files via vectors related to the creation of backup files.
CVSS Score: 3.7 (LOW)
CWE: CWE-362
References: http://drosenbe.blogspot.com/2010/03/nano-as-root.html; http://lists.gnu.org/archive/html/nano-devel/2010-04/msg00000.html; http://secunia.com/advisories/39444
CVE: CVE-2010-1163
Published: 2010-04-16
Description: The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039986.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/39384
CVE: CVE-2010-1461
Published: 2010-04-16
Description: Directory traversal vulnerability in the Photo Battle (com_photobattle) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files via the view parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/63800; http://secunia.com/advisories/39469; http://www.exploit-db.com/exploits/12232
CVE: CVE-2010-1462
Published: 2010-04-16
Description: Directory traversal vulnerability in WebAsyst Shop-Script FREE has unknown impact and attack vectors via the sub parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/510741/100/0/threaded; http://www.vupen.com/english/advisories/2010/0882; http://www.vupen.com/english/research-web.php
CVE: CVE-2010-1463
Published: 2010-04-16
Description: Multiple SQL injection vulnerabilities in WebAsyst Shop-Script FREE allow attackers to execute arbitrary SQL commands via the (1) add2cart, (2) c_id, (3) categoryID, (4) list_price, (5) name, (6) new_offer, (7) price, (8) product_code, (9) productID, (10) rating, and (11) save_product parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/510741/100/0/threaded; http://www.vupen.com/english/advisories/2010/0882; http://www.vupen.com/english/research-web.php
CVE: CVE-2010-1464
Published: 2010-04-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebAsyst Shop-Script FREE allow remote attackers to inject arbitrary web script or HTML via the (1) currency_id_left, (2) currency_id_right, (3) darkcolor, (4) lightcolor, (5) middlecolor, and (6) w parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/510741/100/0/threaded; http://www.vupen.com/english/advisories/2010/0882; http://www.vupen.com/english/research-web.php
CVE: CVE-2010-1465
Published: 2010-04-16
Description: Stack-based buffer overflow in Trellian FTP client 3.01, including 3.1.3.1789, allows remote attackers to execute arbitrary code via a long PASV response.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/39370; http://www.exploit-db.com/exploits/12152; https://exchange.xforce.ibmcloud.com/vulnerabilities/57778
CVE: CVE-2010-1466
Published: 2010-04-16
Description: Directory traversal vulnerability in scr/soustab.php in openUrgence Vaccin 1.03 allows remote attackers to read arbitrary files via the dsn[phptype] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/39400; http://www.exploit-db.com/exploits/12193; http://www.securityfocus.com/bid/39412
CVE: CVE-2010-1467
Published: 2010-04-16
Description: Multiple PHP remote file inclusion vulnerabilities in openUrgence Vaccin 1.03 allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) collectivite.class.php, (2) injection.class.php, (3) utilisateur.class.php, (4) droit.class.php, (5) laboratoire.class.php, (6) vaccin.class.php, (7) effetsecondaire.class.php, (8) medecin.class.php, (9) individu.class.php, and (10) profil.class.php in gen/obj/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/39400; http://www.exploit-db.com/exploits/12193; http://www.securityfocus.com/bid/39412
CVE: CVE-2010-1468
Published: 2010-04-19
Description: SQL injection vulnerability in the Multi-Venue Restaurant Menu Manager (aka MVRMM or com_mv_restaurantmenumanager) component 1.5.2 Stable Update 3 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the mid parameter in a menu_display action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/joomlamvrmm-sql.txt; http://secunia.com/advisories/39217; http://www.exploit-db.com/exploits/12159
CVE: CVE-2010-1469
Published: 2010-04-19
Description: Directory traversal vulnerability in the Ternaria Informatica JProject Manager (com_jprojectmanager) component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlajprojectmanager-lfi.txt; http://secunia.com/advisories/39282; http://www.exploit-db.com/exploits/12146
CVE: CVE-2010-1470
Published: 2010-04-19
Description: Directory traversal vulnerability in the Web TV (com_webtv) component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlawebtv-lfi.txt; http://secunia.com/advisories/39405; http://www.exploit-db.com/exploits/12166
CVE: CVE-2010-1471
Published: 2010-04-19
Description: Directory traversal vulnerability in the AddressBook (com_addressbook) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlaaddressbook-lfi.txt; http://secunia.com/advisories/39412; http://www.exploit-db.com/exploits/12170
CVE: CVE-2010-1472
Published: 2010-04-19
Description: Directory traversal vulnerability in the Daily Horoscope (com_horoscope) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlahoroscope-lfi.txt; http://secunia.com/advisories/39406; http://www.exploit-db.com/exploits/12167
CVE: CVE-2010-1473
Published: 2010-04-19
