deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-2595
Published: 2010-07-02
Description: The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in ImageMagick, does not properly handle invalid ReferenceBlackWhite values, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers an array index error, related to "downsampled OJPEG input."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://blackberry.com/btsc/KB27244; http://bugzilla.maptools.org/show_bug.cgi?id=2208; http://marc.info/?l=oss-security&m=[PII_REDACTED]2908&w=2
CVE: CVE-2010-2596
Published: 2010-07-02
Description: The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://bugzilla.maptools.org/show_bug.cgi?id=2209; http://marc.info/?l=oss-security&m=[PII_REDACTED]2908&w=2; http://secunia.com/advisories/40422
CVE: CVE-2010-2597
Published: 2010-07-02
Description: The TIFFVStripSize function in tif_strip.c in LibTIFF 3.9.0 and 3.9.2 makes incorrect calls to the TIFFGetField function, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image, related to "downsampled OJPEG input" and possibly related to a compiler optimization that triggers a divide-by-zero error.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://bugzilla.maptools.org/show_bug.cgi?id=2215; http://secunia.com/advisories/40422; http://secunia.com/advisories/40527
CVE: CVE-2010-2598
Published: 2010-07-02
Description: LibTIFF in Red Hat Enterprise Linux (RHEL) 3 on x86_64 platforms, as used in tiff2rgba, attempts to process image data even when the required compression functionality is not configured, which allows remote attackers to cause a denial of service via a crafted TIFF image, related to "downsampled OJPEG input."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/40536; http://www.redhat.com/support/errata/RHSA-2010-0520.html; http://www.vupen.com/english/advisories/2010/1761
CVE: CVE-2010-2609
Published: 2010-07-02
Description: SQL injection vulnerability in show_search_result.php in 2daybiz Job Search Engine Script allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/jobsearchengine-sql.txt; http://secunia.com/advisories/40290; http://www.exploit-db.com/exploits/13978
CVE: CVE-2010-2610
Published: 2010-07-02
Description: Multiple SQL injection vulnerabilities in 2daybiz Job Site Script allow remote attackers to execute arbitrary SQL commands via the (1) jid parameter to view_current_job.php, (2) job_iid parameter to show_search_more.php, and (3) left_cat parameter to show_search_result.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/65714; http://osvdb.org/65715; http://osvdb.org/65716
CVE: CVE-2010-2611
Published: 2010-07-02
Description: SQL injection vulnerability in show_search_result.php in i-netsolution Job Search Engine allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/inetsolutionjobsearch-sql.txt; http://www.exploit-db.com/exploits/14079; http://www.vupen.com/english/advisories/2010/1625
CVE: CVE-2010-2612
Published: 2010-07-02
Description: Unspecified vulnerability in the HP OpenVMS Auditing feature in OpenVMS ALPHA 7.3-2, 8.2, and 8.3; and OpenVMS for Integrity Servers 8.3 AND 8.3-1H1; allows local users to obtain sensitive information via unknown vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: ftp://ftp.itrc.hp.com/openvms_patches/alpha/V7.3-2/VMS732_SYS_MUP-V1900.txt; ftp://ftp.itrc.hp.com/openvms_patches/alpha/V8.2/VMS82A_SYS_MUP-V1700.txt; ftp://ftp.itrc.hp.com/openvms_patches/alpha/V8.3/VMS83A_SYS_MUP-V1700.txt
CVE: CVE-2010-2613
Published: 2010-07-02
Description: Cross-site scripting (XSS) vulnerability in the JExtensions JE Awd Song (com_awd_song) component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the song review field, which is not properly handled in a view action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1006-exploits/joomlaawdsong-xss.txt; http://www.exploit-db.com/exploits/14059; http://www.securityfocus.com/bid/41165
CVE: CVE-2010-2614
Published: 2010-07-02
Description: SQL injection vulnerability in admin/admin.php in Grafik CMS 1.1.2, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit_page action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_grafik_cms.html; http://www.securityfocus.com/archive/1/512071/100/0/threaded; http://www.vupen.com/english/advisories/2010/1629
