deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1256
Published: 2010-06-08
Description: Unspecified vulnerability in Microsoft IIS 6.0, 7.0, and 7.5, when Extended Protection for Authentication is enabled, allows remote authenticated users to execute arbitrary code via unknown vectors related to "token checking" that trigger memory corruption, aka "IIS Authentication Memory Corruption Vulnerability."
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/40573; http://www.us-cert.gov/cas/techalerts/TA10-159B.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-040
CVE: CVE-2010-1257
Published: 2010-06-08
Description: Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://support.avaya.com/css/P8/documents/100089747; http://www.securityfocus.com/bid/40409; http://www.us-cert.gov/cas/techalerts/TA10-159B.html
CVE: CVE-2010-1263
Published: 2010-06-08
Description: Windows Shell and WordPad in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7; Microsoft Office XP SP3; Office 2003 SP3; and Office System 2007 SP1 and SP2 do not properly validate COM objects during instantiation, which allows remote attackers to execute arbitrary code via a crafted file, aka "COM Validation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/40574; http://www.securitytracker.com/id?1024555; http://www.us-cert.gov/cas/techalerts/TA10-159B.html
CVE: CVE-2010-1264
Published: 2010-06-08
Description: Unspecified vulnerability in Microsoft Windows SharePoint Services 3.0 SP1 and SP2 allows remote attackers to cause a denial of service (hang) via crafted requests to the Help page that cause repeated restarts of the application pool, aka "Sharepoint Help Page Denial of Service Vulnerability."
CVSS Score: 4.0 (MEDIUM)
References: http://www.securityfocus.com/bid/40559; http://www.us-cert.gov/cas/techalerts/TA10-159B.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039
CVE: CVE-2010-0484
Published: 2010-06-08
Description: The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 "do not properly validate changes in certain kernel objects," which allows local users to execute arbitrary code via vectors related to Device Contexts (DC) and the GetDCEx function, aka "Win32k Improper Data Validation Vulnerability."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.opera.com/support/kb/view/954/; http://www.securityfocus.com/archive/1/511769/100/0/threaded; http://www.us-cert.gov/cas/techalerts/TA10-159B.html
CVE: CVE-2010-0485
Published: 2010-06-08
Description: The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 Gold and SP2, Windows 7, and Server 2008 R2 "do not properly validate all callback parameters when creating a new window," which allows local users to execute arbitrary code, aka "Win32k Window Creation Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.opera.com/support/kb/view/954/; http://www.us-cert.gov/cas/techalerts/TA10-159B.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-032
CVE: CVE-2010-0811
Published: 2010-06-08
Description: Multiple unspecified vulnerabilities in the Microsoft Internet Explorer 8 Developer Tools ActiveX control in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allow remote attackers to execute arbitrary code via unknown vectors that "corrupt the system state," aka "Microsoft Internet Explorer 8 Developer Tools Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA10-159B.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-034; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-027
CVE: CVE-2010-1255
Published: 2010-06-08
Description: The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 Gold and SP2, Windows 7, and Server 2008 R2 allows local users to execute arbitrary code via vectors related to "glyph outline information" and TrueType fonts, aka "Win32k TrueType Font Parsing Vulnerability."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.opera.com/support/kb/view/954/; http://www.us-cert.gov/cas/techalerts/TA10-159B.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-032
CVE: CVE-2010-1259
Published: 2010-06-08
Description: Microsoft Internet Explorer 6 SP1 and SP2, 7, and 8 allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/65215; http://support.avaya.com/css/P8/documents/100089747; http://www.us-cert.gov/cas/techalerts/TA10-159B.html
CVE: CVE-2010-1260
Published: 2010-06-08
Description: The IE8 Developer Toolbar in Microsoft Internet Explorer 8 SP1, SP2, and SP3 allows user-assisted remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Element Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-94, CWE-94
References: http://osvdb.org/65213; http://support.avaya.com/css/P8/documents/100089747; http://www.us-cert.gov/cas/techalerts/TA10-159B.html
CVE: CVE-2010-1261
Published: 2010-06-08
