deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-1196
Published: 2011-03-11
Description: The OGG container implementation in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=71788; http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html; http://www.securityfocus.com/bid/46785
CVE: CVE-2011-1197
Published: 2011-03-11
Description: Google Chrome before 10.0.648.127 does not properly perform table painting, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=72028; http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html; http://www.securityfocus.com/bid/46785
CVE: CVE-2011-1198
Published: 2011-03-11
Description: The video functionality in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger use of a malformed "out-of-bounds structure."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=73026; http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html; http://www.securityfocus.com/bid/46785
CVE: CVE-2011-1199
Published: 2011-03-11
Description: Google Chrome before 10.0.648.127 does not properly handle DataView objects, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=73066; http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html; http://www.securityfocus.com/bid/46785
CVE: CVE-2011-1200
Published: 2011-03-11
Description: Google Chrome before 10.0.648.127 does not properly perform a cast of an unspecified variable during text rendering, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-704
References: http://code.google.com/p/chromium/issues/detail?id=73134; http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html; http://www.securityfocus.com/bid/46785
CVE: CVE-2011-1201
Published: 2011-03-11
Description: The context implementation in WebKit, as used in Google Chrome before 10.0.648.127, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=73196; http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html; http://www.securityfocus.com/bid/46785
CVE: CVE-2011-1202
Published: 2011-03-11
Description: The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=73716; http://downloads.avaya.com/css/P8/documents/100144158; http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f
CVE: CVE-2011-1203
Published: 2011-03-11
Description: Google Chrome before 10.0.648.127 does not properly handle SVG cursors, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=73746; http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-1204
Published: 2011-03-11
Description: Google Chrome before 10.0.648.127 does not properly handle attributes, which allows remote attackers to cause a denial of service (DOM tree corruption) or possibly have unspecified other impact via a crafted document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=74030; http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-1285
Published: 2011-03-11
Description: The regular-expression functionality in Google Chrome before 10.0.648.127 does not properly implement reentrancy, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=74662; http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html; http://www.securityfocus.com/bid/46785
CVE: CVE-2011-1286
Published: 2011-03-11
Description: Google V8, as used in Google Chrome before 10.0.648.127, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger incorrect access to memory.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=74675; http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html; http://www.securityfocus.com/bid/46785
CVE: CVE-2011-1413
Published: 2011-03-11
Description: Google Chrome before 10.0.648.127 on Linux does not properly mitigate an unspecified flaw in an X server, which allows remote attackers to cause a denial of service (application crash) via vectors involving long messages.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=49747; http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html; http://www.securityfocus.com/bid/46785
CVE: CVE-2010-3609
Published: 2011-03-11
Description: The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.vmware.com/pipermail/security-announce/2011/000126.html; http://secunia.com/advisories/43601; http://secunia.com/advisories/43742
CVE: CVE-2011-0456
Published: 2011-03-11
Description: webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN73162541/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000019; http://secunia.com/advisories/43960
CVE: CVE-2011-1137
Published: 2011-03-11
Description: Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://bugs.proftpd.org/show_bug.cgi?id=3586; http://bugs.proftpd.org/show_bug.cgi?id=3587; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058344.html
CVE: CVE-2011-1415
Published: 2011-03-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-1290.  Reason: This candidate is a duplicate of CVE-2011-1290.  Notes: All CVE users should reference CVE-2011-1290 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-1416
Published: 2011-03-11
Description: The Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246 allows attackers to read the contents of memory locations via unknown vectors, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011; http://www.zdnet.com/blog/security/pwn2own-2011-blackberry-falls-to-webkit-browser-attack/8401; http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
CVE: CVE-2011-1417
Published: 2011-03-11
Description: Integer overflow in QuickLook, as used in Apple Mac OS X before 10.6.7 and MobileSafari in Apple iOS before 4.2.7 and 4.3.x before 4.3.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a Microsoft Office document with a crafted size field in the OfficeArtMetafileHeader, related to OfficeArtBlip, as demonstrated on the iPhone by Charlie Miller and Dion Blazakis during a Pwn2Own competition at CanSecWest 2011.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00005.html; http://lists.apple.com/archives/security-announce/2011//Apr/msg00000.html
CVE: CVE-2011-1290
Published: 2011-03-11
Description: Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246, in Google Chrome before 10.0.648.133, and in Apple Safari before 5.0.5, allows remote attackers to execute arbitrary code via unknown vectors related to CSS "style handling," nodesets, and a length value, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011; http://googlechromereleases.blogspot.com/2011/03/stable-and-beta-channel-updates.html; http://lists.apple.com/archives/security-announce/2011//Apr/msg00000.html
CVE: CVE-2010-4651
Published: 2011-03-11
Description: Directory traversal vulnerability in util.c in GNU patch 2.6.1 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a filename that is specified with a .. (dot dot) or full pathname, a related issue to CVE-2010-1679.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://git.savannah.gnu.org/cgit/patch.git/commit/?id=685a78b6052f4df6eac6d625a545cfb54a6ac0e1; http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055241.html
