deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-0041
Published: 2010-03-15
Description: ImageIO in Apple Safari before 4.0.5 and iTunes before 9.1 on Windows does not ensure that memory access is associated with initialized memory, which allows remote attackers to obtain potentially sensitive information from process memory via a crafted BMP image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-0042
Published: 2010-03-15
Description: ImageIO in Apple Safari before 4.0.5 and iTunes before 9.1 on Windows does not ensure that memory access is associated with initialized memory, which allows remote attackers to obtain potentially sensitive information from process memory via a crafted TIFF image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html
CVE: CVE-2010-0043
Published: 2010-03-15
Description: ImageIO in Apple Safari before 4.0.5 and iTunes before 9.1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted TIFF image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-0044
Published: 2010-03-15
Description: PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a (1) RSS or (2) Atom feed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-16
References: http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html; http://osvdb.org/62937; http://support.apple.com/kb/HT4070
CVE: CVE-2010-0045
Published: 2010-03-15
Description: Apple Safari before 4.0.5 on Windows does not properly validate external URL schemes, which allows remote attackers to open local files and execute arbitrary code via a crafted HTML document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html; http://support.apple.com/kb/HT4070; http://www.securityfocus.com/bid/38671
CVE: CVE-2010-0046
Published: 2010-03-15
Description: The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted format arguments.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html
CVE: CVE-2010-0047
Published: 2010-03-15
Description: Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to "HTML object element fallback content."
CVSS Score: 8.8 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html
CVE: CVE-2010-0048
Published: 2010-03-15
Description: Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted XML document.
CVSS Score: 8.8 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html
CVE: CVE-2010-0122
Published: 2010-03-15
Description: Multiple SQL injection vulnerabilities in Employee Timeclock Software 0.99 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to (a) auth.php or (b) login_action.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/38739; http://secunia.com/secunia_research/2010-11/; http://www.osvdb.org/62831
CVE: CVE-2010-0123
Published: 2010-03-15
Description: The database backup implementation in Employee Timeclock Software 0.99 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for a "semi-predictable file name."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/38739; http://secunia.com/secunia_research/2010-10/; http://www.osvdb.org/62833
CVE: CVE-2010-0124
Published: 2010-03-15
Description: Employee Timeclock Software 0.99 places the database password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://secunia.com/advisories/38739; http://secunia.com/secunia_research/2010-12/; http://www.osvdb.org/62830
CVE: CVE-2010-0396
Published: 2010-03-15
Description: Directory traversal vulnerability in the dpkg-source component in dpkg before 1.14.29 allows remote attackers to modify arbitrary files via a crafted Debian source archive.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://security.debian.org/pool/updates/main/d/dpkg/dpkg_1.14.29.tar.gz; http://www.debian.org/security/2010/dsa-2011; http://www.vupen.com/english/advisories/2010/0582
CVE: CVE-2010-0624
Published: 2010-03-15
Description: Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client functionality in GNU tar before 1.23 and GNU cpio before 2.11 allows remote rmt servers to cause a denial of service (memory corruption) or possibly execute arbitrary code by sending more data than was requested, related to archive filenames that contain a : (colon) character.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036668.html
CVE: CVE-2010-0049
Published: 2010-03-15
Description: Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via HTML elements with right-to-left (RTL) text directionality.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=863; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html
CVE: CVE-2010-0050
Published: 2010-03-15
Description: Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an HTML document with improperly nested tags.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html
CVE: CVE-2010-0051
Published: 2010-03-15
Description: WebKit in Apple Safari before 4.0.5 does not properly validate the cross-origin loading of stylesheets, which allows remote attackers to obtain sensitive information via a crafted HTML document.  NOTE: this might overlap CVE-2010-0651.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=9877; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-0052
Published: 2010-03-15
Description: Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to "callbacks for HTML elements."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html