CVE: CVE-2010-2615
Published: 2010-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/admin.php in Grafik CMS 1.1.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) page_menu and (2) description parameters in an edit_page action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.htbridge.ch/advisory/xss_vulnerability_in_grafik_cms.html; http://www.htbridge.ch/advisory/xss_vulnerability_in_grafik_cms_1.html; http://www.securityfocus.com/archive/1/512072/100/0/threaded
CVE: CVE-2010-2616
Published: 2010-07-02
Description: SQL injection vulnerability in bible.php in PHP Bible Search, probably 0.99, allows remote attackers to execute arbitrary SQL commands via the chapter parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.packetstormsecurity.com/1006-exploits/phpbiblesearch-sqlxss.txt; http://www.securityfocus.com/bid/41197; https://exchange.xforce.ibmcloud.com/vulnerabilities/59842
CVE: CVE-2010-2617
Published: 2010-07-02
Description: Cross-site scripting (XSS) vulnerability in bible.php in PHP Bible Search allows remote attackers to inject arbitrary web script or HTML via the chapter parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.packetstormsecurity.com/1006-exploits/phpbiblesearch-sqlxss.txt; http://www.securityfocus.com/bid/41197; https://exchange.xforce.ibmcloud.com/vulnerabilities/59843
CVE: CVE-2010-2618
Published: 2010-07-02
Description: PHP remote file inclusion vulnerability in inc/smarty/libs/init.php in AdaptCMS 2.0.0 Beta, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter.  NOTE: it was later reported that 2.0.1 is also affected.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.org/1006-exploits/adaptcms200-rfi.txt; http://www.exploit-db.com/exploits/14016; http://www.exploit-db.com/exploits/15237
CVE: CVE-2010-1666
Published: 2010-07-02
Description: Buffer overflow in Dan Pascu python-cjson 1.0.5, when UCS-4 encoding is enabled, allows context-dependent attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors involving crafted Unicode input to the cjson.encode function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/40335; http://secunia.com/advisories/40500; http://www.debian.org/security/2010/dsa-2068
CVE: CVE-2010-2480
Published: 2010-07-02
Description: Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.python.org/issue9061; http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html; http://secunia.com/advisories/39935
CVE: CVE-2010-2549
Published: 2010-07-02
Description: Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Vista SP1 and SP2 and Server 2008 Gold and SP2 allows local users to gain privileges or cause a denial of service (system crash) by using a large number of calls to the NtUserCheckAccessForIntegrityLevel function to trigger a failure in the LockProcessByClientId function, leading to deletion of an in-use process object, aka "Win32k Reference Count Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://osvdb.org/66003; http://seclists.org/fulldisclosure/2010/Jul/3; http://secunia.com/advisories/40421
CVE: CVE-2009-4924
Published: 2010-07-02
Description: Dan Pascu python-cjson 1.0.5 does not properly handle a ['/'] argument to cjson.encode, which makes it easier for remote attackers to conduct certain cross-site scripting (XSS) attacks involving Firefox and the end tag of a SCRIPT element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://pypi.python.org/pypi/python-cjson/; http://t3.dotgnu.info/blog/insecurity/quotes-dont-help.html; http://pypi.python.org/pypi/python-cjson/
CVE: CVE-2004-2769
Published: 2010-07-02
Description: Cerberus FTP Server before 4.0.3.0 allows remote authenticated users to list hidden files, even when the "Display hidden files" option is enabled, via the (1) MLSD or (2) MLST commands.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/40370; http://www.cerberusftp.com/phpBB3/viewtopic.php?f=4&t=644; http://www.cerberusftp.com/releasenotes.html
CVE: CVE-2010-2619
Published: 2010-07-02
Description: Citrix XenServer 5.0 Update 2 and earlier, and 5.5 Update 1 and earlier, when using a pvops kernel, allows guest users to cause a denial of service in the host via unspecified vectors that trigger "incorrectly set flags."
