deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-0633
Published: 2010-02-12
Description: Unspecified vulnerability in Citrix XenServer 5.0 Update 3 and earlier, and 5.5, allows local users to bypass authentication and execute unspecified Xen API (XAPI) calls via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/38431; http://support.citrix.com/article/CTX123193; http://support.citrix.com/article/CTX123456
CVE: CVE-2010-0634
Published: 2010-02-12
Description: Unspecified vulnerability in Fast Lexical Analyzer Generator (flex) before 2.5.35 has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://freshmeat.net/projects/flex/releases/311661; http://osvdb.org/62029; http://freshmeat.net/projects/flex/releases/311661
CVE: CVE-2010-0635
Published: 2010-02-12
Description: SQL injection vulnerability in the plgSearchEventsearch::onSearch method in eventsearch.php in the JEvents Search plugin 1.5 through 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/38404; http://www.jevents.net/forum/viewtopic.php?f=17&t=3910#p15526; http://www.securityfocus.com/bid/38050
CVE: CVE-2010-0636
Published: 2010-02-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to inject arbitrary web script or HTML via the (1) tab parameter to users.php and the PATH_INFO to (2) day.php, (3) month.php, and (4) week.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/133/45/; http://secunia.com/advisories/38222; http://webcalendar.cvs.sourceforge.net/viewvc/webcalendar/webcalendar/ChangeLog?pathrev=REL_1_2
CVE: CVE-2010-0637
Published: 2010-02-12
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to hijack the authentication of administrators for requests that (1) delete an event or (2) ban an IP address from posting via unknown vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://holisticinfosec.org/content/view/133/45/; http://secunia.com/advisories/38222; http://webcalendar.cvs.sourceforge.net/viewvc/webcalendar/webcalendar/ChangeLog?pathrev=REL_1_2
CVE: CVE-2009-3960
Published: 2010-02-15
Description: Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/38543; http://securitytracker.com/id?1023584; http://www.adobe.com/support/security/bulletins/apsb10-05.html
CVE: CVE-2009-4643
Published: 2010-02-15
Description: Stack-based buffer overflow in dsInstallerService.dll in the Juniper Installer Service, as used in Juniper Odyssey Access Client 4.72.11421.0 and other products, allows remote attackers to execute arbitrary code via a long string in a malformed DSSETUPSERVICE_CMD_UNINSTALL command to the NeoterisSetupService named pipe.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=850; https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2009-10-540&viewMode=view; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=850
CVE: CVE-2010-0186
Published: 2010-02-15
Description: Cross-domain vulnerability in Adobe Flash Player before 10.0.45.2, Adobe AIR before 1.5.3.9130, and Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows remote attackers to bypass intended sandbox restrictions and make cross-domain requests via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html; http://secunia.com/advisories/38547
CVE: CVE-2010-0187
Published: 2010-02-15
Description: Adobe Flash Player before 10.0.45.2 and Adobe AIR before 1.5.3.9130 allow remote attackers to cause a denial of service (application crash) via a modified SWF file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html; http://sebug.net/exploit/18967/
CVE: CVE-2010-0287
Published: 2010-02-15
Description: Directory traversal vulnerability in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to list the contents of arbitrary directories via a .. (dot dot) in the ns parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://bugs.splitbrain.org/index.php?do=details&task_id=1847; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034729.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034831.html
CVE: CVE-2010-0288
Published: 2010-02-15
Description: A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://bugs.splitbrain.org/index.php?do=details&task_id=1847; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034729.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034831.html
CVE: CVE-2010-0289
Published: 2010-02-15
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25c allow remote attackers to hijack the authentication of administrators for requests that modify access control rules, and other unspecified requests, via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://bugs.splitbrain.org/index.php?do=details&task_id=1853; http://freshmeat.net/projects/dokuwiki/tags/security-fix; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034729.html
CVE: CVE-2010-0291
Published: 2010-02-15
Description: The Linux kernel before 2.6.32.4 allows local users to gain privileges or cause a denial of service (panic) by calling the (1) mmap or (2) mremap function, aka the "do_mremap() mess" or "mremap/mmap mess."
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0067bd8a55862ac9dd212bd1c4f6f5bff1ca1301; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=05d72faa6d13c9d857478a5d35c85db9adada685; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=097eed103862f9c6a97f2e415e21d1134017b135
CVE: CVE-2010-0622
Published: 2010-02-15
Description: The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification of the futex value from user space.
CVSS Score: 2.1 (LOW)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=51246bfd189064079c[PII_REDACTED]6fd2723b18f3; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035070.html; http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00000.html
CVE: CVE-2010-0623
Published: 2010-02-15
Description: The futex_lock_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly manage a certain reference count, which allows local users to cause a denial of service (OOPS) via vectors involving an unmount of an ext3 filesystem.