Description: Directory traversal vulnerability in the Advertising (com_advertising) component 0.25 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlaeasyadbanner-lfi.txt; http://secunia.com/advisories/39410; http://www.exploit-db.com/exploits/12171
CVE: CVE-2010-1474
Published: 2010-04-19
Description: Directory traversal vulnerability in the Sweety Keeper (com_sweetykeeper) component 1.5.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlasweetykeeper-lfi.txt; http://secunia.com/advisories/39388; http://www.exploit-db.com/exploits/12182
CVE: CVE-2010-1475
Published: 2010-04-19
Description: Directory traversal vulnerability in the Preventive & Reservation (com_preventive) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlapr-lfi.txt; http://secunia.com/advisories/39285; http://www.exploit-db.com/exploits/12147
CVE: CVE-2010-1476
Published: 2010-04-19
Description: Directory traversal vulnerability in the AlphaUserPoints (com_alphauserpoints) component 1.5.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the view parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlaalphauserpoints-lfi.txt; http://secunia.com/advisories/39250; http://www.alphaplug.com/
CVE: CVE-2010-1477
Published: 2010-04-19
Description: SQL injection vulnerability in the SermonSpeaker (com_sermonspeaker) component before 3.2.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a latest_sermons action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://joomlacode.org/gf/project/sermon_speaker/forum/?action=ForumBrowse&forum_id=7897&_forum_action=ForumMessageBrowse&thread_id=15219; http://joomlacode.org/gf/project/sermon_speaker/news/?action=NewsThreadView&id=2549; http://packetstormsecurity.org/1004-exploits/joomlasermonspeaker-sql.txt
CVE: CVE-2010-1478
Published: 2010-04-19
Description: Directory traversal vulnerability in the Ternaria Informatica Jfeedback! (com_jfeedback) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlajfeedback-lfi.txt; http://secunia.com/advisories/39262; http://www.exploit-db.com/exploits/12145
CVE: CVE-2010-1479
Published: 2010-04-19
Description: SQL injection vulnerability in the RokModule (com_rokmodule) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the moduleid parameter in a raw action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/joomlarokmodule-bsql.txt; http://secunia.com/advisories/39255; http://www.exploit-db.com/exploits/12148
CVE: CVE-2010-1480
Published: 2010-04-19
Description: SQL injection vulnerability in the RokModule (com_rokmodule) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the module parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/39255; http://www.rockettheme.com/extensions-downloads/free/rokmodule/1040-rokmodule-component/download; http://www.rockettheme.com/extensions-updates/673-rokmodule-security-update-released
CVE: CVE-2009-4767
Published: 2010-04-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Plohni Shoutbox 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) input_name and (2) input_text parameters. NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/60310; http://secunia.com/advisories/37418; http://www.exploit-db.com/exploits/10168
CVE: CVE-2009-4768
Published: 2010-04-20
Description: Unspecified vulnerability in the JASS script interpreter in Warcraft III: The Frozen Throne 1.24b and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted custom map.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://forums.battle.net/thread.html?topicId=[PII_REDACTED]; http://secunia.com/advisories/37390; http://www.securityfocus.com/bid/37052
CVE: CVE-2009-4769
Published: 2010-04-20
Description: Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow (1) remote attackers to execute arbitrary code via format string specifiers in a GET request to the HTTP server component when logging is enabled, and allow (2) remote authenticated users to execute arbitrary code via format string specifiers in a PWD command to the FTP server component.
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://osvdb.org/60181; http://osvdb.org/60182; http://www.metasploit.com/redmine/projects/framework/repository/revisions/7569/entry/modules/exploits/windows/ftp/httpdx_tolog_format.rb
CVE: CVE-2009-4770
Published: 2010-04-20
Description: The FTP server component in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 has a default password of pass123 for the moderator account, which makes it easier for remote attackers to obtain privileged access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://www.metasploit.com/redmine/projects/framework/repository/revisions/7569/entry/modules/exploits/windows/ftp/httpdx_tolog_format.rb; http://www.metasploit.com/redmine/projects/framework/repository/revisions/7569/entry/modules/exploits/windows/ftp/httpdx_tolog_format.rb
CVE: CVE-2009-4771
Published: 2010-04-20
Description: The PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal does not properly validate orders, which allows remote attackers to trigger unspecified "duplicate actions" via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://drupal.org/node/636576; http://osvdb.org/60290; http://secunia.com/advisories/37440