CVSS Score: 1.9 (LOW)
References: http://secunia.com/advisories/40282; http://support.citrix.com/article/CTX125319; http://www.securitytracker.com/id?1024157
CVE: CVE-2010-2620
Published: 2010-07-02
Description: Open&Compact FTP Server (Open-FTPD) 1.2 and earlier allows remote attackers to bypass authentication by sending (1) LIST, (2) RETR, (3) STOR, or other commands without performing the required login steps first.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/40284; http://www.exploit-db.com/exploits/13932; http://secunia.com/advisories/40284
CVE: CVE-2010-2621
Published: 2010-07-02
Description: The QSslSocketBackendPrivate::transmit function in src_network_ssl_qsslsocket_openssl.cpp in Qt 4.6.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a malformed request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.org/adv/qtsslame-adv.txt; http://aluigi.org/poc/qtsslame.zip; http://osvdb.org/65860
CVE: CVE-2010-2622
Published: 2010-07-02
Description: SQL injection vulnerability in the Joomanager component, possibly 1.1.1, for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14127; http://www.securityfocus.com/bid/41256; https://exchange.xforce.ibmcloud.com/vulnerabilities/59945
CVE: CVE-2010-2623
Published: 2010-07-02
Description: SQL injection vulnerability in pages.php in Internet DM Specialist Bed and Breakfast allows remote attackers to execute arbitrary SQL commands via the pp_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14144; http://www.securityfocus.com/bid/41275; http://www.vupen.com/english/advisories/2010/1677
CVE: CVE-2010-2624
Published: 2010-07-02
Description: Multiple SQL injection vulnerabilities in iScripts EasySnaps 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) comment parameter to add_comments.php, (2) values parameter to tags_details.php, or (3) begin parameter to greetings.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/40448; http://www.exploit-db.com/exploits/14162; http://www.salvatorefresta.net/files/adv/iScripts%20EasySnaps%202.0%20Multiple%20SQL%20Injection%20Vulnerabilities-01072010.txt
CVE: CVE-2010-2625
Published: 2010-07-02
Description: Unspecified vulnerability in the Client Service for DPM in Hitachi ServerConductor / Deployment Manager 01-00, 01-01, and 06-00 through 06-00-/A; ServerConductor / Deployment Manager Standard Edition and Enterprise Edition 07-50 through 07-55, and 07-57 through 07-59; and JP1/ServerConductor/Deployment Manager Standard and Enterprise Edition 07-50 through 07-56-/F, 08-00 through 08-09-/E, 08-50 through 08-80-/A, 08-06 through 08-07, and 08-51 through 08-70; allows attackers to cause a denial of service (shutdown and reboot) via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/65833; http://secunia.com/advisories/40343; http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-013/index.html
CVE: CVE-2010-2626
Published: 2010-07-02
Description: index.pl in Miyabi CGI Tools SEO Links 1.02 allows remote attackers to execute arbitrary commands via shell metacharacters in the fn command. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-06/0614.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-06/0615.html; http://osvdb.org/65884
CVE: CVE-2010-2627
Published: 2010-07-02
Description: Multiple directory traversal vulnerabilities in the Refractor 2 engine, as used in Battlefield 2 1.50 (1.5.3153-802.0) and earlier, and Battlefield 2142 (1.10.48.0) and earlier, allow remote servers to overwrite arbitrary files on the client via "..\" (dot dot backslash) sequences in URLs for the (1) sponsor or (2) community logos, and other URLs related to (3) DemoDownloadURL, (4) DemoIndexURL and (5) CustomMapsURL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://aluigi.altervista.org/adv/bf2urlz-adv.txt; http://osvdb.org/65863; http://secunia.com/advisories/40334
CVE: CVE-2010-1327
Published: 2010-07-06
Description: Multiple SQL injection vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the marca parameter to precios.php3 or (2) the where parameter in a delivery_courier action to control/abm_list.php3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.bonsai-sec.com/en/research/vulnerabilities/tornadostore-multiple-sql-injection-0106.php; http://www.securityfocus.com/bid/41233; https://exchange.xforce.ibmcloud.com/vulnerabilities/59950
CVE: CVE-2010-1328
Published: 2010-07-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tipo or (2) destino parameter to login_registrese.php3 in the Services section, (3) the rubro parameter to precios.php3 in the Products section, (4) the arti parameter to recomenda_articulo.php3 in the Products section, (5) the descrip parameter in a profile action to control/abm_det.php3 in the e-Commerce section, (6) the tit parameter in a delivery_courier action to control/abm_list.php3 in the e-Commerce section, or (7) the tit parameter in an usuario action to control/abm_det.php3 in the e-Commerce section.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.bonsai-sec.com/en/research/vulnerabilities/tornadostore-multiple-xss-0107.php; http://www.securityfocus.com/bid/41233; https://exchange.xforce.ibmcloud.com/vulnerabilities/59951
CVE: CVE-2010-1575
Published: 2010-07-06
Description: The Cisco Content Services Switch (CSS) 11500 with software 08.20.1.01 conveys authentication data through ClientCert-* headers but does not delete client-supplied ClientCert-* headers, which might allow remote attackers to bypass authentication via crafted header data, as demonstrated by a ClientCert-Subject-CN header, aka Bug ID CSCsz04690.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/66091; http://securitytracker.com/id?1024167; http://www.securityfocus.com/archive/1/512144/100/0/threaded
