deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-2646
Published: 2010-07-06
Description: Google Chrome before 5.0.375.99 does not properly isolate sandboxed IFRAME elements, which has unspecified impact and remote attack vectors.
CVSS Score: 9.3 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=42575; http://code.google.com/p/chromium/issues/detail?id=42980; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update.html
CVE: CVE-2010-2647
Published: 2010-07-06
Description: Google Chrome before 5.0.375.99 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an invalid SVG document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=43488; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update.html; http://secunia.com/advisories/41856
CVE: CVE-2010-2648
Published: 2010-07-06
Description: The implementation of the Unicode Bidirectional Algorithm (aka Bidi algorithm or UBA) in Google Chrome before 5.0.375.99 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=44424; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html
CVE: CVE-2010-2649
Published: 2010-07-06
Description: Unspecified vulnerability in Google Chrome before 5.0.375.99 allows remote attackers to cause a denial of service (application crash) via an invalid image.
CVSS Score: 4.3 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=45164; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11974
CVE: CVE-2010-2650
Published: 2010-07-06
Description: Unspecified vulnerability in Google Chrome before 5.0.375.99 has unknown impact and attack vectors, related to an "annoyance with print dialogs."
CVSS Score: 9.3 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=46575; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11438
CVE: CVE-2010-2651
Published: 2010-07-06
Description: The Cascading Style Sheets (CSS) implementation in Google Chrome before 5.0.375.99 does not properly perform style rendering, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=46360; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12028
CVE: CVE-2010-2652
Published: 2010-07-06
Description: Google Chrome before 5.0.375.99 does not properly implement modal dialogs, which allows attackers to cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=47056; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11118
CVE: CVE-2010-2630
Published: 2010-07-06
Description: The TIFFReadDirectory function in LibTIFF 3.9.0 does not properly validate the data types of codec-specific tags that have an out-of-order position in a TIFF file, which allows remote attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2010-2481.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://bugzilla.maptools.org/show_bug.cgi?id=2210; http://secunia.com/advisories/50726; http://security.gentoo.org/glsa/glsa-201209-02.xml
CVE: CVE-2010-2631
Published: 2010-07-06
Description: LibTIFF 3.9.0 ignores tags in certain situations during the first stage of TIFF file processing and does not properly handle this during the second stage, which allows remote attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2010-2481.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://bugzilla.maptools.org/show_bug.cgi?id=2210; http://secunia.com/advisories/50726; http://security.gentoo.org/glsa/glsa-201209-02.xml
CVE: CVE-2010-2244
Published: 2010-07-08
Description: The AvahiDnsPacket function in avahi-core/socket.c in avahi-daemon in Avahi 0.6.16 and 0.6.25 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNS packet with an invalid checksum followed by a DNS packet with a valid checksum, a different vulnerability than CVE-2008-5081.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043800.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043820.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]5200&w=2
CVE: CVE-2010-2445
Published: 2010-07-08
Description: freeciv 2.2 before 2.2.1 and 2.3 before 2.3.0 allows attackers to read arbitrary files or execute arbitrary commands via a scenario that contains Lua functionality, related to the (1) os, (2) io, (3) package, (4) dofile, (5) loadfile, (6) loadlib, (7) module, and (8) require modules or functions.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://gna.org/bugs/?15624; http://packetstormsecurity.com/files/163311/Android-2.0-FreeCIV-Arbitrary-Code-Execution.html; http://www.mandriva.com/security/advisories?name=MDVSA-2010:205
CVE: CVE-2010-2654
Published: 2010-07-08
