deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-2036
Published: 2010-05-25
Description: Directory traversal vulnerability in the Percha Fields Attach (com_perchafieldsattach) component 1.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1005-exploits/joomlaperchafa-lfi.txt; http://www.securityfocus.com/bid/40244; http://packetstormsecurity.org/1005-exploits/joomlaperchafa-lfi.txt
CVE: CVE-2010-2037
Published: 2010-05-25
Description: Directory traversal vulnerability in the Percha Downloads Attach (com_perchadownloadsattach) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1005-exploits/joomlaperchada-lfi.txt; http://www.securityfocus.com/bid/40244; http://packetstormsecurity.org/1005-exploits/joomlaperchada-lfi.txt
CVE: CVE-2010-2038
Published: 2010-05-25
Description: Cross-site scripting (XSS) vulnerability in include/tool/editing_files.php in gpEasy CMS 1.6.2 allows remote authenticated users, with Edit privileges, to inject arbitrary web script or HTML via the gpcontent parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.org/1005-exploits/gpeasycms-xss.txt; http://secunia.com/advisories/39643; http://www.htbridge.ch/advisory/xss_vulnerability_in_gpeasy_cms.html
CVE: CVE-2010-2039
Published: 2010-05-25
Description: Cross-site request forgery (CSRF) vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an Admin_Users action to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.org/1004-exploits/gpeasy-xsrf.txt; http://secunia.com/advisories/39643; http://www.exploit-db.com/exploits/12441
CVE: CVE-2010-2040
Published: 2010-05-25
Description: Cross-site scripting (XSS) vulnerability in search.php in V-EVA Shopzilla Affiliate Script PHP allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/64746; http://secunia.com/advisories/39877; http://www.packetstormsecurity.org/1005-exploits/shopzillaas-xss.txt
CVE: CVE-2010-2041
Published: 2010-05-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in PHP-Calendar before 2.0 Beta7 allow remote attackers to inject arbitrary web script or HTML via the (1) description and (2) lastaction parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1005-advisories/phpcalendar-xss.txt; http://php-calendar.blogspot.com/2010/05/php-calendar-20-beta7.html; http://secunia.com/advisories/33899
CVE: CVE-2010-2042
Published: 2010-05-25
Description: SQL injection vulnerability in search.php in ECShop 2.7.2 allows remote attackers to execute arbitrary SQL commands via the encode parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1005-exploits/ecshopsearch-sql.txt; http://secunia.com/advisories/39930; http://www.exploit-db.com/exploits/12702
CVE: CVE-2010-2043
Published: 2010-05-25
Description: Cross-site scripting (XSS) vulnerability in Home.aspx in DataTrack System 3.5 and 3.5.8019.4 allows remote attackers to inject arbitrary web script or HTML via the Work_Order_Summary parameter (aka the request summary).  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cross-site-scripting.blogspot.com/2010/05/datatrack-system-35-persistent-xss.html; http://osvdb.org/64727; http://packetstormsecurity.org/1005-exploits/datatrackserver35-xss.txt
CVE: CVE-2010-2044
Published: 2010-05-25
Description: SQL injection vulnerability in the Konsultasi (com_konsultasi) component 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the sid parameter in a detail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/64637; http://packetstormsecurity.org/1005-exploits/joomlakonsultasi-sql.txt; http://secunia.com/advisories/39816
CVE: CVE-2010-2045
Published: 2010-05-25
Description: Directory traversal vulnerability in the Dione Form Wizard (aka FDione or com_dioneformwizard) component 1.0.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/64633; http://packetstormsecurity.org/1005-exploits/joomlafdione-lfi.txt; http://secunia.com/advisories/39755
CVE: CVE-2010-2046
Published: 2010-05-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in the ActiveHelper LiveHelp (com_activehelper_livehelp) component 2.0.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via (1) the DOMAINID parameter to server/cookies.php or (2) the SERVER parameter to server/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1005-exploits/joomlaactivehelper-xss.txt; http://secunia.com/advisories/39870; http://www.securityfocus.com/bid/40278
CVE: CVE-2010-2047
Published: 2010-05-25
Description: SQL injection vulnerability in index.php in JE CMS 1.0.0 and 1.1 allows remote attackers to execute arbitrary SQL commands via the categoryid parameter in a viewcategory action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/64716; http://secunia.com/advisories/39851; http://www.exploit-db.com/exploits/12641
CVE: CVE-2010-2048
Published: 2010-05-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Heartbeat module 6.x before 6.x-4.9 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/802508; http://drupal.org/node/803570; http://secunia.com/advisories/39893
CVE: CVE-2010-2049
Published: 2010-05-25