CVE: CVE-2010-1576
Published: 2010-07-06
Description: The Cisco Content Services Switch (CSS) 11500 with software before 8.20.4.02 and the Application Control Engine (ACE) 4710 with software before A2(3.0) do not properly handle use of LF, CR, and LFCR as alternatives to the standard CRLF sequence between HTTP headers, which allows remote attackers to bypass intended header insertions or conduct HTTP request smuggling attacks via crafted header data, as demonstrated by LF characters preceding ClientCert-Subject and ClientCert-Subject-CN headers, aka Bug ID CSCta04885.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/66092; http://securitytracker.com/id?1024167; http://securitytracker.com/id?1024168
CVE: CVE-2010-2251
Published: 2010-07-06
Description: The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lftp.yar.ru/news.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043597.html; http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
CVE: CVE-2010-2252
Published: 2010-07-06
Description: GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.gnu.org/archive/html/bug-wget/2010-05/msg00023.html; http://lists.gnu.org/archive/html/bug-wget/2010-05/msg00031.html; http://lists.gnu.org/archive/html/bug-wget/2010-05/msg00032.html
CVE: CVE-2010-2253
Published: 2010-07-06
Description: lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://cpansearch.perl.org/src/GAAS/libwww-perl-5.836/Changes; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050232.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050245.html
CVE: CVE-2010-2481
Published: 2010-07-06
Description: The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly handle unknown tag types in TIFF directory entries, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bugzilla.maptools.org/show_bug.cgi?id=2210; http://marc.info/?l=oss-security&m=[PII_REDACTED]2908&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]2102&w=2
CVE: CVE-2010-2482
Published: 2010-07-06
Description: LibTIFF 3.9.4 and earlier does not properly handle an invalid td_stripbytecount field, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted TIFF file, a different vulnerability than CVE-2010-2443.
CVSS Score: 4.3 (MEDIUM)
References: http://bugzilla.maptools.org/show_bug.cgi?id=1996; http://marc.info/?l=oss-security&m=[PII_REDACTED]2102&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]2757&w=2
CVE: CVE-2010-2483
Published: 2010-07-06
Description: The TIFFRGBAImageGet function in LibTIFF 3.9.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a TIFF file with an invalid combination of SamplesPerPixel and Photometric values.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bugzilla.maptools.org/show_bug.cgi?id=2216; http://marc.info/?l=oss-security&m=[PII_REDACTED]2908&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]2102&w=2
CVE: CVE-2010-2629
Published: 2010-07-06
Description: The Cisco Content Services Switch (CSS) 11500 with software 8.20.4.02 and the Application Control Engine (ACE) 4710 with software A2(3.0) do not properly handle LF header terminators in situations where the GET line is terminated by CRLF, which allows remote attackers to conduct HTTP request smuggling attacks and possibly bypass intended header insertions via crafted header data, as demonstrated by an LF character between the ClientCert-Subject and ClientCert-Subject-CN headers. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1576.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://securitytracker.com/id?1024167; http://securitytracker.com/id?1024168; http://www.securityfocus.com/archive/1/512144/100/0/threaded
CVE: CVE-2010-1667
Published: 2010-07-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40431; http://wiki.mahara.org/Release_Notes/1.0.15; http://wiki.mahara.org/Release_Notes/1.1.9
CVE: CVE-2010-1668
Published: 2010-07-06
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/40431; http://wiki.mahara.org/Release_Notes/1.0.15; http://wiki.mahara.org/Release_Notes/1.1.9
CVE: CVE-2010-1669
Published: 2010-07-06
Description: SQL injection vulnerability in Mahara 1.1.x before 1.1.9 and 1.2.x before 1.2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/40431; http://wiki.mahara.org/Release_Notes/1.1.9; http://wiki.mahara.org/Release_Notes/1.2.5
CVE: CVE-2010-1670
Published: 2010-07-06
Description: Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 has improper configuration options for authentication plugins associated with logins that use the single sign-on (SSO) functionality, which allows remote attackers to bypass authentication via an empty password.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/40431; http://wiki.mahara.org/Release_Notes/1.0.15; http://wiki.mahara.org/Release_Notes/1.1.9
CVE: CVE-2010-2479
Published: 2010-07-06
Description: Cross-site scripting (XSS) vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://htmlpurifier.org/news/2010/0531-4.1.1-released; http://repo.or.cz/w/htmlpurifier.git/commitdiff/18e538317a877a0509ae71a860429c41770da230; http://secunia.com/advisories/39613
CVE: CVE-2010-2645
Published: 2010-07-06
Description: Unspecified vulnerability in Google Chrome before 5.0.375.99, when WebGL is used, allows remote attackers to cause a denial of service (out-of-bounds read) via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=42396; http://googlechromereleases.blogspot.com/2010/07/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12090