Description: Multiple cross-site scripting (XSS) vulnerabilities on the IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7 and 5.0, allow remote attackers to inject arbitrary web script or HTML via the (1) INDEX or (2) IPADDR parameter to private/cindefn.php, (3) the domain parameter to private/power_management_policy_options.php, the slot parameter to (4) private/pm_temp.php or (5) private/power_module.php, (6) the WEBINDEX parameter to private/blade_leds.php, or (7) the SLOT parameter to private/ipmi_bladestatus.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dsecrg.com/pages/vul/show.php?id=154; http://osvdb.org/66122; http://osvdb.org/66125
CVE: CVE-2010-2655
Published: 2010-07-08
Description: Directory traversal vulnerability in private/file_management.php on the IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7 and 5.0, allows remote authenticated users to list arbitrary directories and possibly have unspecified other impact via a .. (dot dot) in the DIR parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://dsecrg.com/pages/vul/show.php?id=154; http://osvdb.org/66124; http://www.exploit-db.com/exploits/14237/
CVE: CVE-2010-2656
Published: 2010-07-08
Description: The IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7 and 5.0, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (1) logs or (2) core files via direct requests, as demonstrated by a request for private/sdc.tgz.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://dsecrg.com/pages/vul/show.php?id=154; http://osvdb.org/66123; http://www.exploit-db.com/exploits/14237/
CVE: CVE-2010-2657
Published: 2010-07-08
Description: Opera before 10.60 on Windows and Mac OS X does not properly prevent certain double-click operations from running a program located on a web site, which allows user-assisted remote attackers to execute arbitrary code via a crafted web page that bypasses a dialog.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/40375; http://www.opera.com/docs/changelogs/mac/1060/; http://www.opera.com/docs/changelogs/windows/1060/
CVE: CVE-2010-2658
Published: 2010-07-08
Description: Opera before 10.60 does not properly restrict certain interaction between plug-ins, file inputs, and the clipboard, which allows user-assisted remote attackers to trigger the uploading of arbitrary files via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/40375; http://www.opera.com/docs/changelogs/mac/1060/; http://www.opera.com/docs/changelogs/unix/1060/
CVE: CVE-2010-2659
Published: 2010-07-08
Description: Opera before 10.50 on Windows, before 10.52 on Mac OS X, and before 10.60 on UNIX platforms makes widget properties accessible to third-party domains, which allows remote attackers to obtain potentially sensitive information via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.opera.com/docs/changelogs/mac/1052/; http://www.opera.com/docs/changelogs/unix/1060/; http://www.opera.com/docs/changelogs/windows/1050/
CVE: CVE-2010-2660
Published: 2010-07-08
Description: Opera before 10.54 on Windows and Mac OS X, and before 10.60 on UNIX platforms, does not properly restrict certain uses of homograph characters in domain names, which makes it easier for remote attackers to spoof IDN domains via unspecified choices of characters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/40250; http://www.opera.com/docs/changelogs/mac/1054/; http://www.opera.com/docs/changelogs/unix/1060/
CVE: CVE-2010-2661
Published: 2010-07-08
Description: Opera before 10.54 on Windows and Mac OS X, and before 10.60 on UNIX platforms, does not properly restrict access to the full pathname of a file selected for upload, which allows remote attackers to obtain potentially sensitive information via unspecified DOM manipulations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/40250; http://www.opera.com/docs/changelogs/mac/1054/; http://www.opera.com/docs/changelogs/unix/1060/
CVE: CVE-2010-2662
Published: 2010-07-08
Description: Opera before 10.60 allows remote attackers to bypass the popup blocker via a javascript: URL and a "fake click."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.opera.com/docs/changelogs/mac/1060/; http://www.opera.com/docs/changelogs/unix/1060/; http://www.opera.com/docs/changelogs/windows/1060/
CVE: CVE-2010-2663
Published: 2010-07-08
Description: Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via an ended event handler that changes the SRC attribute of an AUDIO element.
CVSS Score: 4.3 (MEDIUM)
References: http://www.opera.com/docs/changelogs/mac/1060/; http://www.opera.com/docs/changelogs/unix/1060/; http://www.opera.com/docs/changelogs/windows/1060/
CVE: CVE-2010-2664
Published: 2010-07-08
Description: Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via certain HTML content that has an unclosed SPAN element with absolute positioning.
