deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-3818
Published: 2010-11-22
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving inline text boxes.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-3819
Published: 2010-11-22
Description: WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly perform a cast of an unspecified variable during processing of Cascading Style Sheets (CSS) boxes, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-3820
Published: 2010-11-22
Description: WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, accesses uninitialized memory during processing of editable elements, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-3821
Published: 2010-11-22
Description: WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly handle the :first-letter pseudo-element in a Cascading Style Sheets (CSS) token sequence, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-3822
Published: 2010-11-22
Description: WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, accesses an uninitialized pointer during processing of Cascading Style Sheets (CSS) counter styles, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-3823
Published: 2010-11-22
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving Geolocation objects.  NOTE: this might overlap CVE-2010-3415.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-3824
Published: 2010-11-22
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving SVG use elements.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-3826
Published: 2010-11-22
Description: WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly perform a cast of an unspecified variable during processing of colors in an SVG document, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.
CVSS Score: 9.3 (HIGH)
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-4165
Published: 2010-11-22
Description: The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-369
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7a1abd08d52fdeddb3e9a5a33f2f15cc6a5674d2; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.html
CVE: CVE-2010-4169
Published: 2010-11-22
Description: Use-after-free vulnerability in mm/mprotect.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors involving an mprotect system call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-416
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=63bfd7384b119409685a17d5c58f0b56e5dc03da; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.html
CVE: CVE-2010-3037
Published: 2010-11-22
Description: goform/websXMLAdminRequestCgi.cgi in Cisco Unified Videoconferencing (UVC) System 5110 and 5115, and possibly Unified Videoconferencing System 3545 and 5230, Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway, Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gateway, and Unified Videoconferencing 3515 Multipoint Control Unit (MCU), allows remote authenticated administrators to execute arbitrary commands via the username field, related to a "shell command injection vulnerability," aka Bug ID CSCti54059.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://seclists.org/fulldisclosure/2010/Nov/167; http://www.cisco.com/en/US/products/products_security_response09186a0080b56d0d.html; http://www.securityfocus.com/bid/44922
CVE: CVE-2010-3038
Published: 2010-11-22
Description: Cisco Unified Videoconferencing (UVC) System 5110 and 5115, when the Linux operating system is used, has a default password for the (1) root, (2) cs, and (3) develop accounts, which makes it easier for remote attackers to obtain access via the (a) FTP or (b) SSH daemon, aka Bug ID CSCti54008.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://seclists.org/fulldisclosure/2010/Nov/167; http://www.cisco.com/en/US/products/products_security_response09186a0080b56d0d.html; http://www.securityfocus.com/bid/44924
CVE: CVE-2010-4167
Published: 2010-11-22
Description: Untrusted search path vulnerability in configure.c in ImageMagick before 6.6.5-5, when MAGICKCORE_INSTALLED_SUPPORT is defined, allows local users to gain privileges via a Trojan horse configuration file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=601824; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052515.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052599.html
CVE: CVE-2010-4173
Published: 2010-11-22
Description: The default configuration of libsdp.conf in libsdp 1.1.104 and earlier creates log files in /tmp, which allows local users to overwrite arbitrary files via a (1) symlink or (2) hard link attack on the libsdp.log.##### temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://www.openfabrics.org/downloads/libsdp/libsdp-1.1.105-0.4.g1b9b996.tar.gz; http://www.openwall.com/lists/oss-security/2010/11/16/2; http://www.openwall.com/lists/oss-security/2010/11/16/7
CVE: CVE-2010-4302
Published: 2010-11-22
Description: /opt/rv/Versions/CurrentVersion/Mcu/Config/Mcu.val in Cisco Unified Videoconferencing (UVC) System 5110 and 5115, when the Linux operating system is used, uses a weak hashing algorithm for the (1) administrator and (2) operator passwords, which makes it easier for local users to obtain sensitive information by recovering the cleartext values, aka Bug ID CSCti54010.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-310
References: http://seclists.org/fulldisclosure/2010/Nov/167; http://www.cisco.com/en/US/products/products_security_response09186a0080b56d0d.html; http://www.trustmatta.com/advisories/MATTA-2010-001.txt
CVE: CVE-2010-4303
Published: 2010-11-22
