deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1910
Published: 2010-05-12
Description: The Forgot Password implementation in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to reset passwords of accounts with blank Hint questions and Hint answers by sending an empty value for each of these two Hint fields.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/39740; http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html; http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf
CVE: CVE-2010-1911
Published: 2010-05-12
Description: The site-locking implementation in the SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance relies on a list of server domain names to restrict execution of ActiveX controls, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a DNS hijacking attack.
CVSS Score: 9.3 (HIGH)
CWE: CWE-310
References: http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html; http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf; http://www.kb.cert.org/vuls/id/602801
CVE: CVE-2010-1912
Published: 2010-05-12
Description: The SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to bypass intended restrictions on ActiveX execution via "instantiation/free attacks."
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html; http://www.kb.cert.org/vuls/id/602801; http://www.securityfocus.com/archive/1/511176/100/0/threaded
CVE: CVE-2010-1913
Published: 2010-05-12
Description: The default configuration of pluginlicense.ini for the SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance, when downloaded from a server operated by Telefonica or possibly other companies, contains an incorrect DNS whitelist that includes the DNS hostnames of home computers of many persons, which allows remote attackers to bypass intended restrictions on ActiveX execution by hosting an ActiveX control on an applicable home web server.
CVSS Score: 9.3 (HIGH)
CWE: CWE-16
References: http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html; http://www.kb.cert.org/vuls/id/602801; http://www.securityfocus.com/archive/1/511176/100/0/threaded
CVE: CVE-2010-1869
Published: 2010-05-12
Description: Stack-based buffer overflow in the parser function in GhostScript 8.70 and 8.64 allows context-dependent attackers to execute arbitrary code via a crafted PostScript file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html; http://secunia.com/advisories/39753; http://secunia.com/advisories/40580
CVE: CVE-2010-1914
Published: 2010-05-12
Description: The Zend Engine in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information by interrupting the handler for the (1) ZEND_BW_XOR opcode (shift_left_function), (2) ZEND_SL opcode (bitwise_xor_function), or (3) ZEND_SR opcode (shift_right_function), related to the convert_to_long_base function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html; http://www.php-security.org/2010/05/08/mops-2010-014-php-zend_bw_xor-opcode-interruption-address-information-leak-vulnerability/index.html
CVE: CVE-2010-1915
Published: 2010-05-12
Description: The preg_quote function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature, modification of ZVALs whose values are not updated in the associated local variables, and access of previously-freed memory.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html; http://www.php-security.org/2010/05/09/mops-2010-017-php-preg_quote-interruption-information-leak-vulnerability/index.html
CVE: CVE-2010-1916
Published: 2010-05-12
Description: The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced, which are not properly handled by the "Deprecated config passing" feature; or (2) crafted backend_data and backend_data[key_location] variables, which are not properly handled by the xinha_read_passed_data function.  NOTE: this can be leveraged to upload and possibly execute arbitrary files via config.inc.php in the ImageManager plugin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042577.html; http://secunia.com/advisories/39782; http://secunia.com/advisories/40124
CVE: CVE-2010-1917
Published: 2010-05-12
Description: Stack consumption vulnerability in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (PHP crash) via a crafted first argument to the fnmatch function, as demonstrated using a long string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7777&w=2
CVE: CVE-2010-1918
Published: 2010-05-12
Description: SQL injection vulnerability in ask_chat.php in eFront 3.6.2 and earlier allows remote attackers to execute arbitrary SQL commands via the chatrooms_ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/64506; http://packetstormsecurity.org/1005-exploits/MOPS-2010-018.pdf; http://secunia.com/advisories/39728
