deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1111
Published: 2010-03-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Jokes Complete Website allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to joke.php and the (2) searchingred parameter to results.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.packetstormsecurity.com/1001-exploits/jokescomplete-xss.txt; http://www.securityfocus.com/bid/37852; https://exchange.xforce.ibmcloud.com/vulnerabilities/55761
CVE: CVE-2010-1112
Published: 2010-03-25
Description: Cross-site scripting (XSS) vulnerability in cat.php in KloNews 2.0 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1001-exploits/klonews-xss.txt; http://secunia.com/advisories/38268; http://packetstormsecurity.org/1001-exploits/klonews-xss.txt
CVE: CVE-2010-1113
Published: 2010-03-25
Description: Cross-site scripting (XSS) vulnerability in the forum page in Web Server Creator - Web Portal 0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.packetstormsecurity.com/1001-exploits/webservercreator-traversalxssrfi.txt; http://www.securityfocus.com/bid/37841; https://exchange.xforce.ibmcloud.com/vulnerabilities/55726
CVE: CVE-2010-1114
Published: 2010-03-25
Description: Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pg parameter to index.php and the (2) path parameter to news/form.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.packetstormsecurity.com/1001-exploits/webservercreator-traversalxssrfi.txt; http://www.securityfocus.com/bid/37841; https://exchange.xforce.ibmcloud.com/vulnerabilities/55727
CVE: CVE-2010-1115
Published: 2010-03-25
Description: Directory traversal vulnerability in news/include/customize.php in Web Server Creator - Web Portal 0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the l parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.packetstormsecurity.com/1001-exploits/webservercreator-traversalxssrfi.txt; http://www.securityfocus.com/bid/37841; https://exchange.xforce.ibmcloud.com/vulnerabilities/55725
CVE: CVE-2010-1116
Published: 2010-03-25
Description: LookMer Music Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for dbmdb/LookMerSarkiMDB.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/61845; http://secunia.com/advisories/38247; http://www.packetstormsecurity.com/1001-exploits/lookmer-disclose.txt
CVE: CVE-2010-0164
Published: 2010-03-25
Description: Use-after-free vulnerability in the imgContainer::InternalAddFrameHelper function in src/imgContainer.cpp in libpr0n in Mozilla Firefox 3.6 before 3.6.2 allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a multipart/x-mixed-replace animation in which the frames have different bits-per-pixel (bpp) values.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.mandriva.com/security/advisories?name=MDVSA-2010:070; http://www.mozilla.org/security/announce/2010/mfsa2010-09.html; http://www.securityfocus.com/archive/1/510535/100/0/threaded
CVE: CVE-2010-0165
Published: 2010-03-25
Description: The TraceRecorder::traverseScopeChain function in js/src/jstracer.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via vectors involving certain indirect calls to the JavaScript eval function.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.mandriva.com/security/advisories?name=MDVSA-2010:070; http://www.mozilla.org/security/announce/2010/mfsa2010-11.html; http://www.securityfocus.com/bid/38918
CVE: CVE-2010-0166
Published: 2010-03-25
Description: The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 on Mac OS X, when the Core Text API is used, does not properly perform certain deletions, which allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via an HTML document containing invisible Unicode characters, as demonstrated by the U+FEFF, U+FFF9, U+FFFA, and U+FFFB characters.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://www.mozilla.org/security/announce/2010/mfsa2010-11.html; http://www.securityfocus.com/bid/38918; http://www.securityfocus.com/bid/38943
CVE: CVE-2010-0167
Published: 2010-03-25
Description: The browser engine in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via vectors related to (1) layout/generic/nsBlockFrame.cpp and (2) the _evaluate function in modules/plugin/base/src/nsNPAPIPlugin.cpp.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.mandriva.com/security/advisories?name=MDVSA-2010:070; http://www.mozilla.org/security/announce/2010/mfsa2010-11.html; http://www.securityfocus.com/bid/38918
CVE: CVE-2010-0168
Published: 2010-03-25
Description: The nsDocument::MaybePreLoadImage function in content/base/src/nsDocument.cpp in the image-preloading implementation in Mozilla Firefox 3.6 before 3.6.2 does not apply scheme restrictions and policy restrictions to the image's URL, which might allow remote attackers to cause a denial of service (application crash or hang) or hijack the functionality of the browser's add-ons via a crafted SRC attribute of an IMG element, as demonstrated by remote command execution through an ssh: URL in a configuration that supports gnome-vfs with a nonstandard network.gnomevfs.supported-protocols setting.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://www.mandriva.com/security/advisories?name=MDVSA-2010:070; http://www.mozilla.org/security/announce/2010/mfsa2010-13.html; http://www.securityfocus.com/bid/38918
CVE: CVE-2010-0169
Published: 2010-03-25
Description: The CSSLoaderImpl::DoSheetComplete function in layout/style/nsCSSLoader.cpp in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 changes the case of certain strings in a stylesheet before adding this stylesheet to the XUL cache, which might allow remote attackers to modify the browser's font and other CSS attributes, and potentially disrupt rendering of a web page, by forcing the browser to perform this erroneous stylesheet caching.