Description: The IE8 Developer Toolbar in Microsoft Internet Explorer 8 SP1, SP2, and SP3 allows user-assisted remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/65214; http://support.avaya.com/css/P8/documents/100089747; http://www.us-cert.gov/cas/techalerts/TA10-159B.html
CVE: CVE-2010-1262
Published: 2010-06-08
Description: Microsoft Internet Explorer 6 SP1 and SP2, 7, and 8 allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, related to the CStyleSheet object and a free of the root container, aka "Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://support.avaya.com/css/P8/documents/100089747; http://www.securityfocus.com/archive/1/511727/100/0/threaded; http://www.securityfocus.com/bid/40417
CVE: CVE-2010-1879
Published: 2010-06-08
Description: Unspecified vulnerability in Quartz.dll for DirectShow; Windows Media Format Runtime 9, 9.5, and 11; Media Encoder 9; and the Asycfilt.dll COM component allows remote attackers to execute arbitrary code via a media file with crafted compression data, aka "Media Decompression Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA10-159B.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-033; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7517
CVE: CVE-2010-1880
Published: 2010-06-08
Description: Unspecified vulnerability in Quartz.dll for DirectShow on Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1, and Server 2008 allows remote attackers to execute arbitrary code via a media file with crafted compression data, aka "MJPEG Media Decompression Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/65222; http://www.us-cert.gov/cas/techalerts/TA10-159B.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-033
CVE: CVE-2010-2254
Published: 2010-06-09
Description: SQL injection vulnerability in the Shape5 Bridge of Hope template for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an article action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1001-exploits/joomlaboh-sql.txt; http://www.exploit-db.com/exploits/10964; http://www.securityfocus.com/bid/37602
CVE: CVE-2010-2255
Published: 2010-06-09
Description: SQL injection vulnerability in the BF Survey Pro (com_bfsurvey_pro) component before 1.3.1, BF Survey Pro Free (com_bfsurvey_profree) component 1.2.6, and BF Survey Basic component before 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/61456; http://packetstormsecurity.org/1001-exploits/joomlabfsurveypro-sql.txt; http://secunia.com/advisories/37868
CVE: CVE-2010-2256
Published: 2010-06-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Pay Per Minute Video Chat Script 2.0 and 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/memberviewdetails.php and the (2) model parameter to videos.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1001-exploits/ppmvcs-sqlxss.txt; http://secunia.com/advisories/38086; http://www.exploit-db.com/exploits/10983
CVE: CVE-2010-2257
Published: 2010-06-09
Description: SQL injection vulnerability in index_ie.php in Pay Per Minute Video Chat Script 2.0 and 2.1 allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1001-exploits/ppmvcs-sqlxss.txt; http://www.exploit-db.com/exploits/10983; http://packetstormsecurity.org/1001-exploits/ppmvcs-sqlxss.txt
CVE: CVE-2010-2258
Published: 2010-06-09
Description: Cross-site scripting (XSS) vulnerability in signupconfirm.php in phpBannerExchange 1.2 Arabic allows remote attackers to inject arbitrary web script or HTML via the bannerurl parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/61446; http://packetstormsecurity.org/1001-exploits/phpbannerexchange-xss.txt; http://secunia.com/advisories/38022
CVE: CVE-2010-2259
Published: 2010-06-09
Description: Directory traversal vulnerability in the BF Survey (com_bfsurvey) component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/61438; http://packetstormsecurity.org/1001-exploits/joomlabfsurvey-lfi.txt; http://secunia.com/advisories/37866
CVE: CVE-2010-2260
Published: 2010-06-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Gambit Design Bandwidth Meter, 0.72 and possibly 1.2, allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) view_by_name.php or (2) view_by_ip.php in admin/.  NOTE: some sources report that the affected product is ShaPlus Bandwidth Meter, but this is incorrect.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1001-exploits/bandwidthmeter-xss.txt; http://secunia.com/advisories/38012; http://www.exploit-db.com/exploits/10926
CVE: CVE-2010-0395
Published: 2010-06-10
Description: OpenOffice.org 2.x and 3.0 before 3.2.1 allows user-assisted remote attackers to bypass Python macro security restrictions and execute arbitrary Python code via a crafted OpenDocument Text (ODT) file that triggers code execution when the macro directory structure is previewed.
