deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-3055
Published: 2010-08-24
Description: The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2; http://secunia.com/advisories/41058; http://secunia.com/advisories/41185
CVE: CVE-2010-3056
Published: 2010-08-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.11.x before 2.11.10.1 and 3.x before 3.3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) db_search.php, (2) db_sql.php, (3) db_structure.php, (4) js/messages.php, (5) libraries/common.lib.php, (6) libraries/database_interface.lib.php, (7) libraries/dbi/mysql.dbi.lib.php, (8) libraries/dbi/mysqli.dbi.lib.php, (9) libraries/db_info.inc.php, (10) libraries/sanitizing.lib.php, (11) libraries/sqlparser.lib.php, (12) server_databases.php, (13) server_privileges.php, (14) setup/config.php, (15) sql.php, (16) tbl_replace.php, and (17) tbl_sql.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045991.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045997.html; http://secunia.com/advisories/41000
CVE: CVE-2010-3111
Published: 2010-08-24
Description: Google Chrome before 6.0.472.53 does not properly mitigate an unspecified flaw in the Windows kernel, which has unknown impact and attack vectors, a different vulnerability than CVE-2010-2897.
CVSS Score: 10.0 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=51070; http://googlechromereleases.blogspot.com/2010/08/stable-channel-update_19.html; http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html
CVE: CVE-2010-3112
Published: 2010-08-24
Description: Google Chrome before 5.0.375.127 does not properly implement file dialogs, which allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=45400; http://googlechromereleases.blogspot.com/2010/08/stable-channel-update_19.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11275
CVE: CVE-2010-3113
Published: 2010-08-24
Description: Google Chrome before 5.0.375.127, and webkitgtk before 1.2.5, does not properly handle SVG documents, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors related to state changes when using DeleteButtonController.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=628032; http://code.google.com/p/chromium/issues/detail?id=49596; http://googlechromereleases.blogspot.com/2010/08/stable-channel-update_19.html
CVE: CVE-2010-3114
Published: 2010-08-24
Description: The text-editing implementation in Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, does not check a node type before performing a cast, which has unspecified impact and attack vectors related to (1) DeleteSelectionCommand.cpp, (2) InsertLineBreakCommand.cpp, or (3) InsertParagraphSeparatorCommand.cpp in WebCore/editing/.
CVSS Score: 10.0 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=49628; http://googlechromereleases.blogspot.com/2010/08/stable-channel-update_19.html; http://secunia.com/advisories/41856
CVE: CVE-2010-3115
Published: 2010-08-24
Description: Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, does not properly implement the history feature, which might allow remote attackers to spoof the address bar via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=49964; http://googlechromereleases.blogspot.com/2010/08/stable-channel-update_19.html; http://secunia.com/advisories/41856
CVE: CVE-2010-3116
Published: 2010-08-24
Description: Multiple use-after-free vulnerabilities in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to improper handling of MIME types by plug-ins.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=50515; http://code.google.com/p/chromium/issues/detail?id=51835; http://googlechromereleases.blogspot.com/2010/08/stable-channel-update_19.html
CVE: CVE-2010-3117
Published: 2010-08-24
Description: Google Chrome before 5.0.375.127 does not properly implement the notifications feature, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=50553; http://googlechromereleases.blogspot.com/2010/08/stable-channel-update_19.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12098
CVE: CVE-2010-3118
Published: 2010-08-24
Description: The autosuggest feature in the Omnibox implementation in Google Chrome before 5.0.375.127 does not anticipate entry of passwords, which might allow remote attackers to obtain sensitive information by reading the network traffic generated by this feature.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=51146; http://googlechromereleases.blogspot.com/2010/08/stable-channel-update_19.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11839
CVE: CVE-2010-3119
Published: 2010-08-24
