deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-3433
Published: 2010-10-06
Description: The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 before 9.0.1 do not properly protect script execution by a different SQL user identity within the same session, which allows remote authenticated users to gain privileges via crafted script code in a SECURITY DEFINER function, as demonstrated by (1) redefining standard functions or (2) redefining operators, a different vulnerability than CVE-2010-1168, CVE-2010-1169, CVE-2010-1170, and CVE-2010-1447.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049591.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049592.html
CVE: CVE-2010-3619
Published: 2010-10-06
Description: Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2890, CVE-2010-3621, CVE-2010-3622, CVE-2010-3628, CVE-2010-3632, and CVE-2010-3658.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3620
Published: 2010-10-06
Description: Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows attackers to execute arbitrary code via a crafted image, a different vulnerability than CVE-2010-3629.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3621
Published: 2010-10-06
Description: Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2890, CVE-2010-3619, CVE-2010-3622, CVE-2010-3628, CVE-2010-3632, and CVE-2010-3658.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3622
Published: 2010-10-06
Description: Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2890, CVE-2010-3619, CVE-2010-3621, CVE-2010-3628, CVE-2010-3632, and CVE-2010-3658.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3623
Published: 2010-10-06
Description: Adobe Reader and Acrobat 8.x before 8.2.5 and 9.x before 9.4 on Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://www.adobe.com/support/security/bulletins/apsb10-21.html
CVE: CVE-2010-3624
Published: 2010-10-06
Description: Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.5 and 9.x before 9.4 on Mac OS X allows attackers to execute arbitrary code via a crafted image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://www.adobe.com/support/security/bulletins/apsb10-21.html
CVE: CVE-2010-3625
Published: 2010-10-06
Description: Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allow attackers to execute arbitrary code via unspecified vectors, related to a "prefix protocol handler vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3626
Published: 2010-10-06
Description: Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows attackers to execute arbitrary code via a crafted font, a different vulnerability than CVE-2010-2889.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3627
Published: 2010-10-06
Description: Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows attackers to execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3628
Published: 2010-10-06
Description: Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2890, CVE-2010-3619, CVE-2010-3621, CVE-2010-3622, CVE-2010-3632, and CVE-2010-3658.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3629
Published: 2010-10-06
Description: Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows attackers to execute arbitrary code via a crafted image, a different vulnerability than CVE-2010-3620.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3630
Published: 2010-10-06
Description: Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3631
Published: 2010-10-06
Description: Array index error in Adobe Reader and Acrobat 8.x before 8.2.5 and 9.x before 9.4 on Mac OS X allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://www.adobe.com/support/security/bulletins/apsb10-21.html
CVE: CVE-2010-3632
Published: 2010-10-06
Description: Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2890, CVE-2010-3619, CVE-2010-3621, CVE-2010-3622, CVE-2010-3628, and CVE-2010-3658.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3656
Published: 2010-10-06
Description: Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows attackers to cause a denial of service via unknown vectors, a different vulnerability than CVE-2010-3657.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3657
Published: 2010-10-06
Description: Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows attackers to cause a denial of service via unknown vectors, a different vulnerability than CVE-2010-3656.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3658
Published: 2010-10-06
Description: Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2890, CVE-2010-3619, CVE-2010-3621, CVE-2010-3622, CVE-2010-3628, and CVE-2010-3632.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://secunia.com/advisories/43025
CVE: CVE-2010-3706
Published: 2010-10-06
Description: plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]2377&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]5688&w=2
CVE: CVE-2010-3707
Published: 2010-10-06