CVSS Score: 4.3 (MEDIUM)
References: http://www.opera.com/docs/changelogs/mac/1060/; http://www.opera.com/docs/changelogs/unix/1060/; http://www.opera.com/docs/changelogs/windows/1060/
CVE: CVE-2010-2665
Published: 2010-07-08
Description: Cross-site scripting (XSS) vulnerability in Opera before 10.54 on Windows and Mac OS X, and before 10.11 on UNIX platforms, allows remote attackers to inject arbitrary web script or HTML via a data: URI, related to incorrect detection of the "opening site."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40250; http://www.opera.com/docs/changelogs/mac/1054/; http://www.opera.com/docs/changelogs/unix/1011/
CVE: CVE-2010-2666
Published: 2010-07-08
Description: Opera before 10.54 on Windows and Mac OS X does not properly enforce permission requirements for widget filesystem access and directory selection, which allows user-assisted remote attackers to create or modify arbitrary files, and consequently execute arbitrary code, via widget File I/O operations.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/40250; http://www.opera.com/docs/changelogs/mac/1054/; http://www.opera.com/docs/changelogs/windows/1054/
CVE: CVE-2010-1574
Published: 2010-07-08
Description: IOS 12.2(52)SE and 12.2(52)SE1 on Cisco Industrial Ethernet (IE) 3000 series switches has (1) a community name of public for RO access and (2) a community name of private for RW access, which makes it easier for remote attackers to modify the configuration or obtain potentially sensitive information via SNMP requests, aka Bug ID CSCtf25589.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/66120; http://secunia.com/advisories/40407; http://securitytracker.com/id?1024173
CVE: CVE-2010-2221
Published: 2010-07-08
Description: Multiple buffer overflows in the iSNS implementation in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) before 1.0.6, (2) iSCSI Enterprise Target (aka iscsitarget or IET) 1.4.20.1 and earlier, and (3) Generic SCSI Target Subsystem for Linux (aka SCST or iscsi-scst) 1.0.1.1 and earlier allow remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via (a) a long iSCSI Name string in an SCN message or (b) an invalid PDU.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2010-07/0022.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-07/0058.html; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
CVE: CVE-2010-2494
Published: 2010-07-08
Description: Multiple buffer underflows in the base64 decoder in base64.c in (1) bogofilter and (2) bogolexer in bogofilter before 1.2.2 allow remote attackers to cause a denial of service (heap memory corruption and application crash) via an e-mail message with invalid base64 data that begins with an = (equals) character.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://bogofilter.sourceforge.net/security/bogofilter-SA-2010-01; http://bogofilter.svn.sourceforge.net/viewvc/bogofilter/trunk/bogofilter/doc/bogofilter-SA-2010-01?revision=6909&pathrev=6909; http://bogofilter.svn.sourceforge.net/viewvc/bogofilter/trunk/bogofilter/src/base64.c?view=patch&r1=6906&r2=6903
CVE: CVE-2010-2668
Published: 2010-07-08
Description: Unspecified vulnerability in Adaptive Micro Systems ALPHA Ethernet Adapter II Web-Manager 3.40.2 allows remote attackers to bypass authentication and read or write configuration files via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-07/0010.html; http://osvdb.org/66015; http://secunia.com/advisories/40369
CVE: CVE-2010-2669
Published: 2010-07-08
Description: Cross-site scripting (XSS) vulnerability in admin/editors/text/editor-body.php in Orbis CMS 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cross-site-scripting.blogspot.com/2010/07/orbis-102-reflected-xss.html; http://osvdb.org/66021; http://secunia.com/advisories/40474
CVE: CVE-2010-2670
Published: 2010-07-08
Description: SQL injection vulnerability in recipedetail.php in BrotherScripts Recipe Website allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14224; http://www.securityfocus.com/bid/41365; http://www.vupen.com/english/advisories/2010/1714
CVE: CVE-2010-2671
Published: 2010-07-08
Description: Cross-site scripting (XSS) vulnerability in advancedsearch.php in eZ Publish 3.7.0 through 4.2.0 allows remote attackers to inject arbitrary web script or HTML via the subTreeItem parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ez.no/de/content/download/321164/3192243/version/1/file/16396.diff; http://ez.no/de/content/download/321443/3196351/version/1/file/combined_patch_42.diff; http://ez.no/de/developer/security/security_advisories/ez_publish_4_2/ezsa_2010_001_remote_vulnerability_in_ez_search
CVE: CVE-2010-2672
Published: 2010-07-08
Description: Multiple SQL injection vulnerabilities in eZ Publish 3.7.0 through 4.2.0 allow remote attackers to execute arbitrary SQL commands via the (1) SectionID and (2) SearchTimestamp parameters to the search feature and the (3) SearchContentClassAttributeID parameter to the advancedsearch feature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://ez.no/de/content/download/321165/3192248/version/1/file/16397.diff; http://ez.no/de/content/download/321166/3192253/version/1/file/16398.diff; http://ez.no/de/developer/security/security_advisories/ez_publish_4_2/ezsa_2010_001_remote_vulnerability_in_ez_search
CVE: CVE-2010-2673
Published: 2010-07-08
Description: SQL injection vulnerability in profile_view.php in Devana 1.6.6 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/63278; http://packetstormsecurity.org/1003-exploits/devana-sql.txt; http://secunia.com/advisories/39121