Description: Google Chrome before 5.0.375.127 and webkitgtk before 1.2.6 do not properly support the Ruby language, which allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=51654; http://googlechromereleases.blogspot.com/2010/08/stable-channel-update_19.html; http://secunia.com/advisories/43086
CVE: CVE-2010-3120
Published: 2010-08-24
Description: Google Chrome before 5.0.375.127 does not properly implement the Geolocation feature, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=51670; http://googlechromereleases.blogspot.com/2010/08/stable-channel-update_19.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11865
CVE: CVE-2010-1526
Published: 2010-08-24
Description: Multiple integer overflows in libgdiplus 2.6.7, as used in Mono, allow attackers to execute arbitrary code via (1) a crafted TIFF file, related to the gdip_load_tiff_image function in tiffcodec.c; (2) a crafted JPEG file, related to the gdip_load_jpeg_image_internal function in jpegcodec.c; or (3) a crafted BMP file, related to the gdip_read_bmp_image function in bmpcodec.c, leading to heap-based buffer overflows.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html; http://secunia.com/advisories/40792; http://secunia.com/secunia_research/2010-102/
CVE: CVE-2009-4977
Published: 2010-08-25
Description: PHP remote file inclusion vulnerability in index.php in MyBackup 1.4.0 allows remote authenticated users to execute arbitrary PHP code via a URL in the main_content parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/36106; http://www.exploit-db.com/exploits/9365; http://www.vupen.com/english/advisories/2009/2165
CVE: CVE-2009-4978
Published: 2010-08-25
Description: Directory traversal vulnerability in down.php in MyBackup 1.4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/36106; http://www.exploit-db.com/exploits/9365; http://www.vupen.com/english/advisories/2009/2165
CVE: CVE-2009-4979
Published: 2010-08-25
Description: Multiple SQL injection vulnerabilities in search.php in Photokorn Gallery 1.81 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) where[], (2) sort, (3) order, and (4) Match parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://holisticinfosec.org/content/view/120/45/; http://secunia.com/advisories/36150; http://www.securityfocus.com/bid/35966
CVE: CVE-2009-4980
Published: 2010-08-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Photokorn Gallery 1.81 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) where[] parameter to search.php and (2) qc parameter to admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/120/45/; http://secunia.com/advisories/36150; http://www.securityfocus.com/bid/35966
CVE: CVE-2009-4981
Published: 2010-08-25
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Photokorn Gallery 1.81 allow remote attackers to hijack the authentication of administrators.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://holisticinfosec.org/content/view/120/45/; http://secunia.com/advisories/36150; http://holisticinfosec.org/content/view/120/45/
CVE: CVE-2009-4982
Published: 2010-08-25
Description: SQL injection vulnerability in the select function in Irokez CMS 0.7.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to the default URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/23497; http://www.exploit-db.com/exploits/9369; http://www.securityfocus.com/bid/35957
CVE: CVE-2009-4983
Published: 2010-08-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Silurus Classifieds 1.0 allow remote attackers to inject arbitrary web script or HTML via the ID parameter to (1) category.php and (2) wcategory.php, and the (3) keywords parameter to search.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/silurus-xss.txt; http://secunia.com/advisories/36124; http://packetstormsecurity.org/0908-exploits/silurus-xss.txt
CVE: CVE-2009-4984
Published: 2010-08-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Accessories Me PHP Affiliate Script 1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) Keywords parameter to search.php and (2) SearchIndex parameter to browse.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/36148; http://www.exploit-db.com/exploits/9370; http://secunia.com/advisories/36148
CVE: CVE-2009-4985
Published: 2010-08-25
Description: SQL injection vulnerability in browse.php in Accessories Me PHP Affiliate Script 1.4 allows remote attackers to execute arbitrary SQL commands via the Go parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9370; http://www.exploit-db.com/exploits/9370
CVE: CVE-2009-4986
Published: 2010-08-25
Description: Directory traversal vulnerability in index.php in In-Portal 4.3.1, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the env parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/36165; http://www.exploit-db.com/exploits/9358; http://www.vupen.com/english/advisories/2009/2164
