deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-1007
Published: 2011-02-28
Description: Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login, which allows physically proximate attackers to obtain credentials by resubmitting the login form via the back button of a web browser on an unattended workstation after an RT logout.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614575; http://issues.bestpractical.com/Ticket/Display.html?id=15804; http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html
CVE: CVE-2011-1008
Published: 2011-02-28
Description: Scrips_Overlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information, related to SQL logging.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614576; http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html; http://openwall.com/lists/oss-security/2011/02/22/12
CVE: CVE-2011-1016
Published: 2011-02-28
Description: The Radeon GPU drivers in the Linux kernel before 2.6.38-rc5 do not properly validate data related to the AA resolve registers, which allows local users to write to arbitrary memory locations associated with (1) Video RAM (aka VRAM) or (2) the Graphics Translation Table (GTT) via crafted values.
CVSS Score: 1.9 (LOW)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fff1ce4dc6113b6fdc4e3a815ca5fd229408f8ef; http://openwall.com/lists/oss-security/2011/02/24/11; http://openwall.com/lists/oss-security/2011/02/24/3
CVE: CVE-2011-1020
Published: 2011-02-28
Description: The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write system calls.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: http://openwall.com/lists/oss-security/2011/02/24/18; http://openwall.com/lists/oss-security/2011/02/25/2; http://seclists.org/fulldisclosure/2011/Jan/421
CVE: CVE-2011-1104
Published: 2011-02-28
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that (1) change a PIN, (2) delete messages, (3) add a delivery address, or (4) change a delivery address.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/43483; http://www.kb.cert.org/vuls/id/136612; http://www.securityfocus.com/bid/46537
CVE: CVE-2011-1105
Published: 2011-02-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mutare EVM allow remote attackers to inject arbitrary web script or HTML via (1) a delivery address and possibly (2) a PIN.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/136612; https://exchange.xforce.ibmcloud.com/vulnerabilities/65768; http://www.kb.cert.org/vuls/id/136612
CVE: CVE-2010-4747
Published: 2011-03-01
Description: Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pluginurl parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/42545; http://www.johnleitch.net/Vulnerabilities/WordPress.Processing.Embed.0.5.Reflected.Cross-site.Scripting/65; http://www.osvdb.org/69764
CVE: CVE-2010-4748
Published: 2011-03-01
Description: Cross-site scripting (XSS) vulnerability in pmwiki.php in PmWiki 2.2.20 allows remote attackers to inject arbitrary web script or HTML via the from parameter to Main/WikiSandbox.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8351&w=2; http://packetstormsecurity.org/files/view/96687/pm-wiki-xss.txt; http://secunia.com/advisories/42608
CVE: CVE-2010-4749
Published: 2011-03-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1.e, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) body parameter to action.php and the (2) amount and (3) action parameters to admin/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blogcms.com/; http://packetstormsecurity.org/files/view/96731/blogcms-xsrfxss.txt; http://securityreason.com/securityalert/8112
CVE: CVE-2010-4750
Published: 2011-03-01
Description: Cross-site request forgery (CSRF) vulnerability in admin/libs/ADMIN.php in BLOG:CMS 4.2.1.e, and possibly earlier, allows remote attackers to hijack the authentication of administrators.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://blogcms.com/; http://packetstormsecurity.org/files/view/96731/blogcms-xsrfxss.txt; http://securityreason.com/securityalert/8112
CVE: CVE-2010-4751
Published: 2011-03-01
Description: SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the id parameter in an edituser action, a different vector than CVE-2008-6593, CVE-2010-3484, and CVE-2010-3485.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://holisticinfosec.org/content/view/168/45/; http://secunia.com/advisories/42391; http://www.lightneasy.org/punbb/viewtopic.php?id=1207
CVE: CVE-2010-4752
Published: 2011-03-01
Description: SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the page parameter, a different vector than CVE-2008-6593, CVE-2010-3484, and CVE-2010-3485.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/42391; http://www.lightneasy.org/punbb/viewtopic.php?id=1207; http://www.securityfocus.com/bid/45230
CVE: CVE-2010-4753
Published: 2011-03-01
Description: Cross-site scripting (XSS) vulnerability in LightNEasy.php in LightNEasy 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter, which is not properly handled in a forced SQL error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/168/45/; http://secunia.com/advisories/42391; http://www.lightneasy.org/punbb/viewtopic.php?id=1207
CVE: CVE-2011-0278
Published: 2011-03-01
Description: Unspecified vulnerability in HP Web Jetadmin 10.2 Service Release 3 and 4 allows local users to bypass intended access restrictions via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02714670; http://secunia.com/advisories/43526; http://securitytracker.com/id?1025130
CVE: CVE-2011-0454
Published: 2011-03-01
Description: Buffer overflow in the PPP Access Concentrator (PPPAC) on the SEIL/x86 with firmware 1.00 through 1.61, SEIL/B1 with firmware 1.00 through 3.11, SEIL/X1 with firmware 1.00 through 3.11, SEIL/X2 with firmware 1.00 through 3.11, SEIL/Turbo with firmware 1.80 through 2.10, and SEIL/neu 2FE Plus with firmware 1.80 through 2.10 might allow remote attackers to execute arbitrary code via a PPPoE packet.