CVE: CVE-2010-2674
Published: 2010-07-08
Description: SQL injection vulnerability in index.php in TSOKA:CMS 1.1, 1.9, and 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in an articolo action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/63277; http://packetstormsecurity.org/1003-exploits/tsokacms-sqlxss.txt; http://secunia.com/advisories/39120
CVE: CVE-2010-2675
Published: 2010-07-08
Description: Cross-site scripting (XSS) vulnerability in index.php in TSOKA:CMS 1.1, 1.9, and 2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter in an articolo action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1003-exploits/tsokacms-sqlxss.txt; http://www.exploit-db.com/exploits/11923; http://packetstormsecurity.org/1003-exploits/tsokacms-sqlxss.txt
CVE: CVE-2010-2676
Published: 2010-07-08
Description: Multiple directory traversal vulnerabilities in index.php in Open Web Analytics (OWA) 1.2.3 might allow remote attackers to read arbitrary files via directory traversal sequences in the (1) owa_action and (2) owa_do parameters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1003-exploits/owa123-lfirfi.txt; http://www.ITSecTeam.com/en/vulnerabilities/vulnerability26.htm; http://www.exploit-db.com/exploits/11903
CVE: CVE-2010-2677
Published: 2010-07-08
Description: PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA) 1.2.3, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the IP parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/63288; http://packetstormsecurity.org/1003-exploits/owa123-lfirfi.txt; http://secunia.com/advisories/39153
CVE: CVE-2010-2678
Published: 2010-07-08
Description: SQL injection vulnerability in xmap (com_xmap) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/510374/100/0/threaded; http://www.securityfocus.com/bid/39035; http://www.securityfocus.com/archive/1/510374/100/0/threaded
CVE: CVE-2010-2679
Published: 2010-07-08
Description: SQL injection vulnerability in the Weblinks (com_weblinks) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1003-exploits/joomlaweblinks-sql.txt; http://www.securityfocus.com/archive/1/510364/100/0/threaded; http://www.securityfocus.com/bid/39032
CVE: CVE-2009-4925
Published: 2010-07-12
Description: Multiple SQL injection vulnerabilities in Portale e-commerce Creasito (aka creasito e-commerce content manager) 1.3.16, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the username parameter to (1) admin/checkuser.php and (2) checkuser.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/34809; http://www.exploit-db.com/exploits/8497; http://www.securityfocus.com/archive/1/502818/100/0/threaded
CVE: CVE-2009-4926
Published: 2010-07-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Online Contact Manager (formerly EContact PRO) 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) showGroup parameter to (a) index.php and the (2) id parameter to (b) view.php, (c) email.php, (d) edit.php, and (e) delete.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0904-exploits/ocm30-xss.txt; http://secunia.com/advisories/34826; http://www.securityfocus.com/bid/34626
CVE: CVE-2009-4927
Published: 2010-07-12
Description: WB News 2.1.2 allows remote attackers to bypass authentication and gain administrative access via a modified WBNEWS cookie, as demonstrated by setting this cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/34822; http://www.exploit-db.com/exploits/8492; http://www.securityfocus.com/bid/34609
CVE: CVE-2009-4928
Published: 2010-07-12
Description: PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter, a different vector than CVE-2006-1922 and CVE-2006-7055.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/8494; http://www.securityfocus.com/bid/34617; http://www.exploit-db.com/exploits/8494
CVE: CVE-2009-4929
Published: 2010-07-12
Description: admin/manage_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/34824; http://www.exploit-db.com/exploits/8496; http://www.securityfocus.com/bid/34619
CVE: CVE-2009-4930
Published: 2010-07-12
Description: Cross-site scripting (XSS) vulnerability in the twbkwbis.P_SecurityQuestion (aka Change Security Question) page in SunGard Banner Student System 7.4 allows remote attackers to inject arbitrary web script or HTML via the New Question field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/502810/100/0/threaded; http://www.securityfocus.com/bid/34620; http://www.securityfocus.com/archive/1/502810/100/0/threaded
CVE: CVE-2009-4931
Published: 2010-07-12
Description: Stack-based buffer overflow in Groovy Media Player 1.1.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .m3u playlist file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/8485; http://www.securityfocus.com/bid/34621; https://exchange.xforce.ibmcloud.com/vulnerabilities/49965
CVE: CVE-2009-4932
Published: 2010-07-12
Description: Stack-based buffer overflow in 1by1 1.67 (aka 1.6.7.0) allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .m3u playlist file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/34815; http://www.exploit-db.com/exploits/8484; http://www.securityfocus.com/bid/34618
CVE: CVE-2009-4933
Published: 2010-07-12
Description: Multiple SQL injection vulnerabilities in login.php in EZ Webitor allow remote attackers to execute arbitrary SQL commands via the (1) txtUserId (Username) and (2) txtPassword (Password) parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34819; http://www.exploit-db.com/exploits/8487; http://www.securityfocus.com/bid/34604