CVE: CVE-2009-4987
Published: 2010-08-25
Description: admin/header.php in Scripteen Free Image Hosting Script 2.3 allows remote attackers to bypass authentication and gain administrative access by setting the cookgid cookie value to 1, a different vector than CVE-2008-3211.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/36002; http://www.exploit-db.com/exploits/9256; http://www.osvdb.org/56539
CVE: CVE-2009-4988
Published: 2010-08-25
Description: Stack-based buffer overflow in NT_Naming_Service.exe in SAP Business One 2005 A 6.80.123 and 6.80.320 allows remote attackers to execute arbitrary code via a long GIOP request to TCP port 30000.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/36103; http://www.exploit-db.com/exploits/9319; http://www.securityfocus.com/archive/1/505489/100/0/threaded
CVE: CVE-2009-4989
Published: 2010-08-25
Description: Cross-site scripting (XSS) vulnerability in index.php in AJ Auction Pro OOPD 3.0 allows remote attackers to inject arbitrary web script or HTML via the txtkeyword parameter in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/ajauctionprooopd-xss.txt; http://secunia.com/advisories/36163; http://www.securityfocus.com/bid/35968
CVE: CVE-2009-4990
Published: 2010-08-25
Description: Cross-site scripting (XSS) vulnerability in the Webform report module 5.x and 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via a submission.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/540980; http://secunia.com/advisories/36181; http://www.securityfocus.com/bid/35953
CVE: CVE-2009-4991
Published: 2010-08-25
Description: Cross-site scripting (XSS) vulnerability in users/resume_register.php in Omnistar Recruiting allows remote attackers to inject arbitrary web script or HTML via the job2 parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/omnistarrecruiting-xss.txt; http://secunia.com/advisories/31514; http://packetstormsecurity.org/0908-exploits/omnistarrecruiting-xss.txt
CVE: CVE-2009-4992
Published: 2010-08-25
Description: SQL injection vulnerability in paidbanner.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9383; http://www.exploit-db.com/exploits/9383
CVE: CVE-2009-4993
Published: 2010-08-25
Description: PHP remote file inclusion vulnerability in home.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9383; http://www.exploit-db.com/exploits/9383
CVE: CVE-2009-4994
Published: 2010-08-25
Description: Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/123/45/; http://secunia.com/advisories/36172; http://www.smartertools.com/SmarterTrack/ReleaseNotes.aspx
CVE: CVE-2009-4995
Published: 2010-08-25
Description: Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the email address field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/36172; http://secunia.com/advisories/36172
CVE: CVE-2010-1800
Published: 2010-08-25
Description: CFNetwork in Apple Mac OS X 10.6.3 and 10.6.4 supports anonymous SSL and TLS connections, which allows man-in-the-middle attackers to redirect a connection and obtain sensitive information via crafted responses.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html; http://securitytracker.com/id?1024359; http://support.apple.com/kb/HT4312
CVE: CVE-2010-1801
Published: 2010-08-25
Description: Heap-based buffer overflow in CoreGraphics in Apple Mac OS X 10.5.8 and 10.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html; http://securitytracker.com/id?1024359; http://support.apple.com/kb/HT4312
CVE: CVE-2010-1802
Published: 2010-08-25
Description: libsecurity in Apple Mac OS X 10.5.8 and 10.6.4 does not properly perform comparisons to domain-name strings in X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a certificate associated with a similar domain name, as demonstrated by use of a www.example.con certificate to spoof www.example.com.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html; http://securitytracker.com/id?1024359; http://support.apple.com/kb/HT4312
CVE: CVE-2010-1808
Published: 2010-08-25
Description: Stack-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X 10.5.8 and 10.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted embedded font in a document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html; http://securitytracker.com/id?1024359; http://support.apple.com/kb/HT4312
CVE: CVE-2010-2360
Published: 2010-08-25
Description: Multiple buffer overflows in Winny 2.0b7.1 and earlier might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2006-2007.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN21471805/index.html; http://jvn.jp/en/jp/JVN91740962/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000029.html
CVE: CVE-2010-2361