CVSS Score: 8.3 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN88991166/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000014; http://secunia.com/advisories/43494
CVE: CVE-2011-0711
Published: 2011-03-01
Description: The xfs_fs_geometry function in fs/xfs/xfs_fsops.c in the Linux kernel before 2.6.38-rc6-git3 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FSGEOMETRY_V1 ioctl call.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3a3675b7f23f83ca8c67c9c2b6edf707fd28d1ba; http://openwall.com/lists/oss-security/2011/02/16/10; http://openwall.com/lists/oss-security/2011/02/16/4
CVE: CVE-2011-0719
Published: 2011-03-01
Description: Samba 3.x before 3.3.15, 3.4.x before 3.4.12, and 3.5.x before 3.5.7 does not perform range checks for file descriptors before use of the FD_SET macro, which allows remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening a large number of files, related to (1) Winbind or (2) smbd.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056229.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056241.html
CVE: CVE-2011-1010
Published: 2011-03-01
Description: Buffer overflow in the mac_partition function in fs/partitions/mac.c in the Linux kernel before 2.6.37.2 allows local users to cause a denial of service (panic) or possibly have unspecified other impact via a malformed Mac OS partition table.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fa7ea87a057958a8b7926c1a60a3ca6d696328ed; http://openwall.com/lists/oss-security/2011/02/22/11; http://openwall.com/lists/oss-security/2011/02/22/15
CVE: CVE-2011-1012
Published: 2011-03-01
Description: The ldm_parse_vmdb function in fs/partitions/ldm.c in the Linux kernel before 2.6.38-rc6-git6 does not validate the VBLK size value in the VMDB structure in an LDM partition table, which allows local users to cause a denial of service (divide-by-zero error and OOPS) via a crafted partition table.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-369
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=294f6cf48666825d23c9372ef[PII_REDACTED]6e40d; http://openwall.com/lists/oss-security/2011/02/23/21; http://openwall.com/lists/oss-security/2011/02/23/4
CVE: CVE-2011-1017
Published: 2011-03-01
Description: Heap-based buffer overflow in the ldm_frag_add function in fs/partitions/ldm.c in the Linux kernel 2.6.37.2 and earlier might allow local users to gain privileges or obtain sensitive information via a crafted LDM partition table.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: http://openwall.com/lists/oss-security/2011/02/23/16; http://openwall.com/lists/oss-security/2011/02/24/14; http://openwall.com/lists/oss-security/2011/02/24/4
CVE: CVE-2011-1106
Published: 2011-03-01
Description: Cross-site scripting (XSS) vulnerability in stcenter.nsf in the server in IBM Lotus Sametime allows remote attackers to inject arbitrary web script or HTML via the authReasonCode parameter in an OpenDatabase action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2011-02/0217.html; http://secunia.com/advisories/43430; http://www.securityfocus.com/bid/46481
CVE: CVE-2011-1107
Published: 2011-03-01
Description: Unspecified vulnerability in Google Chrome before 9.0.597.107 allows remote attackers to spoof the URL bar via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=54262; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
CVE: CVE-2011-1108
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 does not properly implement JavaScript dialogs, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.
