deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-2803
Published: 2010-09-08
Description: The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/airlied/drm-2.6.git%3Ba=commit%3Bh=1b2f[PII_REDACTED]d4a06028315dc19d65768a1c05; http://git.kernel.org/?p=linux/kernel/git/airlied/drm-2.6.git%3Ba=commit%3Bh=b9f0aee83335db1f3915f4e42a5e21b351740afd; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9f0aee83335db1f3915f4e42a5e21b351740afd
CVE: CVE-2010-2955
Published: 2010-09-08
Description: The cfg80211_wext_giwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctl_standard_iw_point function in net/wireless/wext-core.c, and obtain potentially sensitive information from kernel heap memory, via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size.
CVSS Score: 2.1 (LOW)
CWE: CWE-193
References: http://forums.grsecurity.net/viewtopic.php?f=3&t=2290; http://git.kernel.org/?p=linux/kernel/git/linville/wireless-2.6.git%3Ba=commit%3Bh=42da2f948d949efd0111309f5827bf0298bcc9a4; http://grsecurity.net/~spender/wireless-infoleak-fix2.patch
CVE: CVE-2010-2958
Published: 2010-09-08
Description: Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to a PHP backtrace and error messages (aka debugging messages), a different vulnerability than CVE-2010-3056.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=133a77fac7d31a38703db2099a90c1b49de62e37; http://secunia.com/advisories/41206; http://www.openwall.com/lists/oss-security/2010/09/01/2
CVE: CVE-2010-2959
Published: 2010-09-08
Description: Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic.
CVSS Score: 7.2 (HIGH)
CWE: CWE-190
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5b75c4973ce779520b9d1e392483207d6f842cde; http://jon.oberheide.org/files/i-can-haz-modharden.c; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/046947.html
CVE: CVE-2010-2960
Published: 2010-09-08
Description: The keyctl_session_to_parent function in security/keys/keyctl.c in the Linux kernel 2.6.35.4 and earlier expects that a certain parent session keyring exists, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a KEYCTL_SESSION_TO_PARENT argument to the keyctl function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html; http://secunia.com/advisories/41263
CVE: CVE-2010-3004
Published: 2010-09-08
Description: Unspecified vulnerability in HP Operations Agent 7.36 and 8.6 on Windows allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02497800; http://secunia.com/advisories/41277; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02497800
CVE: CVE-2010-3005
Published: 2010-09-08
Description: Unspecified vulnerability in HP Operations Agent 7.36 and 8.6 on Windows allows local users to gain privileges via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02497800; http://secunia.com/advisories/41277; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02497800
CVE: CVE-2010-3198
Published: 2010-09-08
Description: ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service (crash of worker threads) via vectors that trigger uncaught exceptions.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/42939; http://www.vupen.com/english/advisories/2010/2275; http://www.zope.org/Products/Zope/2.10.12/CHANGES.txt
CVE: CVE-2010-3264
Published: 2010-09-08
Description: The engine installer in Novell Identity Manager (aka IDM) 3.6.1 stores admin tree credentials in /tmp/idmInstall.log, which allows local users to obtain sensitive information by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://secunia.com/advisories/41194; http://www.novell.com/support/viewContent.do?externalId=7006705; http://www.vupen.com/english/advisories/2010/2226
CVE: CVE-2010-2760
Published: 2010-09-09
Description: Use-after-free vulnerability in the nsTreeSelection function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 might allow remote attackers to execute arbitrary code via vectors involving a XUL tree selection, related to a "dangling pointer vulnerability." NOTE: this issue exists because of an incomplete fix for CVE-2010-2753.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
CVE: CVE-2010-2762
Published: 2010-09-09
Description: The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird 3.1.x before 3.1.3 does not properly restrict objects at the end of scope chains, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to a chrome privileged object and a chain ending in an outer object.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html; http://secunia.com/advisories/42867
CVE: CVE-2010-2763
Published: 2010-09-09
Description: The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox before 3.5.12, Thunderbird before 3.0.7, and SeaMonkey before 2.0.7 does not properly restrict scripted functions, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html; http://www.debian.org/security/2010/dsa-2106
CVE: CVE-2010-2764
Published: 2010-09-09
Description: Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict read access to the statusText property of XMLHttpRequest objects, which allows remote attackers to discover the existence of intranet web servers via cross-origin requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
CVE: CVE-2010-2765
Published: 2010-09-09
Description: Integer overflow in the FRAMESET element implementation in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 might allow remote attackers to execute arbitrary code via a large number of values in the cols (aka columns) attribute, leading to a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
CVE: CVE-2010-2766
Published: 2010-09-09
Description: The normalizeDocument function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 does not properly handle the removal of DOM nodes during normalization, which might allow remote attackers to execute arbitrary code via vectors involving access to a deleted object.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
CVE: CVE-2010-2767
Published: 2010-09-09
Description: The navigator.plugins implementation in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 does not properly handle destruction of the DOM plugin array, which might allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via crafted access to the navigator object, related to a "dangling pointer vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
CVE: CVE-2010-2768
Published: 2010-09-09
Description: Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms via UTF-7 encoding.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
CVE: CVE-2010-2769
Published: 2010-09-09
Description: Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 allows user-assisted remote attackers to inject arbitrary web script or HTML via a selection that is added to a document in which the designMode property is enabled.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
CVE: CVE-2010-2770
Published: 2010-09-09
Description: Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Mac OS X allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted font in a data: URL.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html; http://www.mozilla.org/security/announce/2010/mfsa2010-58.html; http://www.vupen.com/english/advisories/2010/2323
CVE: CVE-2010-3166
Published: 2010-09-09
Description: Heap-based buffer overflow in the nsTextFrameUtils::TransformText function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 might allow remote attackers to execute arbitrary code via a bidirectional text run.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
CVE: CVE-2010-3167
Published: 2010-09-09
Description: The nsTreeContentView function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 does not properly handle node removal in XUL trees, which allows remote attackers to execute arbitrary code via vectors involving access to deleted memory, related to a "dangling pointer vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119, CWE-399
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
CVE: CVE-2010-3168
Published: 2010-09-09
Description: Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict the role of property changes in triggering XUL tree removal, which allows remote attackers to cause a denial of service (deleted memory access and application crash) or possibly execute arbitrary code by setting unspecified properties.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
CVE: CVE-2010-3169
Published: 2010-09-09
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
CVE: CVE-2010-1781
Published: 2010-09-09
Description: Double free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the rendering of an inline element.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html
CVE: CVE-2010-1809
Published: 2010-09-09
Description: The Accessibility component in Apple iOS before 4.1 on the iPhone and iPod touch does not perform the expected VoiceOver announcement associated with the location services icon, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html; http://support.apple.com/kb/HT4334; https://exchange.xforce.ibmcloud.com/vulnerabilities/61694
CVE: CVE-2010-1810
Published: 2010-09-09
Description: FaceTime in Apple iOS before 4.1 on the iPhone and iPod touch does not properly handle invalid X.509 certificates, which allows man-in-the-middle attackers to redirect calls via a crafted certificate.