Description: plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]2377&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]5688&w=2
CVE: CVE-2010-3779
Published: 2010-10-06
Description: Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated users to bypass intended access restrictions by changing the ACL of a mailbox, as demonstrated by a symlinked shared mailbox.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/43220; http://www.dovecot.org/list/dovecot/2010-October/053450.html; http://www.dovecot.org/list/dovecot/2010-October/053452.html
CVE: CVE-2010-3780
Published: 2010-10-06
Description: Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process outage) by simultaneously disconnecting many (1) IMAP or (2) POP3 sessions.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/43220; http://www.dovecot.org/list/dovecot/2010-October/053450.html; http://www.mandriva.com/security/advisories?name=MDVSA-2010:217
CVE: CVE-2010-3781
Published: 2010-10-06
Description: The PL/php add-on 1.4 and earlier for PostgreSQL does not properly protect script execution by a different SQL user identity within the same session, which allows remote authenticated users to gain privileges via crafted script code in a SECURITY DEFINER function, a related issue to CVE-2010-3433.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://www.postgresql.org/about/news.1244; http://www.postgresql.org/docs/9.0/static/release-9-0-1.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6645
CVE: CVE-2010-1322
Published: 2010-10-07
Description: The merge_authdata function in kdc_authdata.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x before 1.8.4 does not properly manage an index into an authorization-data list, which allows remote attackers to cause a denial of service (daemon crash), or possibly obtain sensitive information, spoof authorization, or execute arbitrary code, via a TGS request that triggers an uninitialized pointer dereference, as demonstrated by a request from a Windows Active Directory client.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-006.txt; http://www.mandriva.com/security/advisories?name=MDVSA-2010:202
CVE: CVE-2010-3321
Published: 2010-10-07
Description: RSA Authentication Client 2.0.x, 3.0, and 3.5.x before 3.5.3 does not properly handle a SENSITIVE or NON-EXTRACTABLE tag on a secret key object that is stored on a SecurID 800 authenticator, which allows local users to bypass intended access restrictions and read keys via unspecified PKCS#11 API requests.
CVSS Score: 1.5 (LOW)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/514153/100/0/threaded; http://www.securityfocus.com/bid/43795; http://www.securityfocus.com/archive/1/514153/100/0/threaded
CVE: CVE-2010-3690
Published: 2010-10-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Proxy Granting Ticket IOU (PGTiou) parameter to the callback function in client.php, (2) vectors involving functions that make getCallbackURL calls, or (3) vectors involving functions that make getURL calls.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.html
CVE: CVE-2010-3691
Published: 2010-10-07
Description: PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.html
CVE: CVE-2010-3692
Published: 2010-10-07
Description: Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite arbitrary files via directory traversal sequences in a Proxy Granting Ticket IOU (PGTiou) parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.html
CVE: CVE-2010-3696
Published: 2010-10-07
Description: The fr_dhcp_decode function in lib/dhcp.c in FreeRADIUS 2.1.9, in certain non-default builds, does not properly handle the DHCP Relay Agent Information option, which allows remote attackers to cause a denial of service (infinite loop and daemon outage) via a packet that has more than one sub-option.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://freeradius.org/press/index.html#2.1.10; http://github.com/alandekok/freeradius-server/commit/4dc7800b866f889a1247685bbaa6dd4238a56279; http://secunia.com/advisories/41621
CVE: CVE-2010-3697
Published: 2010-10-07
Description: The wait_for_child_to_die function in main/event.c in FreeRADIUS 2.1.x before 2.1.10, in certain circumstances involving long-term database outages, does not properly handle long queue times for requests, which allows remote attackers to cause a denial of service (daemon crash) by sending many requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://freeradius.org/press/index.html#2.1.10; http://github.com/alandekok/freeradius-server/commit/ff94dd35673bba[PII_REDACTED]d31ce8293b8bd223; http://secunia.com/advisories/41621
CVE: CVE-2010-2797
Published: 2010-10-08
Description: Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://cross-site-scripting.blogspot.com/2010/07/cms-made-simple-18-local-file-inclusion.html; http://secunia.com/advisories/40031; http://www.cmsmadesimple.org/2010/07/3/announcing-cms-made-simple-1-8-1-mankara/
