deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-2465
Published: 2011-07-08
Description: Unspecified vulnerability in ISC BIND 9 9.8.0, 9.8.0-P1, 9.8.0-P2, and 9.8.1b1, when recursion is enabled and the Response Policy Zone (RPZ) contains DNAME or certain CNAME records, allows remote attackers to cause a denial of service (named daemon crash) via an unspecified query.
CVSS Score: 2.6 (LOW)
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062522.html; http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00002.html; http://osvdb.org/73604
CVE: CVE-2011-2664
Published: 2011-07-08
Description: Unspecified vulnerability in Check Point Multi-Domain Management / Provider-1 NGX R65, R70, R71, and R75, and SmartCenter during installation on non-Windows machines, allows local users on the MDS system to overwrite arbitrary files via unknown vectors.
CVSS Score: 3.6 (LOW)
References: http://secunia.com/advisories/45231; http://www.securityfocus.com/bid/48656; https://exchange.xforce.ibmcloud.com/vulnerabilities/68502
CVE: CVE-2010-4808
Published: 2011-07-08
Description: SQL injection vulnerability in index.php in Webmatic allows remote attackers to execute arbitrary SQL commands via the p parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/95827/webmatic-sql.txt; http://www.exploit-db.com/exploits/15517; http://www.securityfocus.com/bid/44863
CVE: CVE-2010-4809
Published: 2011-07-08
Description: SQL injection vulnerability in index.php in DBSite 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/95823/dbsite-sql.txt; http://www.exploit-db.com/exploits/15512; http://www.securityfocus.com/bid/44870
CVE: CVE-2010-4810
Published: 2011-07-08
Description: Multiple PHP remote file inclusion vulnerabilities in AR Web Content Manager (AWCM) 2.1 final allow remote attackers to execute arbitrary PHP code via a URL in the theme_file parameter to (1) includes/window_top.php and (2) header.php, and the (3) lang_file parameter to control/common.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/15510; http://www.securityfocus.com/bid/44868; https://exchange.xforce.ibmcloud.com/vulnerabilities/63236
CVE: CVE-2010-4811
Published: 2011-07-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in ajaxmember.php in 6kbbs 8.0 build 20100901 allow remote attackers to inject arbitrary web script or HTML via the (1) user[msn], (2) user[email], and (3) user[phone] parameters in a modifyDetails action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bbs.wolvez.org/viewtopic.php?id=180; http://secunia.com/advisories/42204; https://exchange.xforce.ibmcloud.com/vulnerabilities/63284
CVE: CVE-2010-4812
Published: 2011-07-08
Description: Multiple SQL injection vulnerabilities in 6kbbs 8.0 build 20100901 allow remote attackers to execute arbitrary SQL commands via the (1) tids[] parameter to ajaxadmin.php and the (2) msgids[] parameter to ajaxmember.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://bbs.wolvez.org/viewtopic.php?id=180; http://secunia.com/advisories/42204; http://www.6kbbs.net/view-487.html
CVE: CVE-2010-4813
Published: 2011-07-08
Description: Cross-site scripting (XSS) vulnerability in the Category Tokens module 6.x before 6.x-1.1 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML by editing or creating vocabulary names, which are not properly handled in token help.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/968176; http://osvdb.org/69145; http://secunia.com/advisories/42168
CVE: CVE-2010-4814
Published: 2011-07-08
Description: SQL injection vulnerability in index1.php in Best Soft Inc. (BSI) Advance Hotel Booking System 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/95829/phpbsiahbs-sql.txt; http://www.exploit-db.com/exploits/15531; http://www.securityfocus.com/bid/44854
CVE: CVE-2011-0549
Published: 2011-07-11
Description: SQL injection vulnerability in forget.php in the management GUI in Symantec Web Gateway 4.5.x allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/45146; http://securitytracker.com/id?1025753; http://www.securityfocus.com/bid/48318
CVE: CVE-2011-1338
Published: 2011-07-11
Description: Untrusted search path vulnerability in XnView before 1.98.1 allows local users to gain privileges via a Trojan horse .exe file in a folder selected by the "Open containing folder" menu item.
CVSS Score: 6.9 (MEDIUM)
References: http://jvn.jp/en/jp/JVN17844633/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000050; http://secunia.com/advisories/45127
CVE: CVE-2011-1526
Published: 2011-07-11
Description: ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062681.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062699.html; http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html
CVE: CVE-2011-1867
Published: 2011-07-11
Description: Stack-based buffer overflow in iNodeMngChecker.exe in the User Access Manager (UAM) 5.0 before SP1 E0101P03 and Endpoint Admission Defense (EAD) 5.0 before SP1 E0101P03 components in HP Intelligent Management Center (aka iNode Management Center) allows remote attackers to execute arbitrary code via a 0x0A0BF007 packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4404&w=2; http://secunia.com/advisories/45129; http://securityreason.com/securityalert/8302
CVE: CVE-2011-1951
Published: 2011-07-11
Description: lib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when using PCRE 8.12 and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via a message that does not match a regular expression.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://git.balabit.hu/?p=bazsi/syslog-ng-3.2.git%3Ba=commit%3Bh=09710c0b105e579d35c7b5f6c66d1ea5e3a3d3ff; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062107.html; http://secunia.com/advisories/45122
CVE: CVE-2011-2064
Published: 2011-07-11
Description: Cisco IOS 12.4MDA before 12.4(24)MDA5 on the Cisco Content Services Gateway - Second Generation (CSG2) allows remote attackers to cause a denial of service (device reload) via crafted ICMP packets, aka Bug ID CSCtl79577.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/73657; http://secunia.com/advisories/45148; http://securitytracker.com/id?1025748
CVE: CVE-2011-2398
Published: 2011-07-11
Description: Unspecified vulnerability in the dynamic loader in HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges or cause a denial of service via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8494&w=2; http://secunia.com/advisories/45132; http://securityreason.com/securityalert/8303
CVE: CVE-2011-2516
Published: 2011-07-11
Description: Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063159.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063229.html; http://santuario.apache.org/secadv/CVE-2011-2516.txt
CVE: CVE-2011-1265
Published: 2011-07-13
Description: The Bluetooth Stack 2.1 in Microsoft Windows Vista SP1 and SP2 and Windows 7 Gold and SP1 does not prevent access to objects in memory that (1) were not properly initialized or (2) have been deleted, which allows remote attackers to execute arbitrary code via crafted Bluetooth packets, aka "Bluetooth Stack Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA11-193A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-053; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12094
CVE: CVE-2011-1281
Published: 2011-07-13
Description: The Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly restrict the number of console objects for a process, which allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that triggers an incorrect memory assignment for a user transaction, aka "CSRSS Local EOP AllocConsole Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/cas/techalerts/TA11-193A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-056; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12602
CVE: CVE-2011-1282
Published: 2011-07-13
Description: The Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly initialize memory and consequently uses a NULL pointer in an unspecified function call, which allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that triggers an incorrect memory assignment for a user transaction, aka "CSRSS Local EOP SrvSetConsoleLocalEUDC Vulnerability."