CVSS Score: 5.0 (MEDIUM)
References: http://www.mozilla.org/security/announce/2010/mfsa2010-14.html; http://www.securityfocus.com/bid/38918; http://www.vupen.com/english/advisories/2010/0692
CVE: CVE-2010-0170
Published: 2010-03-25
Description: Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors that are specific to each affected plugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mandriva.com/security/advisories?name=MDVSA-2010:070; http://www.mozilla.org/security/announce/2010/mfsa2010-10.html; http://www.securityfocus.com/bid/38918
CVE: CVE-2010-0171
Published: 2010-03-25
Description: Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting (XSS) attacks, by using the addEventListener and setTimeout functions in conjunction with a wrapped object.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-3736.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mozilla.org/security/announce/2010/mfsa2010-12.html; http://www.securityfocus.com/bid/38918; http://www.vupen.com/english/advisories/2010/0692
CVE: CVE-2010-0172
Published: 2010-03-25
Description: toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6 before 3.6.2 does not properly handle concurrent authorization requests from multiple web sites, which might allow remote web servers to spoof an authorization dialog and capture credentials by demanding HTTP authentication in opportunistic circumstances.
CVSS Score: 4.3 (MEDIUM)
References: http://www.mandriva.com/security/advisories?name=MDVSA-2010:070; http://www.mozilla.org/security/announce/2010/mfsa2010-15.html; http://www.securityfocus.com/bid/38918
CVE: CVE-2010-0576
Published: 2010-03-25
Description: Unspecified vulnerability in Cisco IOS 12.0 through 12.4, IOS XE 2.1.x through 2.3.x before 2.3.2, and IOS XR 3.2.x through 3.4.3, when Multiprotocol Label Switching (MPLS) and Label Distribution Protocol (LDP) are enabled, allows remote attackers to cause a denial of service (device reload or process restart) via a crafted LDP packet, aka Bug IDs CSCsz45567 and CSCsj25893.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/63188; http://secunia.com/advisories/39065; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b20ee2.shtml
CVE: CVE-2010-0577
Published: 2010-03-25
Description: Cisco IOS 12.2 through 12.4, when certain PMTUD, SNAT, or window-size configurations are used, allows remote attackers to cause a denial of service (infinite loop, and device reload or hang) via a TCP segment with crafted options, aka Bug ID CSCsz75186.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://osvdb.org/63178; http://secunia.com/advisories/39078; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b20f34.shtml
CVE: CVE-2010-0578
Published: 2010-03-25
Description: The IKE implementation in Cisco IOS 12.2 through 12.4 on Cisco 7200 and 7301 routers with VAM2+ allows remote attackers to cause a denial of service (device reload) via a malformed IKE packet, aka Bug ID CSCtb13491.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://osvdb.org/63182; http://secunia.com/advisories/39057; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b20ee5.shtml
CVE: CVE-2010-0579
Published: 2010-03-25
Description: The SIP implementation in Cisco IOS 12.3 and 12.4 allows remote attackers to cause a denial of service (device reload) via a malformed SIP message, aka Bug ID CSCtb93416, the "SIP Message Handling Denial of Service Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/39068; http://securitytracker.com/id?1023744; http://tools.cisco.com/security/center/viewAlert.x?alertId=20063
CVE: CVE-2010-0580
Published: 2010-03-25
Description: Unspecified vulnerability in the SIP implementation in Cisco IOS 12.3 and 12.4 allows remote attackers to execute arbitrary code via a malformed SIP message, aka Bug ID CSCsz48680, the "SIP Message Processing Arbitrary Code Execution Vulnerability."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/39068; http://securitytracker.com/id?1023744; http://tools.cisco.com/security/center/viewAlert.x?alertId=20064