Published: 2010-08-25
Description: Winny 2.0b7.1 and earlier does not properly process BBS information, which has unspecified impact and remote attack vectors that might lead to use of the product's host for DDoS attacks.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN54336184/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000027.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/61278
CVE: CVE-2010-2362
Published: 2010-08-25
Description: Winny 2.0b7.1 and earlier does not properly process node information, which has unspecified impact and remote attack vectors that might lead to use of the product's host for DDoS attacks.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN25393522/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000028.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/61277
CVE: CVE-2010-2711
Published: 2010-08-25
Description: Unspecified vulnerability in the HP MagCloud app before 1.0.5 for the iPad allows remote attackers to read and modify MagCloud application data via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9913&w=2; http://secunia.com/advisories/41062; http://securitytracker.com/id?1024357
CVE: CVE-2010-2935
Published: 2010-08-25
Description: simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle integer values associated with dictionary property items, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PowerPoint document that triggers a heap-based buffer overflow, related to an "integer truncation error."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html; http://secunia.com/advisories/40775
CVE: CVE-2010-2936
Published: 2010-08-25
Description: Integer overflow in simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted polygons in a PowerPoint document that triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html; http://secunia.com/advisories/40775
CVE: CVE-2010-3121
Published: 2010-08-25
Description: Buffer overflow in tm-console-bin in the DevonIT thin-client management tool might allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/278785; http://www.kb.cert.org/vuls/id/278785
CVE: CVE-2010-3122
Published: 2010-08-25
Description: The DevonIT thin-client management tool relies on a shared secret for authentication but transmits the secret in cleartext, which makes it easier for remote attackers to discover the secret value, and consequently obtain administrative control over client machines, by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/278785; http://www.kb.cert.org/vuls/id/278785
CVE: CVE-2010-3124
Published: 2010-08-26
Description: Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as a .mp3 file.
CVSS Score: 9.3 (HIGH)
References: http://git.videolan.org/?p=vlc/vlc-1.1.git%3Ba=blobdiff%3Bf=bin/winvlc.c%3Bh=ac9b97ca9f5f9ba001f13bf61eb5127a1c1dbcbf%3Bhp=2d09cba320e3b0def7069ce1ebab25d1340161c5%3Bhb=43a31df56c37bd62c691cdbe3c1f11babd164b56%3Bhpb=2d366da738b19f8d761d7084746c6db6f52808c6; http://secunia.com/advisories/41107; http://www.exploit-db.com/exploits/14750
CVE: CVE-2010-3125
Published: 2010-08-26
Description: Untrusted search path vulnerability in TeamMate Audit Management Software Suite 8.0 patch 2 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse mfc71enu.dll that is located in the same folder as a .tmx file.
CVSS Score: 9.3 (HIGH)
References: http://www.exploit-db.com/exploits/14747; http://www.exploit-db.com/exploits/14747
CVE: CVE-2010-3126
Published: 2010-08-26
Description: Untrusted search path vulnerability in avast! Free Antivirus version 5.0.594 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse mfc90loc.dll that is located in the same folder as an avast license (.avastlic) file.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/41109; http://www.exploit-db.com/exploits/14743; http://www.vupen.com/english/advisories/2010/2175
CVE: CVE-2010-3127
Published: 2010-08-26
Description: Untrusted search path vulnerability in Adobe PhotoShop CS2 through CS5 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll or Wintab32.dll that is located in the same folder as a PSD or other file that is processed by PhotoShop.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
References: http://blog.zoller.lu/2010/08/cve-2010-xn-loadlibrarygetprocaddress.html; http://secunia.com/advisories/41060; http://www.exploit-db.com/exploits/14741
CVE: CVE-2010-3128
Published: 2010-08-26
Description: Untrusted search path vulnerability in TeamViewer 5.0.8703 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .tvs or .tvc file.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/41112; http://www.exploit-db.com/exploits/14734; http://www.securityfocus.com/archive/1/513317/100/0/threaded