CVSS Score: 3.5 (LOW)
References: http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html; http://support.apple.com/kb/HT4334; https://exchange.xforce.ibmcloud.com/vulnerabilities/61695
CVE: CVE-2010-1811
Published: 2010-09-09
Description: ImageIO in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted TIFF file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html
CVE: CVE-2010-1812
Published: 2010-09-09
Description: Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving selections.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html
CVE: CVE-2010-1813
Published: 2010-09-09
Description: WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors involving HTML object outlines.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html
CVE: CVE-2010-1814
Published: 2010-09-09
Description: WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors involving form menus.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html
CVE: CVE-2010-1815
Published: 2010-09-09
Description: Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving scrollbars.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html
CVE: CVE-2010-1817
Published: 2010-09-09
Description: Buffer overflow in ImageIO in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted GIF file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html; http://support.apple.com/kb/HT4334; https://exchange.xforce.ibmcloud.com/vulnerabilities/61697
CVE: CVE-2010-2883
Published: 2010-09-09
Description: Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787, CWE-787
References: http://blog.metasploit.com/2010/09/return-of-unpublished-adobe.html; http://community.websense.com/blogs/securitylabs/archive/2010/09/10/brief-analysis-on-adobe-reader-sing-table-parsing-vulnerability-cve-2010-2883.aspx; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html
CVE: CVE-2010-3007
Published: 2010-09-09
Description: Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x before build 56936 and 4.x before build 56906 allows local users to gain privileges or cause a denial of service via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02498535; http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02498535
CVE: CVE-2010-3017
Published: 2010-09-09
Description: Unspecified vulnerability in RSA Access Manager Agent 4.7.1 before 4.7.1.7, when RSA Adaptive Authentication Integration is enabled, allows remote attackers to bypass authentication and obtain sensitive information via unknown vectors.
CVSS Score: 5.7 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2010-09/0057.html; http://archives.neohapsis.com/archives/bugtraq/2010-09/0057.html
CVE: CVE-2010-3018
Published: 2010-09-09
Description: RSA Access Manager Server 5.5.3 before 5.5.3.172, 6.0.4 before 6.0.4.53, and 6.1 before 6.1.2.01 does not properly perform cache updates, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2010-09/0056.html; http://archives.neohapsis.com/archives/bugtraq/2010-09/0056.html
CVE: CVE-2010-0574
Published: 2010-09-10
Description: Unspecified vulnerability in Cisco Wireless LAN Controller (WLC) software 3.2 before 3.2.215.0; 4.1 and 4.2 before 4.2.205.0; 4.1M and 4.2M before 4.2.207.54M; 5.0, 5.1, and 6.0 before 6.0.188.0; and 5.2 before 5.2.193.11 allows remote attackers to cause a denial of service (device reload) via a crafted IKE packet, aka Bug ID CSCta56653.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=21287; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b466e9.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=21287
CVE: CVE-2010-0575
Published: 2010-09-10
Description: Cisco Wireless LAN Controller (WLC) software, possibly 6.0.x or possibly 4.1 through 6.0.x, allows remote attackers to bypass ACLs in the controller CPU, and consequently send network traffic to unintended segments or devices, via unspecified vectors, a different vulnerability than CVE-2010-3034.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=21291; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b466e9.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=21291
CVE: CVE-2010-2841
Published: 2010-09-10
Description: Unspecified vulnerability in Cisco Wireless LAN Controller (WLC) software 4.2 before 4.2.209.0; 4.2M before 4.2.207.54M; 5.0, 5.1, and 6.0 before 6.0.196.0; and 5.2 before 5.2.193.11 allows remote authenticated users to cause a denial of service (device reload) via crafted HTTP packets that trigger invalid arguments to the emweb component, aka Bug ID CSCtd16938.
CVSS Score: 6.8 (MEDIUM)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=21288; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b466e9.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=21288