Description: Cisco Unified Videoconferencing (UVC) System 5110 and 5115, when the Linux operating system is used, uses world-readable permissions for the /etc/shadow file, which allows local users to discover encrypted passwords by reading this file, aka Bug ID CSCti54043.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-255
References: http://seclists.org/fulldisclosure/2010/Nov/167; http://www.cisco.com/en/US/products/products_security_response09186a0080b56d0d.html; http://www.trustmatta.com/advisories/MATTA-2010-001.txt
CVE: CVE-2010-4304
Published: 2010-11-22
Description: The web interface in Cisco Unified Videoconferencing (UVC) System 3545, 5110, 5115, and 5230; Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway; Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gateway; and Unified Videoconferencing 3515 Multipoint Control Unit (MCU) uses predictable session IDs based on time values, which makes it easier for remote attackers to hijack sessions via a brute-force attack, aka Bug ID CSCti54048.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://seclists.org/fulldisclosure/2010/Nov/167; http://www.cisco.com/en/US/products/products_security_response09186a0080b56d0d.html; http://www.trustmatta.com/advisories/MATTA-2010-001.txt
CVE: CVE-2010-4305
Published: 2010-11-22
Description: Cisco Unified Videoconferencing (UVC) System 3545, 5110, 5115, and 5230; Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway; Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gateway; and Unified Videoconferencing 3515 Multipoint Control Unit (MCU) improperly use cookies for web-interface credentials, which allows remote attackers to obtain sensitive information by reading a (1) cleartext or (2) base64-encoded cleartext cookie, aka Bug ID CSCti54052.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://seclists.org/fulldisclosure/2010/Nov/167; http://www.cisco.com/en/US/products/products_security_response09186a0080b56d0d.html; http://www.trustmatta.com/advisories/MATTA-2010-001.txt
CVE: CVE-2010-2962
Published: 2010-11-26
Description: drivers/gpu/drm/i915/i915_gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.36 does not properly validate pointers to blocks of memory, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via crafted use of the ioctl interface, related to (1) pwrite and (2) pread operations.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ce9d419dbecc292cc3e06e8b1d6d123d3fa813a4; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html
CVE: CVE-2010-2963
Published: 2010-11-26
Description: drivers/media/video/v4l2-compat-ioctl32.c in the Video4Linux (V4L) implementation in the Linux kernel before 2.6.36 on 64-bit platforms does not validate the destination of a memory copy operation, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via a VIDIOCSTUNER ioctl call on a /dev/video device, followed by a VIDIOCSMICROCODE ioctl call on this device.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3e645d6b485446c54c6745c5e2cf5c528fe4deec; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00008.html
CVE: CVE-2010-3445
Published: 2010-11-26
Description: Stack consumption vulnerability in the dissect_ber_unknown function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark 1.4.x before 1.4.1 and 1.2.x before 1.2.12 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a long string in an unknown ASN.1/BER encoded packet, as demonstrated using SNMP.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2010-09/0088.html; http://blogs.sun.com/security/entry/resource_management_errors_vulnerability_in; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055364.html
CVE: CVE-2010-3698
Published: 2010-11-26
Description: The KVM implementation in the Linux kernel before 2.6.36 does not properly reload the FS and GS segment registers, which allows host OS users to cause a denial of service (host OS crash) via a KVM_RUN ioctl call in conjunction with a modified Local Descriptor Table (LDT).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9581d442b9058d3699b4be568b6e5eae38a41493; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html; http://secunia.com/advisories/42745
CVE: CVE-2010-4300
Published: 2010-11-26
Description: Heap-based buffer overflow in the dissect_ldss_transfer function (epan/dissectors/packet-ldss.c) in the LDSS dissector in Wireshark 1.2.0 through 1.2.12 and 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an LDSS packet with a long digest line that triggers memory corruption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://blogs.sun.com/security/entry/buffer_overflow_vulnerability_in_wireshark; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-4301
Published: 2010-11-26
Description: epan/dissectors/packet-zbee-zcl.c in the ZigBee ZCL dissector in Wireshark 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted ZCL packet, related to Discover Attributes.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://osvdb.org/69355
CVE: CVE-2008-7266
Published: 2010-11-26
Description: Cross-site scripting (XSS) vulnerability in an unspecified Shockwave Flash file in RSA Adaptive Authentication 2.x and 5.7.x allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/42332; http://www.securityfocus.com/archive/1/514869/100/0/threaded; http://www.securitytracker.com/id?1024775
CVE: CVE-2010-3705
Published: 2010-11-26
Description: The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmac_ids array of an SCTP peer, which allows remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array.