CVSS Score: 6.8 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=63732; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://www.securityfocus.com/bid/46614
CVE: CVE-2011-1109
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 does not properly process nodes in Cascading Style Sheets (CSS) stylesheets, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=68263; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-1110
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 does not properly implement key frame rules, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=68741; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://www.securityfocus.com/bid/46614
CVE: CVE-2011-1111
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 does not properly implement forms controls, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=70078; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://www.securityfocus.com/bid/46614
CVE: CVE-2011-1112
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 does not properly perform SVG rendering, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=70244; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://www.securityfocus.com/bid/46614
CVE: CVE-2011-1113
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 on 64-bit Linux platforms does not properly perform pickle deserialization, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=70376; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://www.securityfocus.com/bid/46614
CVE: CVE-2011-1114
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 does not properly handle tables, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale node."
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=71114; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-1115
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 does not properly render tables, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=71115; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-1116
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 does not properly handle SVG animations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=71296; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://www.securityfocus.com/bid/46614
CVE: CVE-2011-1117
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 does not properly handle XHTML documents, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale nodes."
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=71386; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-1118
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 does not properly handle TEXTAREA elements, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=71388; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://www.securityfocus.com/bid/46614
CVE: CVE-2011-1119
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 does not properly determine device orientation, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=71595; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://www.securityfocus.com/bid/46614
CVE: CVE-2011-1120
Published: 2011-03-01
Description: The WebGL implementation in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, aka Issue 71717.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=71717; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://www.securityfocus.com/bid/46614
CVE: CVE-2011-1121
Published: 2011-03-01
Description: Integer overflow in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a TEXTAREA element.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://code.google.com/p/chromium/issues/detail?id=71855; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-1122
Published: 2011-03-01
Description: The WebGL implementation in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, aka Issue 71960.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=71960; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://www.securityfocus.com/bid/46614
CVE: CVE-2011-1123
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 does not properly restrict access to internal extension functions, which has unspecified impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://code.google.com/p/chromium/issues/detail?id=72214; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://www.securityfocus.com/bid/46614
CVE: CVE-2011-1124
Published: 2011-03-01
Description: Use-after-free vulnerability in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to blocked plug-ins.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=72437; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://www.securityfocus.com/bid/46614
CVE: CVE-2011-1125
Published: 2011-03-01
Description: Google Chrome before 9.0.597.107 does not properly perform layout, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=73235; http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html; http://www.securityfocus.com/bid/46614
CVE: CVE-2010-4754
Published: 2011-03-02
Description: The glob implementation in libc in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, and OpenBSD 4.7, and Libsystem in Apple Mac OS X before 10.6.8, allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/lib/libc/gen/glob.3#rev1.30.12.1; http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/lib/libc/gen/glob.c#rev1.18.10.1; http://cxib.net/stuff/glob-0day.c
CVE: CVE-2010-4755
Published: 2011-03-02
Description: The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp-glob.c#rev1.13.12.1; http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp.c#rev1.21.6.1; http://cxib.net/stuff/glob-0day.c
CVE: CVE-2010-4756
Published: 2011-03-02
Description: The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://cxib.net/stuff/glob-0day.c; http://securityreason.com/achievement_securityalert/89; http://securityreason.com/exploitalert/9223
CVE: CVE-2011-0051
Published: 2011-03-02
Description: Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, does not properly handle certain recursive eval calls, which makes it easier for remote attackers to force a user to respond positively to a dialog question, as demonstrated by a question about granting privileges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://downloads.avaya.com/css/P8/documents/100133195; http://support.avaya.com/css/P8/documents/100128655; http://www.mandriva.com/security/advisories?name=MDVSA-2011:041
CVE: CVE-2011-0053
Published: 2011-03-02
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://downloads.avaya.com/css/P8/documents/100133195; http://support.avaya.com/css/P8/documents/100128655; http://www.mandriva.com/security/advisories?name=MDVSA-2011:042