deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1219
Published: 2010-03-30
Description: Directory traversal vulnerability in the JA News (com_janews) component 1.0 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/38952; http://www.exploit-db.com/exploits/11757; http://www.securityfocus.com/bid/38746
CVE: CVE-2010-0132
Published: 2010-03-31
Description: Cross-site scripting (XSS) vulnerability in ViewVC 1.1 before 1.1.5 and 1.0 before 1.0.11, when the regular expression search functionality is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to "search_re input," a different vulnerability than CVE-2010-0736.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038420.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038456.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038925.html
CVE: CVE-2010-0448
Published: 2010-03-31
Description: Unspecified vulnerability in HP SOA Registry Foundation 6.63 and 6.64 allows remote attackers to obtain "unauthorized access to data" via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5378&w=2; http://secunia.com/advisories/39187; http://www.securityfocus.com/bid/39059
CVE: CVE-2010-0449
Published: 2010-03-31
Description: Cross-site scripting (XSS) vulnerability in HP SOA Registry Foundation 6.63 and 6.64 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5378&w=2; http://secunia.com/advisories/39187; http://www.securityfocus.com/bid/39060
CVE: CVE-2010-0450
Published: 2010-03-31
Description: Unspecified vulnerability in HP SOA Registry Foundation 6.63 and 6.64 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 8.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5378&w=2; http://secunia.com/advisories/39187; http://www.securityfocus.com/bid/39061
CVE: CVE-2010-1030
Published: 2010-03-31
Description: Unspecified vulnerability in HP-UX B.11.31, with AudFilter rules enabled, allows local users to cause a denial of service via unknown vectors.
CVSS Score: 4.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4732&w=2; http://www.securityfocus.com/bid/39046; http://www.securitytracker.com/id?1023772
CVE: CVE-2010-1187
Published: 2010-03-31
Description: The Transparent Inter-Process Communication (TIPC) functionality in Linux kernel 2.6.16-rc1 through 2.6.33, and possibly other versions, allows local users to cause a denial of service (kernel OOPS) by sending datagrams through AF_TIPC before entering network mode, which triggers a NULL pointer dereference.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commitdiff%3Bh=d0021b252eaf65ca07ed14f0d66425dd9ccab9a6%3Bhp=6d55cb91a0020ac0d78edcad61efd6c8cf5785a3; http://secunia.com/advisories/39830; http://secunia.com/advisories/43315
CVE: CVE-2010-1188
Published: 2010-03-31
Description: Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20, when IPV6_RECVPKTINFO is set on a listening socket, allows remote attackers to cause a denial of service (kernel panic) via a SYN packet while the socket is in a listening (TCP_LISTEN) state, which is not properly handled and causes the skb structure to be freed.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://git.kernel.org/linus/fb7e2399ec17f1004c0e0ccfd17439f8759ede01; http://secunia.com/advisories/39652; http://support.avaya.com/css/P8/documents/100090459
CVE: CVE-2010-1189
Published: 2010-03-31
Description: MediaWiki before 1.15.2 does not prevent wiki editors from linking to images from other web sites in wiki pages, which allows editors to obtain IP addresses and other information of wiki users by adding a link to an image on an attacker-controlled web site, aka "CSS validation issue."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-March/000088.html; http://secunia.com/advisories/39022
CVE: CVE-2010-1190
Published: 2010-03-31
Description: thumb.php in MediaWiki before 1.15.2, when used with access-restriction mechanisms such as img_auth.php, does not check user permissions before providing scaled images, which allows remote attackers to bypass intended access restrictions and read private images via unspecified manipulations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-March/000088.html; http://secunia.com/advisories/39022
CVE: CVE-2010-1191
Published: 2010-03-31
Description: Sahana disaster management system 0.6.2.2, and possibly other versions, allows remote attackers to bypass intended access restrictions and disable administrator authentication via a direct request to stream.php in an acl_enable_acl action to the admin module.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/39020; http://sourceforge.net/tracker/?func=detail&aid=2970786&group_id=127855&atid=709778; http://www.securityfocus.com/archive/1/510164/100/0/threaded
CVE: CVE-2010-1192
Published: 2010-03-31
Description: libESMTP, probably 1.0.4 and earlier, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html; http://www.openwall.com/lists/oss-security/2010/03/03/6; http://www.openwall.com/lists/oss-security/2010/03/09/3
CVE: CVE-2010-1194
Published: 2010-03-31
Description: The match_component function in smtp-tls.c in libESMTP 1.0.3.r1, and possibly other versions including 1.0.4, treats two strings as equal if one is a substring of the other, which allows remote attackers to spoof trusted certificates via a crafted subjectAltName.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=311191; http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html; http://www.openwall.com/lists/oss-security/2010/03/03/6
CVE: CVE-2010-1195
Published: 2010-03-31
Description: Cross-site scripting (XSS) vulnerability in the htmlscrubber component in ikiwiki 2.x before 2.53.5 and 3.x before 3.20100312 allows remote attackers to inject arbitrary web script or HTML via a crafted data:image/svg+xml URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ikiwiki.info/security/#index36h2; http://secunia.com/advisories/38983; http://secunia.com/advisories/39048
CVE: CVE-2010-0527
Published: 2010-03-31
Description: Integer overflow in Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7458; http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html
CVE: CVE-2010-0528
Published: 2010-03-31
Description: Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted color tables in a movie file, related to malformed MediaVideo data, a sample description atom (STSD), and a crafted length value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; http://www.securityfocus.com/archive/1/510518/100/0/threaded; http://www.zerodayinitiative.com/advisories/ZDI-10-042
CVE: CVE-2010-0529
Published: 2010-03-31
Description: Heap-based buffer overflow in QuickTime.qts in Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PICT image with a BkPixPat opcode (0x12) containing crafted values that are used in a calculation for memory allocation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; http://www.securityfocus.com/archive/1/510569/100/0/threaded; http://www.zerodayinitiative.com/advisories/ZDI-10-067
CVE: CVE-2010-0531
Published: 2010-03-31
Description: Apple iTunes before 9.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted MP4 podcast file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html; http://secunia.com/advisories/39135; http://support.apple.com/kb/HT4105
