deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-0675
Published: 2010-02-22
Description: Cross-site scripting (XSS) vulnerability in index.php in BGSvetionik BGS CMS 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the search parameter in a search action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/62363; http://packetstormsecurity.org/1002-exploits/bgscms-xss.txt; http://secunia.com/advisories/38597
CVE: CVE-2010-0676
Published: 2010-02-22
Description: Directory traversal vulnerability in index.php in the RWCards (com_rwcards) component 3.0.18 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1002-exploits/joomlarwcards-lfi.txt; http://secunia.com/advisories/38638; http://www.securityfocus.com/bid/38267
CVE: CVE-2009-4650
Published: 2010-02-22
Description: SQL injection vulnerability in the Webee Comments (com_webeecomment) component 1.1.1, 1.2, and 2.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the articleId parameter in a default action to index2.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jeffchannell.com/Joomla/webee-111-multiple-vulnerabilities.html; http://secunia.com/advisories/38625; http://www.osvdb.org/62334
CVE: CVE-2009-4651
Published: 2010-02-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Webee Comments (com_webeecomment) component 1.1.1, 1.2, and 2.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) color, (2) img, or (3) url BBCode tags in unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jeffchannell.com/Joomla/webee-111-multiple-vulnerabilities.html; http://www.securityfocus.com/bid/38204; http://jeffchannell.com/Joomla/webee-111-multiple-vulnerabilities.html
CVE: CVE-2010-0677
Published: 2010-02-22
Description: SQL injection vulnerability in index.php in Katalog Stron Hurricane 1.3.5, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the get parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62339; http://packetstormsecurity.org/1002-exploits/katalog-rfisql.txt; http://secunia.com/advisories/38581
CVE: CVE-2010-0678
Published: 2010-02-22
Description: PHP remote file inclusion vulnerability in includes/moderation.php in Katalog Stron Hurricane 1.3.5, and possibly earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the includes_directory parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/62340; http://packetstormsecurity.org/1002-exploits/katalog-rfisql.txt; http://secunia.com/advisories/38581
CVE: CVE-2010-0679
Published: 2010-02-22
Description: Multiple stack-based buffer overflows in the HyleosChemView.HLChemView ActiveX control (HyleosChemView.ocx) in Hyleos ChemView 1.9.5.1 allow remote attackers to execute arbitrary code via a large number of white space characters in the filename argument to the (1) SaveasMolFile and (2) ReadMolFile methods.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/62276; http://packetstormsecurity.org/1002-advisories/chemviewx-overflow.txt; http://packetstormsecurity.org/1002-exploits/hyleoschemview-heap.rb.txt
CVE: CVE-2010-0680
Published: 2010-02-22
Description: Directory traversal vulnerability in index.php in ZeusCMS 0.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/11437; http://www.securityfocus.com/bid/38237; http://www.exploit-db.com/exploits/11437
CVE: CVE-2010-0681
Published: 2010-02-22
Description: ZeusCMS 0.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request for admin/backup.sql.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/11437; http://www.exploit-db.com/exploits/11437
CVE: CVE-2010-0690
Published: 2010-02-23
Description: SQL injection vulnerability in index.php in CommodityRentals Video Games Rentals allows remote attackers to execute arbitrary SQL commands via the pfid parameter in a catalog action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62295; http://packetstormsecurity.org/1002-exploits/videogamesrental-sql.txt; http://secunia.com/advisories/38555
CVE: CVE-2010-0691
Published: 2010-02-23
Description: SQL injection vulnerability in druckansicht.php in JTL-Shop 2 allows remote attackers to execute arbitrary SQL commands via the s parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62329; http://secunia.com/advisories/38588; http://www.exploit-db.com/exploits/11445
CVE: CVE-2010-0692
Published: 2010-02-23
Description: SQL injection vulnerability in the IP-Tech JQuarks (com_jquarks) Component 0.2.3, and possibly earlier, for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/38623; http://www.iptechinside.com/labs/news/show/6; http://www.osvdb.org/62332
CVE: CVE-2010-0693
Published: 2010-02-23
Description: SQL injection vulnerability in products.php in CommodityRentals Trade Manager Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62294; http://packetstormsecurity.org/1002-exploits/trademanager-sql.txt; http://secunia.com/advisories/38556
