deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-1154
Published: 2011-03-30
Description: The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html; http://openwall.com/lists/oss-security/2011/03/04/16
CVE: CVE-2011-1155
Published: 2011-03-30
Description: The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
CVSS Score: 1.9 (LOW)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html; http://openwall.com/lists/oss-security/2011/03/04/16
CVE: CVE-2011-1548
Published: 2011-03-30
Description: The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by /var/log/postgresql/.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606544; http://openwall.com/lists/oss-security/2011/03/04/16; http://openwall.com/lists/oss-security/2011/03/04/17
CVE: CVE-2011-1549
Published: 2011-03-30
Description: The default configuration of logrotate on Gentoo Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by directories under /var/log/ for packages.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2011/03/04/16; http://openwall.com/lists/oss-security/2011/03/04/17; http://openwall.com/lists/oss-security/2011/03/04/18
CVE: CVE-2011-1550
Published: 2011-03-30
Description: The default configuration of logrotate on SUSE openSUSE Factory uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by directories for the (1) cobbler, (2) inn, (3) safte-monitor, and (4) uucp packages.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2011/03/04/16; http://openwall.com/lists/oss-security/2011/03/04/17; http://openwall.com/lists/oss-security/2011/03/04/18
CVE: CVE-2011-1551
Published: 2011-03-30
Description: SUSE openSUSE Factory assigns ownership of the /var/log/cobbler/ directory tree to the web-service user account, which might allow local users to gain privileges by leveraging access to this account during root filesystem operations by the Cobbler daemon.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2011/03/23/11; https://exchange.xforce.ibmcloud.com/vulnerabilities/66487; http://openwall.com/lists/oss-security/2011/03/23/11
CVE: CVE-2010-3695
Published: 2011-03-31
Description: Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in a fetchmail_prefs_save action, related to the Fetchmail configuration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0379.html; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598584; http://cvs.horde.org/diff.php/imp/docs/CHANGES?rt=horde&r1=1.699.2.424&r2=1.699.2.430&ty=h
CVE: CVE-2011-0727
Published: 2011-03-31
Description: GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership of arbitrary files via a symlink attack on a (1) dmrc or (2) face icon file under /var/cache/gdm/.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://ftp.gnome.org/pub/GNOME/sources/gdm/2.32/gdm-2.32.1.news; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057333.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057931.html
CVE: CVE-2011-0764
Published: 2011-03-31
Description: t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz[PII_REDACTED].pdf.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2012-1201.html; http://secunia.com/advisories/43823; http://secunia.com/advisories/47347
CVE: CVE-2011-0963
Published: 2011-03-31
Description: The default configuration of the RADIUS authentication feature on the Cisco Network Admission Control (NAC) Guest Server with software before 2.0.3 allows remote attackers to bypass intended access restrictions and obtain network connectivity via unspecified vectors, aka Bug ID CSCtj66922.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b74114.shtml; http://www.securitytracker.com/id?1025272; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b74114.shtml
CVE: CVE-2011-1174
Published: 2011-03-31
Description: manager.c in Asterisk Open Source 1.6.1.x before 1.6.1.24, 1.6.2.x before 1.6.2.17.2, and 1.8.x before 1.8.3.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a series of manager sessions involving invalid data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://downloads.asterisk.org/pub/security/AST-2011-003.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056945.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/057156.html
CVE: CVE-2011-1175
Published: 2011-03-31
Description: tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.