CVSS Score: 4.9 (MEDIUM)
References: http://bugzilla.kernel.org/show_bug.cgi?id=14256; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5ecb01cfdf96c5f465192bdb2a4fd4a61a24c6cc; http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00006.html
CVE: CVE-2010-0638
Published: 2010-02-15
Description: Cross-site request forgery (CSRF) vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/38222; http://secunia.com/advisories/38222
CVE: CVE-2010-0639
Published: 2010-02-15
Description: The htcpHandleTstRequest function in htcp.c in Squid 2.x before 2.6.STABLE24 and 2.7 before 2.7.STABLE8, and htcp.cc in 3.0 before 3.0.STABLE24, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets to the HTCP port.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.squid-cache.org/show_bug.cgi?id=2858; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035961.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037159.html
CVE: CVE-2009-2949
Published: 2010-02-16
Description: Integer overflow in the XPMReader::ReadXPM function in filter.vcl/ixpm/svt_xpmread.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to execute arbitrary code via a crafted XPM file that triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html; http://secunia.com/advisories/38567; http://secunia.com/advisories/38568
CVE: CVE-2009-2950
Published: 2010-02-16
Description: Heap-based buffer overflow in the GIFLZWDecompressor::GIFLZWDecompressor function in filter.vcl/lgif/decode.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file, related to LZW decompression.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html; http://secunia.com/advisories/38567; http://secunia.com/advisories/38568
CVE: CVE-2009-3301
Published: 2010-02-16
Description: Integer underflow in filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTDefTable table property modifier in a Word document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-191
References: http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html; http://secunia.com/advisories/38567; http://secunia.com/advisories/38568
CVE: CVE-2009-3302
Published: 2010-02-16
Description: filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTSetBrc table property modifier in a Word document, related to a "boundary error flaw."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html; http://secunia.com/advisories/38567; http://secunia.com/advisories/38568
CVE: CVE-2010-0136
Published: 2010-02-16
Description: OpenOffice.org (OOo) 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-77
References: http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html; http://secunia.com/advisories/38695; http://secunia.com/advisories/38921
CVE: CVE-2010-0307
Published: 2010-02-17
Description: The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform does not ensure that the ELF interpreter is available before a call to the SET_PERSONALITY macro, which allows local users to cause a denial of service (system crash) via a 32-bit application that attempts to execute a 64-bit application and then triggers a segmentation fault, as demonstrated by amd64_killer, related to the flush_old_exec function.
CVSS Score: 4.7 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=221af7f87b97431e3ee21ce4b0e77d5411cf1549; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035159.html; http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00000.html
CVE: CVE-2010-0415
Published: 2010-02-17
Description: The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel's node set.
CVSS Score: 4.6 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6f5a55f1a6c5abee15a0e878e5c74d9f1569b8b0; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035070.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035159.html
CVE: CVE-2010-0641
Published: 2010-02-17
Description: Cross-site scripting (XSS) vulnerability in webline/html/admin/wcs/LoginPage.jhtml in Cisco Collaboration Server (CCS) 5 allows remote attackers to inject arbitrary web script or HTML via the dest parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/11403; http://www.securityfocus.com/bid/38201; https://exchange.xforce.ibmcloud.com/vulnerabilities/56220
CVE: CVE-2010-0642
Published: 2010-02-17
Description: Cisco Collaboration Server (CCS) 5 allows remote attackers to read the source code of JHTML files via URL encoded characters in the filename extension, as demonstrated by (1) changing .jhtml to %2Ejhtml, (2) changing .jhtml to .jhtm%6C, (3) appending %00 after .jhtml, and (4) appending %c0%80 after .jhtml, related to the (a) doc/docindex.jhtml, (b) browserId/wizardForm.jhtml, (c) webline/html/forms/callback.jhtml, (d) webline/html/forms/callbackICM.jhtml, (e) webline/html/agent/AgentFrame.jhtml, (f) webline/html/agent/default/badlogin.jhtml, (g) callme/callForm.jhtml, (h) webline/html/multichatui/nowDefunctWindow.jhtml, (i) browserId/wizard.jhtml, (j) admin/CiscoAdmin.jhtml, (k) msccallme/mscCallForm.jhtml, and (l) webline/html/admin/wcs/LoginPage.jhtml components.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.exploit-db.com/exploits/11403; http://www.securityfocus.com/bid/38202; https://exchange.xforce.ibmcloud.com/vulnerabilities/56221
CVE: CVE-2010-0556
Published: 2010-02-18
Description: browser/login/login_prompt.cc in Google Chrome before 4.0.249.89 populates an authentication dialog with credentials that were stored by Password Manager for a different web site, which allows user-assisted remote HTTP servers to obtain sensitive information via a URL that requires authentication, as demonstrated by a URL in the SRC attribute of an IMG element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://code.google.com/p/chromium/issues/detail?id=32718; http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html; http://secunia.com/advisories/38545