CVSS Score: 8.3 (HIGH)
CWE: CWE-400
References: http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=51e97a12bef19b7e43199fc153cf9bd5f2140362; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]8814&w=2
CVE: CVE-2010-3814
Published: 2010-11-26
Description: Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated by a PDF document with a crafted embedded font.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602221; http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0edf0986f3be570f5bf90ff245a85c1675f5c9a4; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html
CVE: CVE-2010-3827
Published: 2010-11-26
Description: Apple iOS before 4.2 does not properly validate signatures before displaying a configuration profile in the configuration installation utility, which allows remote attackers to spoof profiles via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://secunia.com/advisories/42314; http://support.apple.com/kb/HT4456
CVE: CVE-2010-3828
Published: 2010-11-26
Description: iAd Content Display in Apple iOS before 4.2 allows man-in-the-middle attackers to make calls via a crafted URL in an ad.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://secunia.com/advisories/42314; http://support.apple.com/kb/HT4456
CVE: CVE-2010-3829
Published: 2010-11-26
Description: WebKit in Apple iOS before 4.2 allows remote attackers to bypass the remote image loading setting in Mail via an HTML LINK element with a DNS prefetching property, as demonstrated by an HTML e-mail message that uses a LINK element for X-Confirm-Reading-To functionality, a related issue to CVE-2010-3813.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-3830
Published: 2010-11-26
Description: Networking in Apple iOS before 4.2 accesses an invalid pointer during the processing of packet filter rules, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://secunia.com/advisories/42314; http://support.apple.com/kb/HT4456
CVE: CVE-2010-3831
Published: 2010-11-26
Description: Photos in Apple iOS before 4.2 enables support for HTTP Basic Authentication over an unencrypted connection, which allows man-in-the-middle attackers to read MobileMe account passwords by spoofing a MobileMe Gallery server during a "Send to MobileMe" action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://secunia.com/advisories/42314; http://support.apple.com/kb/HT4456
CVE: CVE-2010-3832
Published: 2010-11-26
Description: Heap-based buffer overflow in the GSM mobility management implementation in Telephony in Apple iOS before 4.2 on the iPhone and iPad allows remote attackers to execute arbitrary code on the baseband processor via a crafted Temporary Mobile Subscriber Identity (TMSI) field.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://secunia.com/advisories/42314; http://support.apple.com/kb/HT4456
CVE: CVE-2010-3855
Published: 2010-11-26
Description: Buffer overflow in the ft_var_readpackedpoints function in truetype/ttgxvar.c in FreeType 2.4.3 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TrueType GX font.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602221; http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=59eb9f8cfe7d1df379a2318316d1f04f80fba54a; http://lists.apple.com/archives/security-announce/2011//Jul/msg00000.html
CVE: CVE-2010-3909
Published: 2010-11-26
Description: Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/42246; http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/; http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes
CVE: CVE-2010-3910
Published: 2010-11-26
Description: Multiple directory traversal vulnerabilities in the return_application_language function in include/utils/utils.php in vtiger CRM before 5.2.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the lang_crm parameter to phprint.php or (2) the current_language parameter in an Accounts Import action to graph.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/42246; http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/; http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes
CVE: CVE-2010-3911
Published: 2010-11-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via (1) the username (aka default_user_name) field or (2) the password field in a Users Login action to index.php, or (3) the label parameter in a Settings GetFieldInfo action to index.php, related to modules/Settings/GetFieldInfo.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/42246; http://vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/; http://wiki.vtiger.com/index.php/Vtiger521:Release_Notes
CVE: CVE-2010-4172
Published: 2010-11-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2337&w=2
CVE: CVE-2010-4298
Published: 2010-11-26
Description: SQL injection vulnerability in the download module in Free Simple Software 1.0 allows remote attackers to execute arbitrary SQL commands via the downloads_id parameter in a download_now action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/514863/100/0/threaded; http://www.securityfocus.com/bid/44998; https://www.uncompiled.com/2010/11/free-simple-software-sql-injection-vulnerability-cve-2010-4298/