CVE: CVE-2011-0157
Published: 2011-03-11
Description: WebKit, as used in Apple iOS before 4.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-09-1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html; http://support.apple.com/kb/HT4564; http://www.securityfocus.com/bid/46807
CVE: CVE-2011-0158
Published: 2011-03-11
Description: MobileSafari in Apple iOS before 4.3 does not properly implement application launching through URL handlers, which allows remote attackers to cause a denial of service (persistent application crash) via crafted JavaScript code.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html; http://support.apple.com/kb/HT4564; http://www.securityfocus.com/bid/46806
CVE: CVE-2011-0159
Published: 2011-03-11
Description: The Safari Settings feature in Safari in Apple iOS 4.x before 4.3 does not properly implement the clearing of cookies during execution of the Safari application, which might make it easier for remote web servers to track users by setting a cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html; http://support.apple.com/kb/HT4564; http://www.securityfocus.com/bid/46810
CVE: CVE-2011-0160
Published: 2011-03-11
Description: WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle redirects in conjunction with HTTP Basic Authentication, which might allow remote web servers to capture credentials by logging the Authorization HTTP header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html; http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html; http://support.apple.com/kb/HT4564
CVE: CVE-2011-0161
Published: 2011-03-11
Description: WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle the Attr.style accessor, which allows remote attackers to bypass the Same Origin Policy and inject Cascading Style Sheets (CSS) token sequences via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-264
References: http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html; http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html; http://support.apple.com/kb/HT4564
CVE: CVE-2011-0162
Published: 2011-03-11
Description: Wi-Fi in Apple iOS before 4.3 and Apple TV before 4.2 does not properly perform bounds checking for Wi-Fi frames, which allows remote attackers to cause a denial of service (device reset) via unspecified traffic on the local wireless network.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html; http://lists.apple.com/archives/security-announce/2011//Mar/msg00005.html; http://support.apple.com/kb/HT4564
CVE: CVE-2011-0163
Published: 2011-03-11
Description: WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle unspecified "cached resources," which allows remote attackers to cause a denial of service (resource unavailability) via a crafted web site that conducts a cache-poisoning attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html; http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html; http://support.apple.com/kb/HT4564
CVE: CVE-2011-0166
Published: 2011-03-11
Description: The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via vectors related to the dragging of content.  NOTE: this might overlap CVE-2011-0778.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html; http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html; http://support.apple.com/kb/HT4566
CVE: CVE-2011-0167
Published: 2011-03-11
Description: The windows functionality in WebKit in Apple Safari before 5.0.4 allows remote attackers to bypass the Same Origin Policy, and force the upload of arbitrary local files from a client computer, via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html; http://support.apple.com/kb/HT4566; http://www.securityfocus.com/bid/46816
CVE: CVE-2011-0169
Published: 2011-03-11
Description: WebKit in Apple Safari before 5.0.4, when the Web Inspector is used, does not properly handle the window.console._inspectorCommandLineAPI property, which allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html; http://support.apple.com/kb/HT4566; http://www.securityfocus.com/bid/46809
CVE: CVE-2011-0715
Published: 2011-03-11
Description: The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056071.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056072.html
CVE: CVE-2011-1418
Published: 2011-03-11
Description: The stateless address autoconfiguration (aka SLAAC) functionality in the IPv6 networking implementation in Apple iOS before 4.3 and Apple TV before 4.2 places the MAC address into the IPv6 address, which makes it easier for remote IPv6 servers to track users by logging source IPv6 addresses.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html; http://lists.apple.com/archives/security-announce/2011//Mar/msg00005.html; http://support.apple.com/kb/HT4564
CVE: CVE-2011-0280
Published: 2011-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in HP Power Manager (HPPM) 4.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the logType parameter to Contents/exportlogs.asp, (2) the Id parameter to Contents/pagehelp.asp, or the (3) SORTORD or (4) SORTCOL parameter to Contents/applicationlogs.asp.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2011-03/0111.html; http://secunia.com/advisories/43058; http://www.securityfocus.com/bid/46830
CVE: CVE-2011-0432
Published: 2011-03-14
Description: Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://code.google.com/p/pywebdav/updates/list; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055412.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055413.html
CVE: CVE-2011-0700
Published: 2011-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, and (5) escaping of tags within the tags meta box.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://codex.wordpress.org/Version_3.0.5; http://core.trac.wordpress.org/changeset/17397; http://core.trac.wordpress.org/changeset/17401
CVE: CVE-2011-0701
Published: 2011-03-14
Description: wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://codex.wordpress.org/Version_3.0.5; http://core.trac.wordpress.org/changeset/17393; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056412.html
CVE: CVE-2011-1088
Published: 2011-03-14
Description: Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
CVSS Score: 5.8 (MEDIUM)
References: http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E; http://markmail.org/message/lzx5273wsgl5pob6; http://markmail.org/message/yzmyn44f5aetmm2r
CVE: CVE-2011-1091
Published: 2011-03-14
Description: libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7.10 allows (1) remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG notification packet, and allows (2) remote Yahoo! servers to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG SMS message.