CVSS Score: 5.0 (MEDIUM)
References: http://downloads.asterisk.org/pub/security/AST-2011-004.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056945.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/057156.html
CVE: CVE-2011-1552
Published: 2011-03-31
Description: t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2012-1201.html; http://secunia.com/advisories/43823; http://secunia.com/advisories/48985
CVE: CVE-2011-1553
Published: 2011-03-31
Description: Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2012-1201.html; http://secunia.com/advisories/43823; http://secunia.com/advisories/48985
CVE: CVE-2011-1554
Published: 2011-03-31
Description: Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://rhn.redhat.com/errata/RHSA-2012-1201.html; http://secunia.com/advisories/43823; http://secunia.com/advisories/48985
CVE: CVE-2010-3447
Published: 2011-04-04
Description: Cross-site scripting (XSS) vulnerability in view.php in the file viewer in Horde Gollem before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the file parameter in a view_file action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.horde.org/ticket/9191; http://git.horde.org/diff.php/gollem/view.php?rt=horde&r1=1.51.2.6&r2=1.51.2.7&ty=u; http://git.horde.org/diff.php/gollem/view.php?rt=horde-git&r1=7f7a4300f16b429ed645bc3e2af2cedffc70ce3e&r2=025a1bfbe69622036f8e3a27a6edd39c02dcd4ea
CVE: CVE-2010-3693
Published: 2011-04-04
Description: Cross-site scripting (XSS) vulnerability in Horde Dynamic IMP (DIMP) before 1.1.5, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via vectors related to displaying mailbox names.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.horde.org/ticket/9240; http://cvs.horde.org/diff.php/dimp/docs/CHANGES?rt=horde&r1=1.69.2.82&r2=1.69.2.87&ty=h; http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde&r1=1.35.2.11&r2=1.35.2.13&ty=h
CVE: CVE-2010-4235
Published: 2011-04-04
Description: Format string vulnerability in RealNetworks Helix Server 12.x, 13.x, and 14.x before 14.2, and Helix Mobile Server 12.x, 13.x, and 14.x before 14.2, allows remote attackers to execute arbitrary code via vectors related to the x-wap-profile HTTP header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://docs.real.com/docs/security/SecurityUpdate033111HS.pdf; http://www.securityfocus.com/bid/47110; http://docs.real.com/docs/security/SecurityUpdate033111HS.pdf
CVE: CVE-2010-4596
Published: 2011-04-04
Description: Stack-based buffer overflow in RealNetworks Helix Server 12.x, 13.x, and 14.x before 14.2, and Helix Mobile Server 12.x, 13.x, and 14.x before 14.2, allows remote attackers to execute arbitrary code via a long string in an RTSP request.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://docs.real.com/docs/security/SecurityUpdate033111HS.pdf; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=899; http://www.securityfocus.com/bid/47109
CVE: CVE-2010-4778
Published: 2011-04-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (aka fmserver) field in a fetchmail_prefs_save action, related to the Fetchmail configuration, a different issue than CVE-2010-3695.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde&r1=1.39.4.10&r2=1.39.4.11; http://www.vupen.com/english/advisories/2010/2513; http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde&r1=1.39.4.10&r2=1.39.4.11
CVE: CVE-2011-0461
Published: 2011-04-04
Description: /etc/init.d/boot.localfs in the aaa_base package before 11.2-43.48.1 in SUSE openSUSE 11.2, and before 11.3-8.7.1 in openSUSE 11.3, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/mtab.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html; http://lists.opensuse.org/opensuse-updates/2011-03/msg00007.html
CVE: CVE-2011-0468
Published: 2011-04-04
Description: The aaa_base package before 11.3-8.9.1 in SUSE openSUSE 11.3, and before 11.4-54.62.1 in openSUSE 11.4, allows local users to gain privileges via shell metacharacters in a filename, related to tab expansion.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html; http://lists.opensuse.org/opensuse-updates/2011-03/msg00010.html; http://secunia.com/advisories/43825
CVE: CVE-2011-0951
Published: 2011-04-04
Description: The web-based management interface in Cisco Secure Access Control System (ACS) 5.1 before 5.1.0.44.6 and 5.2 before 5.2.0.26.3 allows remote attackers to change arbitrary user passwords via unspecified vectors, aka Bug ID CSCtl77440.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://secunia.com/advisories/43924; http://securitytracker.com/id?1025271; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b74117.shtml