CVE: CVE-2010-0694
Published: 2010-02-23
Description: SQL injection vulnerability in the PerchaGallery (com_perchagallery) component before 1.5b for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an editunidad action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://docs.joomla.org/Vulnerable_Extensions_List#New_format_Feed_Starts_Here; http://packetstormsecurity.org/1001-exploits/joomlaperchagallery-sql.txt; http://www.exploit-db.com/exploits/11024
CVE: CVE-2010-0695
Published: 2010-02-23
Description: Cross-site scripting (XSS) vulnerability in pages/index.php in BASIC-CMS allows remote attackers to inject arbitrary web script or HTML via the nav_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1002-exploits/basiccms-sqlxss.txt; http://www.securityfocus.com/bid/38235; http://packetstormsecurity.org/1002-exploits/basiccms-sqlxss.txt
CVE: CVE-2010-0696
Published: 2010-02-23
Description: Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/62331; http://secunia.com/advisories/38587; http://www.exploit-db.com/exploits/11447
CVE: CVE-2009-3036
Published: 2010-02-23
Description: Cross-site scripting (XSS) vulnerability in the console in Symantec IM Manager 8.3 and 8.4 before 8.4.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/62446; http://secunia.com/advisories/38672; http://www.securityfocus.com/bid/38241
CVE: CVE-2010-0107
Published: 2010-02-23
Description: Buffer overflow in an ActiveX control (SYMLTCOM.dll) in Symantec N360 1.0 and 2.0; Norton Internet Security, AntiVirus, SystemWorks, and Confidential 2006 through 2008; and Symantec Client Security 3.0.x before 3.1 MR9, and 3.1.x before MR9; allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.  NOTE: this is only a vulnerability if the attacker can "masquerade as an authorized site."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/62412; http://secunia.com/advisories/38654; http://www.securityfocus.com/archive/1/509717/100/0/threaded
CVE: CVE-2010-0146
Published: 2010-02-23
Description: Directory traversal vulnerability in the Management Center for Cisco Security Agents 6.0 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/62443; http://secunia.com/advisories/38619; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1910d.shtml
CVE: CVE-2010-0147
Published: 2010-02-23
Description: SQL injection vulnerability in the Management Center for Cisco Security Agents 5.1 before 5.1.0.117, 5.2 before 5.2.0.296, and 6.0 before 6.0.1.132 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/62444; http://secunia.com/advisories/38619; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1910d.shtml
CVE: CVE-2010-0148
Published: 2010-02-23
Description: Unspecified vulnerability in Cisco Security Agent 5.2 before 5.2.0.285, when running on Linux, allows remote attackers to cause a denial of service (kernel panic) via "a series of TCP packets."
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/62445; http://secunia.com/advisories/38619; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1910d.shtml
CVE: CVE-2010-0189
Published: 2010-02-23
Description: A certain ActiveX control in NOS Microsystems getPlus Download Manager (aka DLM or Downloader) 1.5.2.35, as used in Adobe Download Manager, improperly validates requests involving web sites that are not in subdomains, which allows remote attackers to force the download and installation of arbitrary programs via a crafted name for a download site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://aviv.raffon.net/2010/02/18/SkeletonsInAdobesSecurityCloset.aspx; http://blogs.adobe.com/psirt/2010/02/adobe_download_manager_issue.html; http://blogs.zdnet.com/security/?p=5505
CVE: CVE-2010-0682
Published: 2010-02-23
Description: WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://hakre.wordpress.com/2010/02/16/the-short-memory-of-wordpress-org-security/; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052917.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052932.html
CVE: CVE-2010-0685
Published: 2010-02-23
Description: The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Business Edition B.x.x and C.x.x, when using the ${EXTEN} channel variable and wildcard pattern matches, allows context-dependent attackers to inject strings into the dialplan using metacharacters that are injected when the variable is expanded, as demonstrated using the Dial application to process a crafted SIP INVITE message that adds an unintended outgoing channel leg.  NOTE: it could be argued that this is not a vulnerability in Asterisk, but a class of vulnerabilities that can occur in any program that uses this feature without the associated filtering functionality that is already available.