CVSS Score: 4.0 (MEDIUM)
References: http://developer.pidgin.im/viewmtn/revision/diff/5cbe18129b6e7c660bc093f7e5e1414ceca17d04/with/a7c415abba1f5f01f[PII_REDACTED]8837f73d99bb7/libpurple/protocols/yahoo/libymsg.c; http://developer.pidgin.im/viewmtn/revision/info/a7c415abba1f5f01f[PII_REDACTED]8837f73d99bb7; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055874.html
CVE: CVE-2011-1419
Published: 2011-03-14
Description: Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
CVSS Score: 5.8 (MEDIUM)
References: http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E; http://marc.info/?l=tomcat-user&m=[PII_REDACTED]5409&w=2; http://markmail.org/message/lzx5273wsgl5pob6
CVE: CVE-2010-4757
Published: 2011-03-15
Description: Cross-site scripting (XSS) vulnerability in submitnews.php in e107 before 0.7.23 allows remote attackers to inject arbitrary web script or HTML via the submitnews_title parameter, a different vector than CVE-2008-6208.  NOTE: some of these details are obtained from third party information.  NOTE: this might be the same as CVE-2009-4083.1 or CVE-2011-0457.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://e107.org/comment.php?comment.news.872; http://e107.org/svn_changelog.php?version=0.7.23; http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/newspost.php?r1=11655&r2=11654&pathrev=11655
CVE: CVE-2011-0001
Published: 2011-03-15
Description: Double free vulnerability in the iscsi_rx_handler function (usr/iscsi/iscsid.c) in the tgt daemon (tgtd) in Linux SCSI target framework (tgt) before 1.0.14, aka scsi-target-utils, allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown vectors related to a buffer overflow during iscsi login.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html; http://lists.wpkg.org/pipermail/stgt/2011-March/004473.html; http://secunia.com/advisories/43706
CVE: CVE-2011-0063
Published: 2011-03-15
Description: The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./.../ sequence in the "extra" parameter to the help command, which causes the regular expression to produce .. (dot dot) sequences.  NOTE: this vulnerability is due to an incomplete fix for CVE-2011-0049.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/43631; http://securityreason.com/securityalert/8133; http://sotiriu.de/adv/NSOADV-2011-003.txt
CVE: CVE-2011-0438
Published: 2011-03-15
Description: nslcd/pam.c in the nss-pam-ldapd 0.8.0 PAM module returns a success code when a user is not found in LDAP, which allows remote attackers to bypass authentication.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://arthurdejong.org/nss-pam-ldapd/news.html#20110309; http://lists.arthurdejong.org/nss-pam-ldapd-announce/2011/attachments/txtVf3rHgt8qQ.txt; http://lists.arthurdejong.org/nss-pam-ldapd-announce/2011/msg00000.html
CVE: CVE-2011-0457
Published: 2011-03-15
Description: Cross-site scripting (XSS) vulnerability in e107 0.7.22 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://e107.org/comment.php?comment.news.872; http://e107.org/svn_changelog.php?version=0.7.23; http://jvn.jp/en/jp/JVN01635457/index.html