Description: Cross-site scripting (XSS) vulnerability in jsp/audit/reports/ExportReport.jsp in ManageEngine ADAudit Plus 4.0.0 build 4043 allows remote attackers to inject arbitrary web script or HTML via the reportList parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/64726; http://secunia.com/advisories/39876; http://www.securityfocus.com/bid/40253
CVE: CVE-2010-2050
Published: 2010-05-25
Description: Directory traversal vulnerability in the Moron Solutions MS Comment (com_mscomment) component 0.8.0b for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1005-exploits/joomlamscomment-lfi.txt; http://www.exploit-db.com/exploits/12611; http://www.securityfocus.com/bid/40185
CVE: CVE-2010-2051
Published: 2010-05-25
Description: SQL injection vulnerability in article.php in Debliteck DBCart allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1005-exploits/dbcart-sql.txt; http://secunia.com/advisories/39867; http://www.exploit-db.com/exploits/12661
CVE: CVE-2010-2077
Published: 2010-05-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-1640.  Reason: This candidate is a duplicate of CVE-2010-1640.  Notes: All CVE users should reference CVE-2010-1640 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-2078
Published: 2010-05-25
Description: DataTrack System 3.5 allows remote attackers to list the root directory via a (1) /%u0085/ or (2) /%u00A0/ URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://cross-site-scripting.blogspot.com/2010/05/datatrack-system-35-persistent-xss.html; http://packetstormsecurity.org/1005-exploits/datatrackserver35-xss.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/58734
CVE: CVE-2010-2079
Published: 2010-05-25
Description: DataTrack System 3.5 allows remote attackers to bypass intended restrictions on file extensions, and read arbitrary files, via a trailing backslash in a URI, as demonstrated by (1) web.config\ and (2) .ascx\ files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://cross-site-scripting.blogspot.com/2010/05/datatrack-system-35-persistent-xss.html; http://packetstormsecurity.org/1005-exploits/datatrackserver35-xss.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/58735
CVE: CVE-2009-4873
Published: 2010-05-26
Description: Stack-based buffer overflow in the HTTP server in Rhino Software Serv-U Web Client 9.0.0.5 allows remote attackers to cause a denial of service (server crash) or execute arbitrary code via a long Session cookie.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/37228; http://www.rangos.de/ServU-ADV.txt; http://www.securityfocus.com/bid/36895
CVE: CVE-2009-4874
Published: 2010-05-26
Description: TalkBack 2.3.14 does not properly restrict access to the edit comment feature (comments.php), which allows remote attackers to modify comments.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/55745; http://secunia.com/advisories/35735; http://www.exploit-db.com/exploits/9095
CVE: CVE-2009-4875
Published: 2010-05-26
Description: FCKeditor.Java 2.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed request parameter that contains "ctrl" characters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://dev.fckeditor.net/ticket/3902; http://java.fckeditor.net/changes-report.html#a2.4.2; http://secunia.com/advisories/35870
CVE: CVE-2009-4876
Published: 2010-05-26
Description: admin/cikkform.php in Netrix CMS 1.0 allows remote attackers to modify arbitrary pages via a direct request using the cid parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/56008; http://secunia.com/advisories/35891; http://www.exploit-db.com/exploits/9203
CVE: CVE-2009-4877
Published: 2010-05-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in WebGUI before 7.7.14 allow remote attackers to hijack the authentication of users for unspecified requests via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/55798; http://secunia.com/advisories/35775; http://sourceforge.net/project/shownotes.php?release_id=695900
CVE: CVE-2009-4878
Published: 2010-05-26
Description: Unspecified vulnerability in the Administration Console in Novell Access Manager before 3.1 SP1 allows attackers to access system files via unknown attack vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/35898; http://www.novell.com/documentation/novellaccessmanager31/accessmanager_readme/data/accessmanager_readme.html; http://www.securityfocus.com/bid/35734
CVE: CVE-2009-4879
Published: 2010-05-26
Description: The Identity Server in Novell Access Manager before 3.1 SP1 allows attackers with disabled Active Directory accounts to authenticate using X.509 authentication, which bypasses intended access restrictions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://www.novell.com/documentation/novellaccessmanager31/accessmanager_readme/data/accessmanager_readme.html; http://www.securitytracker.com/id?1022581; http://www.novell.com/documentation/novellaccessmanager31/accessmanager_readme/data/accessmanager_readme.html
CVE: CVE-2010-1639
Published: 2010-05-26
Description: The cli_pdf function in libclamav/pdf.c in ClamAV before 0.96.1 allows remote attackers to cause a denial of service (crash) via a malformed PDF file, related to an inconsistency in the calculated stream length and the real stream length.