CVE: CVE-2010-0643
Published: 2010-02-18
Description: Google Chrome before 4.0.249.89 attempts to make direct connections to web sites when all configured proxy servers are unavailable, which allows remote HTTP servers to obtain potentially sensitive information about the identity of a client user via standard HTTP logging, as demonstrated by a proxy server that was configured for the purpose of anonymity.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=12303; http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html; http://secunia.com/advisories/38545
CVE: CVE-2010-0644
Published: 2010-02-18
Description: Google Chrome before 4.0.249.89, when a SOCKS 5 proxy server is configured, sends DNS queries directly, which allows remote DNS servers to obtain potentially sensitive information about the identity of a client user via request logging, as demonstrated by a proxy server that was configured for the purpose of anonymity.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=29914; http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html; http://secunia.com/advisories/38545
CVE: CVE-2010-0645
Published: 2010-02-18
Description: Multiple integer overflows in factory.cc in Google V8 before r3560, as used in Google Chrome before 4.0.249.89, allow remote attackers to execute arbitrary code in the Chrome sandbox via crafted use of JavaScript arrays.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://code.google.com/p/chromium/issues/detail?id=31009; http://code.google.com/p/v8/source/detail?r=3560; http://codereview.chromium.org/525064
CVE: CVE-2010-0646
Published: 2010-02-18
Description: Multiple integer signedness errors in factory.cc in Google V8 before r3560, as used in Google Chrome before 4.0.249.89, allow remote attackers to execute arbitrary code in the Chrome sandbox via crafted use of JavaScript arrays.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://code.google.com/p/chromium/issues/detail?id=31009; http://code.google.com/p/v8/source/detail?r=3560; http://codereview.chromium.org/525064
CVE: CVE-2010-0647
Published: 2010-02-18
Description: WebKit before r53525, as used in Google Chrome before 4.0.249.89, allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed RUBY element, as demonstrated by a <ruby>><table><rt> sequence.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://code.google.com/p/chromium/issues/detail?id=31692; http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-0648
Published: 2010-02-18
Description: Mozilla Firefox, possibly before 3.6, allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value, related to an IFRAME element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=32309; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041432.html
CVE: CVE-2010-0649
Published: 2010-02-18
Description: Integer overflow in the CrossCallParamsEx::CreateFromBuffer function in sandbox/src/crosscall_server.cc in Google Chrome before 4.0.249.89 allows attackers to leverage renderer access to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a malformed message, related to deserializing of sandbox messages.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://code.google.com/p/chromium/issues/detail?id=32915; http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html; http://secunia.com/advisories/38545
CVE: CVE-2010-0650
Published: 2010-02-18
Description: WebKit, as used in Google Chrome before 4.0.249.78 and Apple Safari, allows remote attackers to bypass intended restrictions on popup windows via crafted use of a mouse click event.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://code.google.com/p/chromium/issues/detail?id=3275; http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-0651
Published: 2010-02-18
Description: WebKit before r52784, as used in Google Chrome before 4.0.249.78 and Apple Safari before 4.0.5, permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=9877; http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-0652
Published: 2010-02-18
Description: Microsoft Internet Explorer permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote HTTP servers to obtain sensitive information via a crafted document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=9877; http://code.google.com/p/chromium/issues/detail?id=9877
CVE: CVE-2010-0653
Published: 2010-02-18
Description: Opera before 10.10 permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=9877; http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html; http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html
CVE: CVE-2010-0654
Published: 2010-02-18
Description: Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 permit cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=9877; http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html; http://websec.sv.cmu.edu/css/css.pdf
CVE: CVE-2010-0655
Published: 2010-02-18
Description: Use-after-free vulnerability in Google Chrome before 4.0.249.78 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving the display of a blocked popup window during navigation to a different web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=12523; http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html; http://secunia.com/secunia_research/2009-65/
CVE: CVE-2010-0656
Published: 2010-02-18
Description: WebKit before r51295, as used in Google Chrome before 4.0.249.78, presents a directory-listing page in response to an XMLHttpRequest for a file:/// URL that corresponds to a directory, which allows attackers to obtain sensitive information or possibly have unspecified other impact via a crafted local HTML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=20450; http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html