CVE: CVE-2010-0815
Published: 2010-05-12
Description: VBE6.DLL in Microsoft Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Visual Basic for Applications (VBA), and VBA SDK 6.3 through 6.5 does not properly search for ActiveX controls that are embedded in documents, which allows remote attackers to execute arbitrary code via a crafted document, aka "VBE6.DLL Stack Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA10-131A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-031; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7074
CVE: CVE-2010-0816
Published: 2010-05-12
Description: Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7; and Windows Mail on Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows remote e-mail servers and man-in-the-middle attackers to execute arbitrary code via a crafted (1) POP3 or (2) IMAP response, as demonstrated by a certain +OK response on TCP port 110, aka "Outlook Express and Windows Mail Integer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/bugtraq/2010-05/0068.html; http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=13&Itemid=13; http://www.securityfocus.com/bid/40052
CVE: CVE-2010-1457
Published: 2010-05-12
Description: Tools/gdomap.c in gdomap in GNUstep Base before 1.20.0 allows local users to read arbitrary files via a (1) -c or (2) -a option, which prints file contents in an error message.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://ftpmain.gnustep.org/pub/gnustep/core/gnustep-base-1.20.0.tar.gz; http://savannah.gnu.org/bugs/?29755; http://secunia.com/advisories/39746
CVE: CVE-2010-1620
Published: 2010-05-12
Description: Integer overflow in the load_iface function in Tools/gdomap.c in gdomap in GNUstep Base before 1.20.0 might allow context-dependent attackers to execute arbitrary code via a (1) file or (2) socket that provides configuration data with many entries, leading to a heap-based buffer overflow.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://ftpmain.gnustep.org/pub/gnustep/core/gnustep-base-1.20.0.tar.gz; http://marc.info/?l=oss-security&m=[PII_REDACTED]5709&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]7537&w=2
CVE: CVE-2010-1482
Published: 2010-05-12
Description: Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.cmsmadesimple.org/2010/05/01/announcing-cms-made-simple-1-7-1-escade/; http://int21.de/cve/CVE-2010-1482-cmsmadesimple-xss-backend.html; http://www.securityfocus.com/archive/1/511178
CVE: CVE-2010-1920
Published: 2010-05-12
Description: Directory traversal vulnerability in scr/soustab.php in OpenMairie openAnnuaire 2.00, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsn[phptype] parameter, a related issue to CVE-2007-2069.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1005-exploits/openmairie-rfilfi.txt; http://secunia.com/advisories/39673; http://www.exploit-db.com/exploits/12486
CVE: CVE-2010-1921
Published: 2010-05-12
Description: Multiple PHP remote file inclusion vulnerabilities in OpenMairie openAnnuaire 2.00, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) annuaire.class.php, (2) droit.class.php, (3) collectivite.class.php, (4) profil.class.php, (5) direction.class.php, (6) service.class.php, (7) directiongenerale.class.php, and (8) utilisateur.class.php in obj/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.org/1005-exploits/openmairie-rfilfi.txt; http://secunia.com/advisories/39673; http://www.exploit-db.com/exploits/12486
CVE: CVE-2010-1922
Published: 2010-05-12
Description: Multiple PHP remote file inclusion vulnerabilities in 29o3 CMS 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the LibDir parameter to (1) lib/page/pageDescriptionObject.php, and (2) layoutHeaderFuncs.php, (3) layoutManager.php, and (4) layoutParser.php in lib/layout/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/1005-exploits/29o3cms-rfi.txt; http://www.exploit-db.com/exploits/12558; http://www.securityfocus.com/archive/1/511222/100/0/threaded
CVE: CVE-2010-1923
Published: 2010-05-12
Description: SQL injection vulnerability in user.php in Hi Web Wiesbaden Web 2.0 Social Network Freunde Community System allows remote attackers to execute arbitrary SQL commands via the id parameter in a showgallery action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/64513; http://packetstormsecurity.org/1005-exploits/web20snfcs-sql.txt; http://secunia.com/advisories/39761
CVE: CVE-2010-1924
Published: 2010-05-12
Description: SQL injection vulnerability in index.php in Hi Web Wiesbaden Live Shopping Multi Portal System allows remote attackers to execute arbitrary SQL commands via the artikel parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/64512; http://secunia.com/advisories/39718; http://www.exploit-db.com/exploits/12545