CVE: CVE-2010-0532
Published: 2010-03-31
Description: Race condition in the installation package in Apple iTunes before 9.1 on Windows allows local users to gain privileges by replacing an unspecified file with a Trojan horse.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html; http://secunia.com/advisories/39135; http://support.apple.com/kb/HT4105
CVE: CVE-2010-0536
Published: 2010-03-31
Description: Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted BMP image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6969; http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html
CVE: CVE-2010-0267
Published: 2010-03-31
Description: Microsoft Internet Explorer 6, 6 SP1, and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1023773; http://www.securityfocus.com/bid/39023; http://www.us-cert.gov/cas/techalerts/TA10-068A.html
CVE: CVE-2010-0488
Published: 2010-03-31
Description: Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site, aka "Post Encoding Information Disclosure Vulnerability."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-732
References: http://jvn.jp/en/jp/JVN49467403/index.html; http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000011.html; http://securitytracker.com/id?1023773
CVE: CVE-2010-0489
Published: 2010-03-31
Description: Race condition in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Race Condition Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-362
References: http://securitytracker.com/id?1023773; http://www.securityfocus.com/bid/39026; http://www.us-cert.gov/cas/techalerts/TA10-068A.html
CVE: CVE-2010-0490
Published: 2010-03-31
Description: Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1023773; http://www.securityfocus.com/bid/39031; http://www.us-cert.gov/cas/techalerts/TA10-068A.html
CVE: CVE-2010-0491
Published: 2010-03-31
Description: Use-after-free vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 6 SP1 allows remote attackers to execute arbitrary code by changing unspecified properties of an HTML object that has an onreadystatechange event handler, aka "HTML Object Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=864; http://securitytracker.com/id?1023773; http://www.securityfocus.com/bid/39027
CVE: CVE-2010-0492
Published: 2010-03-31
Description: Use-after-free vulnerability in mstime.dll in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via vectors related to the TIME2 behavior, the CTimeAction object, and destruction of markup, leading to memory corruption, aka "HTML Object Memory Corruption Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-94, CWE-94
References: http://securitytracker.com/id?1023773; http://www.securityfocus.com/archive/1/510506/100/0/threaded; http://www.securityfocus.com/bid/39030
CVE: CVE-2010-0494
Published: 2010-03-31
Description: Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted HTML document in a situation where the client user drags one browser window across another browser window, aka "HTML Element Cross-Domain Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://securitytracker.com/id?1023773; http://www.securityfocus.com/bid/39047; http://www.us-cert.gov/cas/techalerts/TA10-068A.html
CVE: CVE-2010-0805
Published: 2010-03-31
Description: The Tabular Data Control (TDC) ActiveX control in Microsoft Internet Explorer 5.01 SP4, 6 on Windows XP SP2 and SP3, and 6 SP1 allows remote attackers to execute arbitrary code via a long URL (DataURL parameter) that triggers memory corruption in the CTDCCtl::SecurityCHeckDataURL function, aka "Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1023773; http://www.securityfocus.com/archive/1/510507/100/0/threaded; http://www.securityfocus.com/bid/39025
CVE: CVE-2010-0807
Published: 2010-03-31
Description: Microsoft Internet Explorer 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, leading to memory corruption, aka "HTML Rendering Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1023773; http://www.securityfocus.com/bid/39024; http://www.us-cert.gov/cas/techalerts/TA10-068A.html
CVE: CVE-2010-0082
Published: 2010-04-01
Description: Unspecified vulnerability in the HotSpot Server component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 5.1 (MEDIUM)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0084
Published: 2010-04-01
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2010-0091.
CVSS Score: 5.0 (MEDIUM)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0085
Published: 2010-04-01
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0088.
CVSS Score: 5.1 (MEDIUM)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0087
Published: 2010-04-01
Description: Unspecified vulnerability in the Java Web Start, Java Plug-in component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0088
Published: 2010-04-01
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0085.
CVSS Score: 6.8 (MEDIUM)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0089
Published: 2010-04-01
Description: Unspecified vulnerability in the Java Web Start, Java Plug-in component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect availability via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0090
Published: 2010-04-01
Description: Unspecified vulnerability in the Java Web Start, Java Plug-in component in Oracle Java SE and Java for Business 6 Update 18 allows remote attackers to affect integrity and availability via unknown vectors.
CVSS Score: 5.8 (MEDIUM)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0091
Published: 2010-04-01
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2010-0084.
CVSS Score: 4.3 (MEDIUM)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0092
Published: 2010-04-01
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 5.1 (MEDIUM)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0093
Published: 2010-04-01
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0095.
CVSS Score: 5.1 (MEDIUM)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0094
Published: 2010-04-01
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18 and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is due to missing privilege checks during deserialization of RMIConnectionImpl objects, which allows remote attackers to call system-level Java functions via the ClassLoader of a constructor that is being deserialized.
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0095
Published: 2010-04-01
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0093.
CVSS Score: 6.8 (MEDIUM)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0837
Published: 2010-04-01
Description: Unspecified vulnerability in the Pack200 component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0838
Published: 2010-04-01
Description: Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is a stack-based buffer overflow using an untrusted size value in the readMabCurveData function in the CMM module in the JVM.
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0839
Published: 2010-04-01
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html