CVE: CVE-2010-2938
Published: 2010-10-08
Description: arch/x86/hvm/vmx/vmcs.c in the virtual-machine control structure (VMCS) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when an Intel platform without Extended Page Tables (EPT) functionality is used, accesses VMCS fields without verifying hardware support for these fields, which allows local users to cause a denial of service (host OS crash) by requesting a VMCS dump for a fully virtualized Xen guest.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/46397; http://support.avaya.com/css/P8/documents/100113326; http://www.redhat.com/support/errata/RHSA-2010-0723.html
CVE: CVE-2010-3088
Published: 2010-10-08
Description: The notify function in pidgin-knotify.c in the pidgin-knotify plugin 0.2.1 and earlier for Pidgin allows remote attackers to execute arbitrary commands via shell metacharacters in a message.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://code.google.com/p/pidgin-knotify/issues/detail?id=1; http://www.openwall.com/lists/oss-security/2010/09/12/1; http://www.openwall.com/lists/oss-security/2010/09/13/4
CVE: CVE-2010-3743
Published: 2010-10-08
Description: Directory traversal vulnerability in Visual Synapse HTTP Server 1.0 RC1 through RC3, and 0.60 and earlier, allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/15216; http://www.securityfocus.com/archive/1/514167/100/0/threaded; http://www.securityfocus.com/bid/43830
CVE: CVE-2010-3882
Published: 2010-10-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add Pages, (2) Add Global Content, (3) Edit Global Content, (4) Add Article, (5) Add Category, (6) Add Field Definition, or (7) Add Shortcut module.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40031; http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/; http://secunia.com/advisories/40031
CVE: CVE-2010-3883
Published: 2010-10-08
Description: Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/40031; http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/; http://secunia.com/advisories/40031
CVE: CVE-2010-3884
Published: 2010-10-08
Description: Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/40031; http://secunia.com/advisories/40031
CVE: CVE-2010-3885
Published: 2010-10-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-3227.  Reason: This candidate is a duplicate of CVE-2010-3227.  Notes: All CVE users should reference CVE-2010-3227 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-3886
Published: 2010-10-08
Description: The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain pointer value as part of producing Timer ID values for the setTimeout and setInterval methods in VBScript and JScript, which allows remote attackers to obtain sensitive information about the heap memory addresses used by an application, as demonstrated by the Internet Explorer 8 application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2010-06/0259.html; http://twitter.com/WisecWisec/statuses/[PII_REDACTED]; http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker/2010/20100630
CVE: CVE-2010-3887
Published: 2010-10-08
Description: The Limit Mail feature in the Parental Controls functionality in Mail on Apple Mac OS X does not properly enforce the correspondence whitelist, which allows remote attackers to bypass intended access restrictions and conduct e-mail communication by leveraging knowledge of a child's e-mail address and a parent's e-mail address, related to parental notification of unapproved e-mail addresses.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://blog.kamens.us/2010/08/03/mac-os-x-mail-parental-controls-vulnerability/; http://blog.kamens.us/2010/08/03/mac-os-x-mail-parental-controls-vulnerability/
CVE: CVE-2010-3888
Published: 2010-10-08
Description: Unspecified vulnerability in Microsoft Windows on 32-bit platforms allows local users to gain privileges via unknown vectors, as exploited in the wild in July 2010 by the Stuxnet worm, and identified by Kaspersky Lab researchers and other researchers.
CVSS Score: 7.2 (HIGH)
References: http://www.computerworld.com/s/article/9185919/Is_Stuxnet_the_best_malware_ever_; http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker/2010/20100716; http://www.securelist.com/en/blog/2291/Myrtus_and_Guava_Episode_MS10_061
CVE: CVE-2010-3889
Published: 2010-10-08
Description: Unspecified vulnerability in Microsoft Windows on 32-bit platforms allows local users to gain privileges via unknown vectors, as exploited in the wild in July 2010 by the Stuxnet worm, and identified by Microsoft researchers and other researchers.
CVSS Score: 7.2 (HIGH)
References: http://www.computerworld.com/s/article/9185919/Is_Stuxnet_the_best_malware_ever_; http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker/2010/20100716-%281%29; http://www.securelist.com/en/blog/2291/Myrtus_and_Guava_Episode_MS10_061