CVSS Score: 8.4 (HIGH)
CWE: CWE-119, CWE-476
References: http://www.us-cert.gov/cas/techalerts/TA11-193A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-056; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12402
CVE: CVE-2011-1283
Published: 2011-07-13
Description: The Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, and Windows Server 2008 Gold and SP2 does not ensure that an unspecified array index has a non-negative value before performing read and write operations, which allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that triggers an incorrect memory assignment for a user transaction, aka "CSRSS Local EOP SrvSetConsoleNumberOfCommand Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/cas/techalerts/TA11-193A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-056; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12362
CVE: CVE-2011-1284
Published: 2011-07-13
Description: Integer overflow in the Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that triggers an incorrect memory assignment for a user transaction, aka "CSRSS Local EOP SrvWriteConsoleOutput Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/cas/techalerts/TA11-193A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-056; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12734
CVE: CVE-2011-1870
Published: 2011-07-13
Description: Integer overflow in the Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, and Windows Server 2003 SP2, allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that triggers an incorrect memory assignment for a user transaction, aka "CSRSS Local EOP SrvWriteConsoleOutputString Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://osvdb.org/73795; http://www.securityfocus.com/bid/48605; http://www.us-cert.gov/cas/techalerts/TA11-193A.html
CVE: CVE-2011-1874
Published: 2011-07-13
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Use After Free Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-399, CWE-416
References: http://osvdb.org/73777; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1875
Published: 2011-07-13
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Use After Free Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://osvdb.org/73785; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1876
Published: 2011-07-13
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Use After Free Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://osvdb.org/73778; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1877
Published: 2011-07-13
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, aka "Win32k Use After Free Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://osvdb.org/73779; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1878
Published: 2011-07-13
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Use After Free Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://osvdb.org/73780; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1879
Published: 2011-07-13
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Use After Free Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://osvdb.org/73781; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1880
Published: 2011-07-13
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Null Pointer De-reference Vulnerability."
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/73786; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1881
Published: 2011-07-13
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Null Pointer De-reference Vulnerability."
CVSS Score: 8.4 (HIGH)
CWE: CWE-476
References: http://osvdb.org/73787; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1882
Published: 2011-07-13
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Use After Free Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://osvdb.org/73782; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1883
Published: 2011-07-13
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Use After Free Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://osvdb.org/73783; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1884
Published: 2011-07-13
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Use After Free Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://osvdb.org/73784; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1885
Published: 2011-07-13
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Null Pointer De-reference Vulnerability."
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/73788; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1886
Published: 2011-07-13
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3 does not properly validate the arguments to functions, which allows local users to read arbitrary data from kernel memory via a crafted application that triggers a NULL pointer dereference, aka "Win32k Incorrect Parameter Validation Allows Information Disclosure Vulnerability."
CVSS Score: 2.1 (LOW)
References: http://osvdb.org/73791; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1887
Published: 2011-07-13
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Null Pointer De-reference Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://osvdb.org/73789; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2011-1888
Published: 2011-07-13
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Null Pointer De-reference Vulnerability."
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/73790; http://secunia.com/advisories/45186; http://support.avaya.com/css/P8/documents/100144947
CVE: CVE-2010-4554
Published: 2011-07-14
Description: functions/page_header.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html; http://rhn.redhat.com/errata/RHSA-2012-0103.html; http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/page_header.php?view=patch&r1=14117&r2=14116&pathrev=14117
CVE: CVE-2010-4555
Published: 2011-07-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) drop-down selection lists, (2) the > (greater than) character in the SquirrelSpell spellchecking plugin, and (3) errors associated with the Index Order (aka options_order) page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html; http://rhn.redhat.com/errata/RHSA-2012-0103.html; http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119
CVE: CVE-2011-0287
Published: 2011-07-14
Description: Unspecified vulnerability in the BlackBerry Administration API in Research In Motion (RIM) BlackBerry Enterprise Server (BES) software 5.0.1 through 5.0.3, and BlackBerry Enterprise Server Express software 5.0.1 through 5.0.3, allows remote attackers to read text files or cause a denial of service via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/45242; http://www.blackberry.com/btsc/KB27258; http://www.securityfocus.com/bid/48655