CVSS Score: 4.3 (MEDIUM)
References: http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=commitdiff%3Bh=f0eb394501ec21b9fe67f36cbf5db788711d4236#patch2; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055771.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055777.html
CVE: CVE-2010-1640
Published: 2010-05-26
Description: Off-by-one error in the parseicon function in libclamav/pe_icons.c in ClamAV 0.96 allows remote attackers to cause a denial of service (crash) via a crafted PE icon that triggers an out-of-bounds read, related to improper rounding during scaling.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=clamav-0.96.1; http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blobdiff%3Bf=libclamav/pe_icons.c%3Bh=3f1bc5be69d0f9d84e576814d1a3cc6f40c4ff2c%3Bhp=39a714f05968f9e929576bf171dd0eb58bf06bef%3Bhb=7f0e3bbf77382d9782e0189bf80f5f59a95779b3%3Bhpb=f0eb394501ec21b9fe67f36cbf5db788711d4236; http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
CVE: CVE-2010-1513
Published: 2010-05-26
Description: Multiple integer overflows in src/image.c in Ziproxy before 3.0.1 allow remote attackers to execute arbitrary code via (1) a large JPG image, related to the jpg2bitmap function or (2) a large PNG image, related to the png2bitmap function, leading to heap-based buffer overflows.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/39941; http://secunia.com/secunia_research/2010-75/; http://www.securityfocus.com/archive/1/511424/100/0/threaded
CVE: CVE-2010-2025
Published: 2010-05-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 allow remote attackers to hijack the authentication of administrators for requests that (1) reset the modem, (2) erase the firmware, (3) change the administrative password, (4) install modified firmware, or (5) change the access level, as demonstrated by a request to goform/_aslvl.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0322.html; http://www.securityfocus.com/bid/40346; http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0322.html
CVE: CVE-2010-2026
Published: 2010-05-26
Description: The web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 allows remote attackers to bypass authentication, and reset the modem or replace the firmware, via a direct request to an unspecified page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0322.html; http://www.securityfocus.com/bid/40346; http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0322.html
CVE: CVE-2010-2082
Published: 2010-05-26
Description: The web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 has a default administrative password (aka SAPassword) of W2402, which makes it easier for remote attackers to obtain privileged access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0322.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0322.html
CVE: CVE-2010-2083
Published: 2010-05-26
Description: Microsoft Dynamics GP has a default value of ACCESS for the system password, which might make it easier for remote authenticated users to bypass intended access restrictions via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://www.christopherkois.com/?p=448; http://www.christopherkois.com/?p=448
CVE: CVE-2010-1459
Published: 2010-05-27
Description: The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
CVE: CVE-2010-2084
Published: 2010-05-27
Description: Microsoft ASP.NET 2.0 does not prevent setting the InnerHtml property on a control that inherits from HtmlContainerControl, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to an attribute.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.communities.hp.com/securitysoftware/blogs/spilabs/archive/2010/03/30/configuration-is-half-the-battle-asp-net-and-cross-site-scripting.aspx; http://www.communities.hp.com/securitysoftware/blogs/spilabs/archive/2010/03/30/configuration-is-half-the-battle-asp-net-and-cross-site-scripting.aspx
CVE: CVE-2010-2085
Published: 2010-05-27
Description: The default configuration of ASP.NET in Microsoft .NET before 1.1 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the __VIEWSTATE parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf; https://www.trustwave.com/spiderlabs/advisories/TWSL2010-001.txt; http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf
CVE: CVE-2010-2086
Published: 2010-05-27
Description: Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79
References: http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf; https://www.trustwave.com/spiderlabs/advisories/TWSL2010-001.txt; http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf
CVE: CVE-2010-2087
Published: 2010-05-27
Description: Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf; https://www.trustwave.com/spiderlabs/advisories/TWSL2010-001.txt; http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf
CVE: CVE-2010-2088
Published: 2010-05-27
Description: ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks against the form control via the __VIEWSTATE parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf; https://www.trustwave.com/spiderlabs/advisories/TWSL2010-001.txt; http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf
CVE: CVE-2009-4134
Published: 2010-05-27
Description: Buffer underflow in the rgbimg module in Python 2.5 allows remote attackers to cause a denial of service (application crash) via a large ZSIZE value in a black-and-white (aka B/W) RGB image that triggers an invalid pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-787
References: http://bugs.python.org/issue8678; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-0595
Published: 2010-05-27
Description: Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 has a default password for the administrative user account and unspecified other accounts, which makes it easier for remote attackers to obtain privileged access, aka Bug ID CSCtb83495.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/39904; http://securitytracker.com/id?1024027; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c518.shtml
CVE: CVE-2010-0596
Published: 2010-05-27
Description: Unspecified vulnerability in Cisco Mediator Framework 2.2 before 2.2.1.dev.1 and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 allows remote authenticated users to read or modify the device configuration, and gain privileges, via a (1) HTTP or (2) HTTPS request, aka Bug ID CSCtb83607.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/39904; http://securitytracker.com/id?1024027; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c518.shtml
CVE: CVE-2010-0597
Published: 2010-05-27
Description: Unspecified vulnerability in Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 allows remote authenticated users to read or modify the device configuration, and gain privileges or cause a denial of service (device reload), via a (1) XML RPC or (2) XML RPC over HTTPS request, aka Bug ID CSCtb83618.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/39904; http://securitytracker.com/id?1024027; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c518.shtml
CVE: CVE-2010-0598
Published: 2010-05-27
Description: Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 does not encrypt HTTP sessions from operator workstations, which allows remote attackers to discover Administrator credentials by sniffing the network, aka Bug ID CSCtb83631.
CVSS Score: 9.3 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/39904; http://securitytracker.com/id?1024027; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c518.shtml
CVE: CVE-2010-0599
Published: 2010-05-27
Description: Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 does not encrypt XML RPC sessions from operator workstations, which allows remote attackers to discover Administrator credentials by sniffing the network, aka Bug ID CSCtb83505.
CVSS Score: 9.3 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/39904; http://securitytracker.com/id?1024027; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c518.shtml