CVE: CVE-2010-1925
Published: 2010-05-12
Description: SQL injection vulnerability in makale.php in tekno.Portal 0.1b allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2006-2817.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1005-exploits/teknoportal-sql.txt; http://secunia.com/advisories/20464; http://www.exploit-db.com/exploits/12552
CVE: CVE-2010-1926
Published: 2010-05-12
Description: Directory traversal vulnerability in scr/soustab.php in openMairie openCourrier 2.02 and 2.03 beta, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsn[phptype] parameter, a related issue to CVE-2007-2069.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/opencourrier-rfilfi.txt; http://secunia.com/advisories/39624; http://www.exploit-db.com/exploits/12398
CVE: CVE-2010-1927
Published: 2010-05-12
Description: Multiple PHP remote file inclusion vulnerabilities in openMairie openCourrier 2.02 and 2.03 beta, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) bible.class.php, (2) dossier.class.php, (3) service.class.php, (4) collectivite.class.php, (5) droit.class.php, (6) tache.class.php, (7) emetteur.class.php, (8) utilisateur.class.php, (9) courrier.recherche.tab.class.php, and (10) profil.class.php in obj/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.org/1004-exploits/opencourrier-rfilfi.txt; http://secunia.com/advisories/39624; http://www.exploit-db.com/exploits/12398
CVE: CVE-2010-1928
Published: 2010-05-12
Description: Directory traversal vulnerability in scr/soustab.php in openMairie openPlanning 1.00, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsn[phptype] parameter, a related issue to CVE-2007-2069.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/openplanning-rfilfi.txt; http://secunia.com/advisories/39606; http://www.exploit-db.com/exploits/12365
CVE: CVE-2010-1934
Published: 2010-05-12
Description: Multiple PHP remote file inclusion vulnerabilities in openMairie openPlanning 1.00, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) categorie.class.php, (2) profil.class.php, (3) collectivite.class.php, (4) ressource.class.php, (5) droit.class.php, (6) utilisateur.class.php, and (7) planning.class.php in obj/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.org/1004-exploits/openplanning-rfilfi.txt; http://secunia.com/advisories/39606; http://www.exploit-db.com/exploits/12365
CVE: CVE-2010-1935
Published: 2010-05-12
Description: Directory traversal vulnerability in scr/soustab.php in openMairie Openpresse 1.01, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsn[phptype] parameter, a related issue to CVE-2007-2069.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/openpresse-lfi.txt; http://secunia.com/advisories/39605; http://www.exploit-db.com/exploits/12364
CVE: CVE-2010-1936
Published: 2010-05-12
Description: Directory traversal vulnerability in scr/soustab.php in openMairie openComInterne 1.01, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsn[phptype] parameter, a related issue to CVE-2007-2069.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/opencominterne-lfi.txt; http://secunia.com/advisories/39623; http://www.exploit-db.com/exploits/12396
CVE: CVE-2009-3467
Published: 2010-05-13
Description: Cross-site scripting (XSS) vulnerability in an unspecified method in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/39790; http://www.adobe.com/support/security/bulletins/apsb10-11.html; http://www.vupen.com/english/advisories/2010/1127
CVE: CVE-2010-0127
Published: 2010-05-13
Description: Adobe Shockwave Player before 11.5.7.609 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted FFFFFF45h Shockwave 3D blocks in a Shockwave file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://secunia.com/advisories/38751; http://secunia.com/secunia_research/2010-17/; http://www.adobe.com/support/security/bulletins/apsb10-12.html
CVE: CVE-2010-0128
Published: 2010-05-13
Description: Integer signedness error in dirapi.dll in Adobe Shockwave Player before 11.5.7.609 and Adobe Director before 11.5.7.609 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted .dir file that triggers an invalid read operation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://secunia.com/advisories/38751; http://secunia.com/secunia_research/2010-19/; http://www.adobe.com/support/security/bulletins/apsb10-12.html
CVE: CVE-2010-0129
Published: 2010-05-13
Description: Multiple integer overflows in Adobe Shockwave Player before 11.5.7.609 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted .dir (aka Director) file that triggers an array index error.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html; http://hi.baidu.com/fs_fx/blog/item/fa74a61705b5e24621a4e951.html; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