CVE: CVE-2011-1126
Published: 2011-04-04
Description: VMware vmrun, as used in VIX API 1.x before 1.10.3 and VMware Workstation 6.5.x and 7.x before 7.1.4 build 385536 on Linux, might allow local users to gain privileges via a Trojan horse shared library in an unspecified directory.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://lists.vmware.com/pipermail/security-announce/2011/000131.html; http://secunia.com/advisories/43885; http://secunia.com/advisories/43943
CVE: CVE-2011-1546
Published: 2011-04-04
Description: Multiple SQL injection vulnerabilities in Andy's PHP Knowledgebase (Aphpkb) before 0.95.3 allow remote attackers to execute arbitrary SQL commands via the s parameter to (1) a_viewusers.php or (2) keysearch.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the (3) id or (4) start parameter to pending.php, or the (5) aid parameter to a_authordetails.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://aphpkb.blogspot.com/2011/03/this-release-includes-security-fixes.html; http://secunia.com/advisories/34476; http://securityreason.com/securityalert/8168
CVE: CVE-2011-1555
Published: 2011-04-04
Description: SQL injection vulnerability in saa.php in Andy's PHP Knowledgebase (Aphpkb) 0.95.3 and earlier allows remote attackers to execute arbitrary SQL commands via the aid parameter, a different vulnerability than CVE-2011-1546.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://aphpkb.blogspot.com/2011/03/this-release-includes-security-fixes.html; http://secunia.com/advisories/34476; http://www.vupen.com/english/advisories/2011/0802
CVE: CVE-2011-1556
Published: 2011-04-04
Description: SQL injection vulnerability in plugins/pdfClasses/pdfgen.php in Andy's PHP Knowledgebase (Aphpkb) 0.95.4 allows remote attackers to execute arbitrary SQL commands via the pdfa parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/43879; http://www.autosectools.com/Advisories/Andy%27s.PHP.Knowledgebase.Project.0.95.4_SQL.Injection_161.html; http://www.exploit-db.com/exploits/17061/
CVE: CVE-2011-1557
Published: 2011-04-04
Description: SQL injection vulnerability in ICloudCenter ICJobSite 1.1 allows remote attackers to execute arbitrary SQL commands via the pid parameter to an unspecified component, a different vulnerability than CVE-2011-1546.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/47100; http://www.securityfocus.com/bid/47100
CVE: CVE-2011-0891
Published: 2011-04-04
Description: Unspecified vulnerability in the OS-Core.CORE2-KRN fileset in HP HP-UX B.11.23 and B.11.31 allows local users to cause a denial of service via unknown vectors.
CVSS Score: 4.4 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02753287; http://www.securitytracker.com/id?1025279; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02753287
CVE: CVE-2011-0893
Published: 2011-04-04
Description: Cross-site scripting (XSS) vulnerability in HP Operations 9.10 on UNIX platforms allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9257&w=2; http://secunia.com/advisories/43985; http://securityreason.com/securityalert/8174
CVE: CVE-2011-0894
Published: 2011-04-04
Description: Unspecified vulnerability in HP Operations 9.10 on UNIX platforms allows remote authenticated users to bypass intended access restrictions via unknown vectors.
CVSS Score: 5.5 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9257&w=2; http://secunia.com/advisories/43985; http://securityreason.com/securityalert/8174
CVE: CVE-2011-1082
Published: 2011-04-04
Description: fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e; http://openwall.com/lists/oss-security/2011/03/02/1; http://openwall.com/lists/oss-security/2011/03/02/2
CVE: CVE-2011-1083
Published: 2011-04-04
Description: The epoll implementation in the Linux kernel 2.6.37.2 and earlier does not properly traverse a tree of epoll file descriptors, which allows local users to cause a denial of service (CPU consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: http://article.gmane.org/gmane.linux.kernel/1105744; http://article.gmane.org/gmane.linux.kernel/1105888; http://article.gmane.org/gmane.linux.kernel/1106686
CVE: CVE-2011-1425
Published: 2011-04-04
Description: xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-264
References: http://git.gnome.org/browse/xmlsec/commit/?id=2d5eddcc4163ea050cf3a3a1a25452bb5124f780; http://git.gnome.org/browse/xmlsec/commit/?id=35eaacde6093d[PII_REDACTED]fc2146341b8b9f5fa; http://secunia.com/advisories/43920