CVSS Score: 9.3 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042468.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042529.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042534.html
CVE: CVE-2010-1570
Published: 2010-06-10
Description: The computer telephony integration (CTI) server component in Cisco Unified Contact Center Express (UCCX) 7.0 before 7.0(1)SR4 and 7.0(2), 6.0 before 6.0(1)SR1, and 5.0 before 5.0(2)SR3 allows remote attackers to cause a denial of service (CTI server and Node Manager failure) via a malformed CTI message.
CVSS Score: 7.8 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2f110.shtml; http://www.securityfocus.com/bid/40684; http://www.securitytracker.com/id?1024081
CVE: CVE-2010-1571
Published: 2010-06-10
Description: Directory traversal vulnerability in the bootstrap service in Cisco Unified Contact Center Express (UCCX) 7.0 before 7.0(1)SR4 and 7.0(2), unspecified 6.0 versions, and 5.0 before 5.0(2)SR3 allows remote attackers to read arbitrary files via a crafted bootstrap message to TCP port 6295.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2f110.shtml; http://www.securityfocus.com/bid/40680; http://www.securitytracker.com/id?1024082
CVE: CVE-2010-1572
Published: 2010-06-10
Description: Unspecified vulnerability in the tech support diagnostic shell in Cisco Application Extension Platform (AXP) 1.1 and 1.1.5 allows local users to obtain sensitive configuration information and gain administrator privileges via unspecified API calls.
CVSS Score: 9.0 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b3290b.shtml; http://www.securityfocus.com/bid/40682; https://exchange.xforce.ibmcloud.com/vulnerabilities/59271
CVE: CVE-2010-1573
Published: 2010-06-10
Description: Linksys WAP54Gv3 firmware 3.04.03 and earlier uses a hard-coded username (Gemtek) and password (gemtekswd) for a debug interface for certain web pages, which allows remote attackers to execute arbitrary commands via the (1) data1, (2) data2, or (3) data3 parameters to (a) Debug_command_page.asp and (b) debug.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://secunia.com/advisories/40103; http://tools.cisco.com/security/center/viewAlert.x?alertId=20682; http://www.icysilence.org/?p=268
CVE: CVE-2010-1931
Published: 2010-06-10
Description: SQL injection vulnerability in includes/content/cart.inc.php in CubeCart PHP Shopping cart 4.3.4 through 4.3.9 allows remote attackers to execute arbitrary SQL commands via the shipKey parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forums.cubecart.com/index.php?showtopic=41469; http://osvdb.org/65250; http://secunia.com/advisories/40102
CVE: CVE-2010-1960
Published: 2010-06-10
Description: Buffer overflow in the error handling functionality in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long, invalid option to jovgraph.exe.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5281&w=2; http://secunia.com/advisories/40101; http://www.securityfocus.com/archive/1/511734/100/0/threaded
CVE: CVE-2010-1961
Published: 2010-06-10
Description: Buffer overflow in ovutil.dll in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unspecified variables to jovgraph.exe, which are not properly handled in a call to the sprintf function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5281&w=2; http://secunia.com/advisories/40101; http://www.securityfocus.com/archive/1/511731/100/0/threaded
CVE: CVE-2010-2193
Published: 2010-06-10
Description: Multiple unspecified vulnerabilities in the CA (1) PSFormX and (2) WebScan ActiveX controls, as distributed on the CA Global Advisor web site until May 2009, allow remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://osvdb.org/65382; http://secunia.com/advisories/40092; http://www.securityfocus.com/archive/1/511764/100/0/threaded
CVE: CVE-2010-2261
Published: 2010-06-10
Description: Linksys WAP54Gv3 firmware 3.04.03 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) data2 and (2) data3 parameters to (a) Debug_command_page.asp and (b) debug.cgi.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/archive/1/511733/100/0/threaded; http://www.securityfocus.com/archive/1/511733/100/0/threaded
CVE: CVE-2010-2262
Published: 2010-06-10
Description: Galileo Students Team Weborf before 0.12.1 allows remote attackers to cause a denial of service (crash) via a crafted Range header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://galileo.dmi.unict.it/wiki/weborf/doku.php?id=news:released_0.12.1; http://secunia.com/advisories/40051; http://www.securityfocus.com/bid/40575
CVE: CVE-2009-4883
Published: 2010-06-11
Description: SQL injection vulnerability in index.php in PHPRecipeBook 2.24 and 2.39 allows remote attackers to execute arbitrary SQL commands via the (1) base_id or (2) course_id parameter in a search action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34221; http://www.exploit-db.com/exploits/8182; http://www.securityfocus.com/bid/34052