CVE: CVE-2010-0130
Published: 2010-05-13
Description: Integer overflow in Adobe Shockwave Player before 11.5.7.609 might allow remote attackers to execute arbitrary code via a crafted .dir (aka Director) file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://secunia.com/advisories/38751; http://secunia.com/secunia_research/2010-22/; http://www.adobe.com/support/security/bulletins/apsb10-12.html
CVE: CVE-2010-0986
Published: 2010-05-13
Description: Adobe Shockwave Player before 11.5.7.609 does not properly process asset entries, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted Shockwave file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://secunia.com/advisories/38751; http://secunia.com/secunia_research/2010-34/; http://www.adobe.com/support/security/bulletins/apsb10-12.html
CVE: CVE-2010-0987
Published: 2010-05-13
Description: Heap-based buffer overflow in Adobe Shockwave Player before 11.5.7.609 might allow remote attackers to execute arbitrary code via crafted embedded fonts in a Shockwave file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://secunia.com/advisories/38751; http://secunia.com/secunia_research/2010-50/; http://www.adobe.com/support/security/bulletins/apsb10-12.html
CVE: CVE-2010-1280
Published: 2010-05-13
Description: Adobe Shockwave Player before 11.5.7.609 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file, related to (1) an erroneous dereference and (2) a certain Shock.dir file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html; http://secunia.com/advisories/38751; http://www.adobe.com/support/security/bulletins/apsb10-12.html
CVE: CVE-2010-1281
Published: 2010-05-13
Description: iml32.dll in Adobe Shockwave Player before 11.5.7.609 does not validate a certain value from a file before using it in file-pointer calculations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://secunia.com/advisories/38751; http://www.adobe.com/support/security/bulletins/apsb10-12.html; http://www.securityfocus.com/archive/1/511252/100/0/threaded
CVE: CVE-2010-1282
Published: 2010-05-13
Description: Adobe Shockwave Player before 11.5.7.609 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted ATOM size in a .dir (aka Director) file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html; http://hi.baidu.com/fs_fx/blog/item/f8de1d18ba8c9b76dbb4bd56.html; http://www.adobe.com/support/security/bulletins/apsb10-12.html
CVE: CVE-2010-1283
Published: 2010-05-13
Description: Adobe Shockwave Player before 11.5.7.609 does not properly parse 3D objects in .dir (aka Director) files, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a modified field in a 0xFFFFFF49 record.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://secunia.com/advisories/38751; http://www.adobe.com/support/security/bulletins/apsb10-12.html; http://www.securityfocus.com/archive/1/511253/100/0/threaded
CVE: CVE-2010-1292
Published: 2010-05-13
Description: The implementation of pami RIFF chunk parsing in Adobe Shockwave Player before 11.5.7.609 does not validate a certain value from a file before using it in file-pointer calculations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38751; http://www.adobe.com/support/security/bulletins/apsb10-12.html; http://www.securityfocus.com/archive/1/511242/100/0/threaded
CVE: CVE-2010-1293
Published: 2010-05-13
Description: Cross-site scripting (XSS) vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/39790; http://www.adobe.com/support/security/bulletins/apsb10-11.html; http://www.vupen.com/english/advisories/2010/1127
CVE: CVE-2010-1294
Published: 2010-05-13
Description: Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows local users to obtain sensitive information via unknown vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/39790; http://www.adobe.com/support/security/bulletins/apsb10-11.html; http://www.vupen.com/english/advisories/2010/1127
CVE: CVE-2010-1550
Published: 2010-05-13
Description: Format string vulnerability in ovet_demandpoll.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via format string specifiers in the sel parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4351&w=2; http://www.securityfocus.com/archive/1/511245/100/0/threaded; http://zerodayinitiative.com/advisories/ZDI-10-081/
CVE: CVE-2010-1551
Published: 2010-05-13
Description: Stack-based buffer overflow in the _OVParseLLA function in ov.dll in netmon.exe in Network Monitor in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via the sel parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4351&w=2; http://www.securityfocus.com/archive/1/511247/100/0/threaded; http://www.securityfocus.com/bid/40067