CVE: CVE-2010-0053
Published: 2010-03-15
Description: Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the run-in Cascading Style Sheets (CSS) display property.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html
CVE: CVE-2010-0054
Published: 2010-03-15
Description: Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving HTML IMG elements.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html
CVE: CVE-2009-4698
Published: 2010-03-15
Description: Multiple SQL injection vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to execute arbitrary SQL commands via the codigo parameter to (1) aviso.php and (2) imprimir.php, and the (3) cod_categoria parameter to categoria.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/56593; http://osvdb.org/56595; http://secunia.com/advisories/35966
CVE: CVE-2009-4699
Published: 2010-03-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in SkaDate Dating allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin/auth.php and (2) file_uploader.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56544; http://osvdb.org/56545; http://secunia.com/advisories/35997
CVE: CVE-2009-4700
Published: 2010-03-15
Description: Directory traversal vulnerability in index.php in SkaDate Dating allows remote attackers to read arbitrary files via a .. (dot dot) in the layout parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/56543; http://secunia.com/advisories/35997; http://www.exploit-db.com/exploits/9260
CVE: CVE-2009-4701
Published: 2010-03-15
Description: SQL injection vulnerability in the Myth download (myth_download) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
CVE: CVE-2009-4702
Published: 2010-03-15
Description: SQL injection vulnerability in the Tour Extension (pm_tour) extension before 0.0.13 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
CVE: CVE-2009-4703
Published: 2010-03-15
Description: SQL injection vulnerability in the Webesse Image Gallery (ws_gallery) extension 1.0.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
CVE: CVE-2009-4704
Published: 2010-03-15
Description: Unspecified vulnerability in the Webesse E-Card (ws_ecard) extension 1.0.2 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
CVE: CVE-2009-4705
Published: 2010-03-15
Description: Cross-site scripting (XSS) vulnerability in the Twitter Search (twittersearch) extension before 0.1.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
CVE: CVE-2009-4706
Published: 2010-03-15
Description: Cross-site scripting (XSS) vulnerability in the Mailform (mailform) extension before 0.9.24 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
CVE: CVE-2009-4707
Published: 2010-03-15
Description: Cross-site scripting (XSS) vulnerability in the [Gobernalia] Front End News Submitter (gb_fenewssubmit) extension 0.1.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
CVE: CVE-2009-4708
Published: 2010-03-15
Description: SQL injection vulnerability in the [Gobernalia] Front End News Submitter (gb_fenewssubmit) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
CVE: CVE-2009-4709
Published: 2010-03-15
Description: SQL injection vulnerability in the datamints Newsticker (datamints_newsticker) extension before 0.7.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/; http://www.securityfocus.com/bid/35879; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
CVE: CVE-2009-4710
Published: 2010-03-15
Description: SQL injection vulnerability in the Reset backend password (cwt_resetbepassword) extension 1.20 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36084; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/; http://www.securityfocus.com/bid/35876
CVE: CVE-2009-4711
Published: 2010-03-15
Description: SQL injection vulnerability in the CoolURI (cooluri) extension before 1.0.16 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2008-6686.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36082; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/; http://www.securityfocus.com/bid/35872
CVE: CVE-2009-4712
Published: 2010-03-15
Description: SQL injection vulnerability in index.php in Tukanas Classifieds (aka EasyClassifieds) Script 1.0 allows remote attackers to execute arbitrary SQL commands via the b parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/56601; http://packetstormsecurity.org/0907-exploits/tukanasec-sql.txt; http://secunia.com/advisories/35977
CVE: CVE-2009-4713
Published: 2010-03-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to inject arbitrary web script or HTML via (1) the cod_categoria parameter to categoria.php, (2) the opcao parameter to index.php, and the PATH_INFO to (3) categoria.php and (4) index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56596; http://osvdb.org/56597; http://secunia.com/advisories/35966
CVE: CVE-2009-4714
Published: 2010-03-15
Description: Cross-site scripting (XSS) vulnerability in the quiz module for XOOPS Celepar allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to cadastro_usuario.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/xoopsceleparquiz-xss.txt; http://secunia.com/advisories/35966; http://www.osvdb.org/56598
CVE: CVE-2009-4715
Published: 2010-03-15