CVE: CVE-2010-0581
Published: 2010-03-25
Description: Unspecified vulnerability in the SIP implementation in Cisco IOS 12.3 and 12.4 allows remote attackers to execute arbitrary code via a malformed SIP message, aka Bug ID CSCsz89904, the "SIP Packet Parsing Arbitrary Code Execution Vulnerability."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/39068; http://securitytracker.com/id?1023744; http://tools.cisco.com/security/center/viewAlert.x?alertId=20065
CVE: CVE-2010-0582
Published: 2010-03-25
Description: Cisco IOS 12.1 through 12.4, and 15.0M before 15.0(1)M1, allows remote attackers to cause a denial of service (interface queue wedge) via malformed H.323 packets, aka Bug ID CSCta19962.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/39067; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b20ee4.shtml; http://www.securitytracker.com/id?1023742
CVE: CVE-2010-0583
Published: 2010-03-25
Description: Memory leak in the H.323 implementation in Cisco IOS 12.1 through 12.4, and 15.0M before 15.0(1)M1, allows remote attackers to cause a denial of service (memory consumption and device reload) via malformed H.323 packets, aka Bug ID CSCtb93855.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/63181; http://secunia.com/advisories/39067; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b20ee4.shtml
CVE: CVE-2010-0584
Published: 2010-03-25
Description: Unspecified vulnerability in Cisco IOS 12.4, when NAT SCCP fragmentation support is enabled, allows remote attackers to cause a denial of service (device reload) via crafted Skinny Client Control Protocol (SCCP) packets, aka Bug ID CSCsy09250.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/63187; http://secunia.com/advisories/39062; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b20ee6.shtml
CVE: CVE-2010-0585
Published: 2010-03-25
Description: Cisco IOS 12.1 through 12.4, when Cisco Unified Communications Manager Express (CME) or Cisco Unified Survivable Remote Site Telephony (SRST) is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed Skinny Client Control Protocol (SCCP) message, aka Bug ID CSCsz48614, the "SCCP Packet Processing Denial of Service Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/39069; http://tools.cisco.com/security/center/viewAlert.x?alertId=20069; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b20f33.shtml
CVE: CVE-2010-0586
Published: 2010-03-25
Description: Cisco IOS 12.1 through 12.4, when Cisco Unified Communications Manager Express (CME) or Cisco Unified Survivable Remote Site Telephony (SRST) is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed Skinny Client Control Protocol (SCCP) message, aka Bug ID CSCsz49741, the "SCCP Request Handling Denial of Service Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/63177; http://secunia.com/advisories/39069; http://tools.cisco.com/security/center/viewAlert.x?alertId=20070
CVE: CVE-2010-1117
Published: 2010-03-25
Description: Heap-based buffer overflow in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to discover the base address of a Windows .dll file, and possibly have unspecified other impact, via unknown vectors, as demonstrated by Peter Vreugdenhil during a Pwn2Own competition at CanSecWest 2010.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010; http://news.cnet.com/8301-27080_3-20001126-245.html; http://twitter.com/thezdi/statuses/[PII_REDACTED]
CVE: CVE-2010-1118
Published: 2010-03-25
Description: Unspecified vulnerability in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a use-after-free issue, as demonstrated by Peter Vreugdenhil during a Pwn2Own competition at CanSecWest 2010.