CVE: CVE-2009-4884
Published: 2010-06-11
Description: Multiple SQL injection vulnerabilities in phpCommunity 2 2.1.8, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the forum_id parameter in a forum action to index.php, (2) the topic_id parameter in a forum action to index.php, (3) the wert parameter in an id search action to index.php, (4) the wert parameter in a nick search action to index.php, or (5) the wert parameter in a forum search action to index.php, related to class_forum.php and class_search.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8185; http://www.securityfocus.com/archive/1/501588/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/49151
CVE: CVE-2009-4885
Published: 2010-06-11
Description: Cross-site scripting (XSS) vulnerability in templates/1/login.php in phpCommunity 2 2.1.8 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/8185; http://www.securityfocus.com/archive/1/501588/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/49153
CVE: CVE-2009-4886
Published: 2010-06-11
Description: Multiple directory traversal vulnerabilities in phpCommunity 2 2.1.8 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) file parameter to module/admin/files/show_file.php and the (2) path parameter to module/admin/files/show_source.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/8185; http://www.securityfocus.com/archive/1/501588/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/49152
CVE: CVE-2009-4887
Published: 2010-06-11
Description: PHP remote file inclusion vulnerability in index.php in CMS S.Builder 3.7 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in a binn_include_path cookie.  NOTE: this can also be leveraged to include and execute arbitrary local files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/8172; http://www.securityfocus.com/bid/34037; https://exchange.xforce.ibmcloud.com/vulnerabilities/49139
CVE: CVE-2009-4888
Published: 2010-06-11
Description: Cross-site scripting (XSS) vulnerability in poster.php in PHortail 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the (1) pseudo, (2) email, (3) ti, and (4) txt parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/52502; http://packetstormsecurity.org/0903-exploits/phortail-xss.txt; http://secunia.com/advisories/34203
CVE: CVE-2009-4889
Published: 2010-06-11
Description: SQL injection vulnerability in books.php in the Book Panel (book_panel) module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the bookid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8186; http://www.securityfocus.com/bid/34049; https://exchange.xforce.ibmcloud.com/vulnerabilities/49160
CVE: CVE-2009-4890
Published: 2010-06-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in the login application in vBook 4.2.17 allow remote attackers to inject arbitrary web script or HTML via the (1) title and (2) message parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/501603/100/0/threaded; http://www.securityfocus.com/bid/34046; https://exchange.xforce.ibmcloud.com/vulnerabilities/49161
CVE: CVE-2009-4891
Published: 2010-06-11
Description: SQL injection vulnerability in index.php in CS-Cart 2.0.0 Beta 3 allows remote attackers to execute arbitrary SQL commands via the product_id parameter in a products.view action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8184; http://www.securityfocus.com/bid/34048; https://exchange.xforce.ibmcloud.com/vulnerabilities/49154
CVE: CVE-2009-4892
Published: 2010-06-11
Description: SQL injection vulnerability in Content Management System WEBjump! allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) portfolio_genre.php and (2) news_id.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8188; http://www.securityfocus.com/bid/34058; http://www.exploit-db.com/exploits/8188
CVE: CVE-2010-1384
Published: 2010-06-11
Description: Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not provide a warning about a (1) http or (2) https URL that contains a username and password, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN46026251/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001538.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html
CVE: CVE-2010-1385
Published: 2010-06-11
Description: Use-after-free vulnerability in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://secunia.com/advisories/40105; http://securitytracker.com/id?1024067
CVE: CVE-2010-1388
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6, and before 4.1 on Mac OS X 10.4, does not properly handle clipboard (1) drag and (2) paste operations for URLs, which allows user-assisted remote attackers to read arbitrary files via a crafted HTML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/40105