CVSS Score: 5.0 (MEDIUM)
References: http://downloads.digium.com/pub/security/AST-2010-002.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037679.html; http://secunia.com/advisories/38641
CVE: CVE-2010-0697
Published: 2010-02-23
Description: Cross-site scripting (XSS) vulnerability in the iTweak Upload module 6.x-1.x before 6.x-1.2 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users, with create content and upload file permissions, to inject arbitrary web script or HTML via the file name of an uploaded file.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/711072; http://drupal.org/node/711074; http://drupal.org/node/717214
CVE: CVE-2010-0698
Published: 2010-02-23
Description: SQL injection vulnerability in backoffice/login.asp in Dynamicsoft WSC CMS 2.2 allows remote attackers to execute arbitrary SQL commands via the Password parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1002-exploits/wsccms-sql.txt; http://secunia.com/advisories/38698; http://www.exploit-db.com/exploits/11507
CVE: CVE-2010-0699
Published: 2010-02-23
Description: Cross-site scripting (XSS) vulnerability in index.php in VideoSearchScript Pro 3.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1002-exploits/vss-xss.txt; http://secunia.com/advisories/38701; http://packetstormsecurity.org/1002-exploits/vss-xss.txt
CVE: CVE-2010-0700
Published: 2010-02-23
Description: Cross-site scripting (XSS) vulnerability in index.php in WampServer 2.0i allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/62481; http://secunia.com/advisories/38706; http://www.securityfocus.com/bid/38357
CVE: CVE-2010-0701
Published: 2010-02-23
Description: SQL injection vulnerability in ForceChangePassword.jsp in Newgen Software OmniDocs allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62403; http://packetstormsecurity.org/1002-exploits/omnidocs-sql.txt; http://secunia.com/advisories/38527
CVE: CVE-2010-0702
Published: 2010-02-23
Description: SQL injection vulnerability in cisco/services/PhonecDirectory.php in Fonality Trixbox 2.2.4 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1002-exploits/tribox-sql.txt; http://www.exploit-db.com/exploits/11508; http://www.securityfocus.com/bid/38323
CVE: CVE-2010-0703
Published: 2010-02-23
Description: Cross-site scripting (XSS) vulnerability in wa/auth in PortWise SSL VPN 4.6 allows remote attackers to inject arbitrary web script or HTML via the reloadFrame parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/62482; http://packetstormsecurity.org/1002-exploits/PR09-04.txt; http://secunia.com/advisories/38627
CVE: CVE-2010-0285
Published: 2010-02-24
Description: gnome-screensaver 2.14.3, 2.22.2, 2.27.x, 2.28.0, and 2.28.3, when the X configuration enables the extend screen option, allows physically proximate attackers to bypass screen locking, access an unattended workstation, and view half of the GNOME desktop by attaching an external monitor.
CVSS Score: 5.6 (MEDIUM)
References: http://git.gnome.org/browse/gnome-screensaver/commit/?id=2f597ea9f1f363277fd4dfc109fa41bbc6225aca; http://security-tracker.debian.org/tracker/CVE-2010-0285; http://www.mandriva.com/security/advisories?name=MDVSA-2011:093
CVE: CVE-2010-0420
Published: 2010-02-24
Description: libpurple in Finch in Pidgin before 2.6.6, when an XMPP multi-user chat (MUC) room is used, does not properly parse nicknames containing <br> sequences, which allows remote attackers to cause a denial of service (application crash) via a crafted nickname.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://developer.pidgin.im/wiki/ChangeLog; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035332.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035347.html
CVE: CVE-2010-0422
Published: 2010-02-24
Description: gnome-screensaver 2.28.x before 2.28.3 does not properly synchronize the state of screen locking and the unlock dialog in situations involving a change to the number of monitors, which allows physically proximate attackers to bypass screen locking and access an unattended workstation by connecting and disconnecting monitors multiple times, a related issue to CVE-2010-0414.
CVSS Score: 4.0 (MEDIUM)
References: http://ftp.gnome.org/pub/GNOME/sources/gnome-screensaver/2.28/gnome-screensaver-2.28.3.news; http://git.gnome.org/browse/gnome-screensaver/commit/?id=271ae93d7b140b8ba40d77f9e4ce894e5fd1b554; http://git.gnome.org/browse/gnome-screensaver/commit/?id=d4dcbd65a2df3c093c4e3a74bbbc75383eb9eadb
CVE: CVE-2010-0423
Published: 2010-02-24
Description: gtkimhtml.c in Pidgin before 2.6.6 allows remote attackers to cause a denial of service (CPU consumption and application hang) by sending many smileys in a (1) IM or (2) chat.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://developer.pidgin.im/wiki/ChangeLog; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035332.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035347.html
CVE: CVE-2010-0426
Published: 2010-02-24
Description: sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.9p21.patch.gz; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=570737; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040578.html
CVE: CVE-2010-0640
Published: 2010-02-24
Description: Cross-site scripting (XSS) vulnerability in CA eHealth Performance Manager 6.0.x through 6.2.x, when malicious HTML detection is disabled, allows remote attackers to inject arbitrary web script or HTML via a crafted request.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2010/Feb/415; http://www.securityfocus.com/archive/1/509714/100/0/threaded; http://www.securityfocus.com/bid/38376
CVE: CVE-2010-0118
Published: 2010-02-25
Description: Bournal before 1.4.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified temporary files associated with a --hack_the_gibson update check.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036697.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036701.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036764.html
CVE: CVE-2010-0119
Published: 2010-02-25
Description: Bournal before 1.4.1 on FreeBSD 8.0, when the -K option is used, places a ccrypt key on the command line, which allows local users to obtain sensitive information by listing the process and its arguments, related to "echoing."