CVSS Score: 10.0 (HIGH)
References: http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010; http://news.cnet.com/8301-27080_3-20001126-245.html; http://twitter.com/thezdi/statuses/[PII_REDACTED]
CVE: CVE-2010-1119
Published: 2010-03-25
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or read the SMS database or other data, via vectors related to "attribute manipulation," as demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010; http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1120
Published: 2010-03-25
Description: Unspecified vulnerability in Safari 4 on Apple Mac OS X 10.6 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by Charlie Miller during a Pwn2Own competition at CanSecWest 2010.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010; http://news.cnet.com/8301-27080_3-20001126-245.html; http://twitter.com/thezdi/statuses/[PII_REDACTED]
CVE: CVE-2010-1121
Published: 2010-03-25
Description: Mozilla Firefox 3.6.x before 3.6.3 does not properly manage the scopes of DOM nodes that are moved from one document to another, which allows remote attackers to conduct use-after-free attacks and execute arbitrary code via unspecified vectors involving improper interaction with garbage collection, as demonstrated by Nils during a Pwn2Own competition at CanSecWest 2010.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html
CVE: CVE-2010-0628
Published: 2010-03-25
Description: The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in the SPNEGO GSS-API functionality in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2 and 1.8 before 1.8.1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid packet that triggers incorrect preparation of an error token.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/39023; http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt; http://www.kb.cert.org/vuls/id/839413
CVE: CVE-2010-1122
Published: 2010-03-25
Description: Unspecified vulnerability in Mozilla Firefox 3.5.x through 3.5.8 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly have unknown other impact via vectors that might involve compressed data, a different vulnerability than CVE-2010-1028.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.mandriva.com/security/advisories?name=MDVSA-2010:070; https://bugzilla.mozilla.org/show_bug.cgi?id=552216; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12448
CVE: CVE-2009-4505
Published: 2010-03-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in OpenCMS OAMP Comments Module 1.0.1 allow remote attackers to inject arbitrary web script or HTML via the name field in a comment, and other unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/39099; http://www.csnc.ch/misc/files/advisories/CVE-2009-4505_opencms_oamp_comments_module_xss_cyrill_brunschwiler.txt; http://www.securityfocus.com/archive/1/510291/100/0/threaded
CVE: CVE-2010-0439
Published: 2010-03-26
Description: Chip Salzenberg Deliver allows local users to cause a denial of service, obtain sensitive information, and possibly change the ownership of arbitrary files via a symlink attack on an unspecified file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://www.securityfocus.com/archive/1/510306/100/0/threaded; http://www.securityfocus.com/bid/38924; http://www.securityfocus.com/archive/1/510306/100/0/threaded
CVE: CVE-2010-0731
Published: 2010-03-26
Description: The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html; http://secunia.com/advisories/39127; http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230
CVE: CVE-2010-0740
Published: 2010-03-26
Description: The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection that triggers a NULL pointer dereference, related to the minor version number.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc; http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038587.html
CVE: CVE-2010-0988
Published: 2010-03-26
Description: Multiple unspecified vulnerabilities in Pulse CMS before 1.2.3 allow (1) remote attackers to write to arbitrary files and execute arbitrary PHP code via vectors related to improper handling of login failures by includes/login.php; and allow remote authenticated users to write to arbitrary files and execute arbitrary PHP code via vectors involving the (2) filename and (3) block parameters to view.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/39011; http://secunia.com/secunia_research/2010-45/; http://secunia.com/secunia_research/2010-51/
CVE: CVE-2010-0989
Published: 2010-03-26
Description: Directory traversal vulnerability in delete.php in Pulse CMS before 1.2.3 allows remote authenticated users to delete arbitrary files via directory traversal sequences in the f parameter.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/39011; http://secunia.com/secunia_research/2010-48/; http://www.osvdb.org/63167
CVE: CVE-2010-1123
Published: 2010-03-26
Description: Chip Salzenberg Deliver does not properly associate a lockfile with the user who created the file, which allows local users to cause a denial of service (blockage of incoming e-mail) by creating lockfiles for arbitrary mailboxes.
CVSS Score: 2.1 (LOW)
CWE: CWE-362
References: http://www.securityfocus.com/archive/1/510306/100/0/threaded; http://www.securityfocus.com/bid/38924; https://exchange.xforce.ibmcloud.com/vulnerabilities/57558
CVE: CVE-2010-1124
Published: 2010-03-26
Description: bos.rte.libc 5.3.9.4 on IBM AIX 5.3 does not properly support reading a certain address field after a successful getaddrinfo function call, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors, as demonstrated by IBM DB2 crashes on "systems with databases cataloged with alternate servers using IP addresses."
CVSS Score: 7.8 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=isg1IZ66710; http://www.securityfocus.com/bid/38964; http://www-01.ibm.com/support/docview.wss?uid=isg1IZ66710
CVE: CVE-2009-4739
Published: 2010-03-26
Description: PHP remote file inclusion vulnerability in index.php in SkaDate Dating allows remote attackers to execute arbitrary PHP code via a URL in the language_id parameter.  NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/56543; http://secunia.com/advisories/35997; http://www.exploit-db.com/exploits/9260
CVE: CVE-2009-4740
Published: 2010-03-26
Description: Directory traversal vulnerability in the Webesse E-Card (ws_ecard) extension 1.0.2 and earlier for TYPO3 has unspecified impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/