CVE: CVE-2011-1558
Published: 2011-04-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in the IBM Web Interface for Content Management (aka WEBi) 1.0.4 before FP3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-1242.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/43993; http://www-01.ibm.com/support/docview.wss?uid=swg1IO13663; http://www.ibm.com/support/docview.wss?uid=swg24029060
CVE: CVE-2011-1559
Published: 2011-04-05
Description: Unspecified vulnerability in the IBM Web Interface for Content Management (aka WEBi) 1.0.4 before FP3 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/43993; http://www-01.ibm.com/support/docview.wss?uid=swg1IO13806; http://www.ibm.com/support/docview.wss?uid=swg24029060
CVE: CVE-2011-1560
Published: 2011-04-05
Description: solid.exe in IBM solidDB before 4.5.181, 6.0.x before 6.0.1067, 6.1.x and 6.3.x before 6.3.47, and 6.5.x before 6.5.0.3 uses a password-hash length specified by the client, which allows remote attackers to bypass authentication via a short length value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-255
References: http://osvdb.org/71494; http://secunia.com/advisories/44030; http://www.ibm.com/support/docview.wss?uid=swg21474552
CVE: CVE-2011-1561
Published: 2011-04-05
Description: The LDAP login feature in bos.rte.security 6.1.6.4 in IBM AIX 6.1, when ldap_auth is enabled in ldap.cfg, allows remote attackers to bypass authentication via a login attempt with an arbitrary password.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://aix.software.ibm.com/aix/efixes/security/ldapauth_advisory.asc; http://secunia.com/advisories/43968; http://securitytracker.com/id?1025273
CVE: CVE-2011-1562
Published: 2011-04-05
Description: Ecava IntegraXor HMI before n 3.60 (Build 4032) allows remote attackers to bypass authentication and execute arbitrary SQL statements via unspecified vectors related to a crafted POST request. NOTE: some sources have reported this issue as SQL injection, but this might not be accurate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/44105; http://twitter.com/#%21/djrbliss/status/[PII_REDACTED]9431296; http://www.integraxor.com/blog/security-issue-20[PII_REDACTED]-vulnerability-note
CVE: CVE-2011-1563
Published: 2011-04-05
Description: Multiple stack-based buffer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attackers to execute arbitrary code via (1) a long username in an On_FC_CONNECT_FCS_LOGIN packet, and crafted (2) On_FC_CTAGLIST_FCS_CADDTAG, (3) On_FC_CTAGLIST_FCS_CDELTAG, (4) On_FC_CTAGLIST_FCS_ADDTAGMS, (5) On_FC_RFUSER_FCS_LOGIN, (6) unspecified "On_FC_BINFILE_FCS_*FILE", (7) On_FC_CGETTAG_FCS_GETTELEMETRY, (8) On_FC_CGETTAG_FCS_GETCHANNELTELEMETRY, (9) On_FC_CGETTAG_FCS_SETTELEMETRY, (10) On_FC_CGETTAG_FCS_SETCHANNELTELEMETRY, and (11) On_FC_SCRIPT_FCS_STARTPROG packets to port 910.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/realwin_2-adv.txt; http://aluigi.org/adv/realwin_3-adv.txt; http://aluigi.org/adv/realwin_4-adv.txt
CVE: CVE-2011-1564
Published: 2011-04-05
Description: Multiple integer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attackers to execute arbitrary code via crafted (1) On_FC_MISC_FCS_MSGBROADCAST and (2) On_FC_MISC_FCS_MSGSEND packets, which trigger a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://aluigi.org/adv/realwin_6-adv.txt; http://secunia.com/advisories/43848; http://securityreason.com/securityalert/8177
CVE: CVE-2011-1565
Published: 2011-04-05
Description: Directory traversal vulnerability in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allows remote attackers to (1) read (opcode 0x3) or (2) create or write (opcode 0x2) arbitrary files via ..\ (dot dot backslash) sequences to TCP port 12401.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://aluigi.org/adv/igss_1-adv.txt; http://secunia.com/advisories/43849; http://securityreason.com/securityalert/8178
CVE: CVE-2011-1566
Published: 2011-04-05
Description: Directory traversal vulnerability in dc.exe 9.00.00.11059 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allows remote attackers to execute arbitrary programs via ..\ (dot dot backslash) sequences in opcodes (1) 0xa and (2) 0x17 to TCP port 12397.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://aluigi.org/adv/igss_8-adv.txt; http://secunia.com/advisories/43849; http://www.exploit-db.com/exploits/17024