Description: Cross-site scripting (XSS) vulnerability in rates.php in Real Time Currency Exchange allows remote attackers to inject arbitrary web script or HTML via the Amount parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/rtce-xss.txt; http://secunia.com/advisories/35936; http://www.osvdb.org/56081
CVE: CVE-2009-4716
Published: 2010-03-15
Description: Cross-site scripting (XSS) vulnerability in results.php in EDGEPHP EZWebSearch allows remote attackers to inject arbitrary web script or HTML via the language parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/ezwebsearch-xss.txt; http://secunia.com/advisories/35922; http://www.osvdb.org/56082
CVE: CVE-2009-4717
Published: 2010-03-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the (1) host parameter to stat/host.php, nodayshow parameter to (2) mostvisitpage.php and (3) visitorduration.php in stat/, (4) nopagesmost parameter to stat/mostvisitpagechart.php, and date parameter to (5) pageviewers.php, (6) pageviewerschart.php, and (7) referer.php in stat/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/webstatcaffe-xss.txt; http://secunia.com/advisories/36068; http://packetstormsecurity.org/0907-exploits/webstatcaffe-xss.txt
CVE: CVE-2009-4718
Published: 2010-03-15
Description: SQL injection vulnerability in visitorduration.php in Gonafish WebStatCaffe allows remote attackers to execute arbitrary SQL commands via the nodayshow parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36068; http://secunia.com/advisories/36068
CVE: CVE-2010-0963
Published: 2010-03-16
Description: Cross-site scripting (XSS) vulnerability in index.php in dl Download Ticket Service before 0.7 allows remote attackers to inject arbitrary web script or HTML via the t parameter, related to an invalid ticket ID.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://article.gmane.org/gmane.comp.web.dl-ticket-service.general/33; http://freshmeat.net/projects/dl-ticket-service; http://osvdb.org/62884
CVE: CVE-2010-0964
Published: 2010-03-16
Description: SQL injection vulnerability in start.php in Eros Webkatalog allows remote attackers to execute arbitrary SQL commands via the id parameter in a rubrik action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://4004securityproject.wordpress.com/2010/03/11/eros-erotik-webkatalog-start-php-rubrikidsql-injection/; http://osvdb.org/62902; http://packetstormsecurity.org/1003-exploits/eroserotikwebkat-sql.txt
CVE: CVE-2010-0965
Published: 2010-03-16
Description: Jevci Siparis Formu Scripti stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for siparis.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/62843; http://packetstormsecurity.org/1003-exploits/jevci-disclose.txt; http://secunia.com/advisories/38893
CVE: CVE-2010-0966
Published: 2010-03-16
Description: PHP remote file inclusion vulnerability in inc/config.php in deV!L`z Clanportal (DZCP) 1.5.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/38902; http://www.exploit-db.com/exploits/11735; http://www.vupen.com/english/advisories/2010/0615
CVE: CVE-2010-0967
Published: 2010-03-16
Description: Multiple directory traversal vulnerabilities in Geekhelps ADMP 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the style parameter to (1) colorvoid/footer.php, (2) default-green/footer.php, (3) default-orange/footer.php, and (4) default/footer.php in themes/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/62915; http://osvdb.org/62916; http://osvdb.org/62917
CVE: CVE-2010-0968
Published: 2010-03-16
Description: SQL injection vulnerability in bannershow.php in Geekhelps ADMP 1.01 allows remote attackers to execute arbitrary SQL commands via the click parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/11721; http://www.vupen.com/english/advisories/2010/0612; http://www.exploit-db.com/exploits/11721
CVE: CVE-2010-0969
Published: 2010-03-16
Description: Unbound before 1.4.3 does not properly align structures on 64-bit platforms, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.gentoo.org/show_bug.cgi?id=309117; http://marc.info/?l=oss-security&m=[PII_REDACTED]1747&w=2; http://osvdb.org/62903
CVE: CVE-2010-0970
Published: 2010-03-16
Description: SQL injection vulnerability in phpmylogon.php in PhpMyLogon 2 allows remote attackers to execute arbitrary SQL commands via the username parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/11737; http://www.vupen.com/english/advisories/2010/0614; https://exchange.xforce.ibmcloud.com/vulnerabilities/56868
CVE: CVE-2010-0971
Published: 2010-03-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.6.4 allow remote authenticated users, with Instructor privileges, to inject arbitrary web script or HTML via the (1) Question and (2) Choice fields in tools/polls/add.php, the (3) Type and (4) Title fields in tools/groups/create_manual.php, and the (5) Title field in assignments/add_assignment.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://osvdb.org/62904; http://osvdb.org/62905; http://osvdb.org/62906
CVE: CVE-2010-0972
Published: 2010-03-16
Description: Directory traversal vulnerability in the GCalendar (com_gcalendar) component 2.1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/38925; http://www.exploit-db.com/exploits/11738; https://exchange.xforce.ibmcloud.com/vulnerabilities/56863