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036697.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036701.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036764.html
CVE: CVE-2010-0412
Published: 2010-02-25
Description: stap-server in SystemTap 1.1 does not properly restrict the value of the -B (aka BUILD) option, which allows attackers to have an unspecified impact via vectors associated with executing the make program, a different vulnerability than CVE-2009-4273.
CVSS Score: 7.5 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035201.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035261.html; http://lists.fedoraproject.org/pipermail/scm-commits/2010-February/394714.html
CVE: CVE-2010-0620
Published: 2010-02-25
Description: Directory traversal vulnerability in the SSL Service in EMC HomeBase Server 6.2.x before 6.2.3 and 6.3.x before 6.3.2 allows remote attackers to overwrite arbitrary files with any content, and consequently execute arbitrary code, via a .. (dot dot) in an unspecified parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/8230; http://www.securityfocus.com/archive/1/509723/100/0/threaded; http://www.securityfocus.com/bid/38380
CVE: CVE-2010-0704
Published: 2010-02-25
Description: Cross-site scripting (XSS) vulnerability in the Portlet Palette in IBM WebSphere Portal 6.0.1.5 wp6015_008_01 allows remote attackers to inject arbitrary web script or HTML via the search field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38574; http://www-01.ibm.com/support/docview.wss?uid=swg1PM05829; http://secunia.com/advisories/38574
CVE: CVE-2010-0705
Published: 2010-02-25
Description: Aavmker4.sys in avast! 4.8 through 4.8.1368.0 and 5.0 before 5.0.418.0 running on Windows 2000 and XP does not properly validate input to IOCTL 0xb2d60030, which allows local users to cause a denial of service (system crash) or execute arbitrary code to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://forum.avast.com/index.php?topic=55484.0; http://osvdb.org/62510; http://secunia.com/advisories/38677
CVE: CVE-2010-0706
Published: 2010-02-25
Description: Cross-site scripting (XSS) vulnerability in the login/prompt component in Subex Nikira Fraud Management System allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38564; http://www.packetstormsecurity.org/1002-exploits/nikara-xss.txt; http://www.securityfocus.com/bid/38311
CVE: CVE-2010-0707
Published: 2010-02-25
Description: Cross-site request forgery (CSRF) vulnerability in add_user.php in Employee Timeclock Software 0.99 allows remote attackers to hijack the authentication of an administrator for requests that create new administrative users.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/62478; http://secunia.com/advisories/38662; http://www.exploit-db.com/exploits/11516
CVE: CVE-2003-1589
Published: 2010-02-25
Description: Unspecified vulnerability in Sun ONE (aka iPlanet) Web Server 4.1 before SP13 and 6.0 before SP6 on Windows allows attackers to cause a denial of service (daemon crash) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-66-201454-1; https://exchange.xforce.ibmcloud.com/vulnerabilities/56616; http://sunsolve.sun.com/search/document.do?assetkey=1-66-201454-1
CVE: CVE-2003-1590
Published: 2010-02-25
Description: Unspecified vulnerability in Sun ONE (aka iPlanet) Web Server 6.0 SP3 through SP5 on Windows allows remote attackers to cause a denial of service (daemon crash) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-66-201451-1; https://exchange.xforce.ibmcloud.com/vulnerabilities/56615; http://sunsolve.sun.com/search/document.do?assetkey=1-66-201451-1
CVE: CVE-2010-0011
Published: 2010-02-25
Description: The eval_js function in uzbl-core.c in Uzbl before 2010.01.05 exposes the run method of the Uzbl object, which allows remote attackers to execute arbitrary commands via JavaScript code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://github.com/Dieterbe/uzbl/commit/1958b52d41cba96956dc1995660de49525ed1047; http://github.com/Dieterbe/uzbl/downloads; http://lists.uzbl.org/pipermail/uzbl-dev-uzbl.org/2010-January/000586.html