deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-0407
Published: 2011-01-11
Description: SQL injection vulnerability in the store function in _phenotype/system/class/PhenoTypeDataObject.class.php in Phenotype CMS 3.0 allows remote attackers to execute arbitrary SQL commands via a crafted URI, as demonstrated by Gallery/gal_id/1/image1,1.html.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/70308; http://secunia.com/advisories/42837; http://www.htbridge.ch/advisory/sql_injection_in_phenotype_cms.html
CVE: CVE-2010-3676
Published: 2011-01-11
Description: storage/innobase/dict/dict0crea.c in mysqld in Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (assertion failure) by modifying the (1) innodb_file_format or (2) innodb_file_per_table configuration parameters for the InnoDB storage engine, then executing a DDL statement.
CVSS Score: 4.0 (MEDIUM)
References: http://bugs.mysql.com/bug.php?id=55039; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html; http://www.mandriva.com/security/advisories?name=MDVSA-2011:012
CVE: CVE-2010-3677
Published: 2011-01-11
Description: Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a join query that uses a table with a unique SET column.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.mysql.com/bug.php?id=54575; http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
CVE: CVE-2010-3678
Published: 2011-01-11
Description: Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (crash) via (1) IN or (2) CASE operations with NULL arguments that are explicitly specified or indirectly provided by the WITH ROLLUP modifier.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.mysql.com/bug.php?id=54477; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
CVE: CVE-2010-3679
Published: 2011-01-11
Description: Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via certain arguments to the BINLOG command, which triggers an access of uninitialized memory, as demonstrated by valgrind.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.mysql.com/bug.php?id=54393; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html; http://secunia.com/advisories/42936
CVE: CVE-2010-3680
Published: 2011-01-11
Description: Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by creating temporary tables with nullable columns while using InnoDB, which triggers an assertion failure.
CVSS Score: 4.0 (MEDIUM)
References: http://bugs.mysql.com/bug.php?id=54044; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html; http://secunia.com/advisories/42875
CVE: CVE-2010-3681
Published: 2011-01-11
Description: Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using the HANDLER interface and performing "alternate reads from two indexes on a table," which triggers an assertion failure.
CVSS Score: 4.0 (MEDIUM)
References: http://bugs.mysql.com/bug.php?id=54007; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html; http://dev.mysql.com/doc/refman/5.5/en/news-5-5-5.html
CVE: CVE-2010-3682
Published: 2011-01-11
Description: Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using EXPLAIN with crafted "SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...)" statements, which triggers a NULL pointer dereference in the Item_singlerow_subselect::store function.
CVSS Score: 4.0 (MEDIUM)
References: http://bugs.mysql.com/bug.php?id=52711; http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
CVE: CVE-2010-3683
Published: 2011-01-11
Description: Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 sends an OK packet when a LOAD DATA INFILE request generates SQL errors, which allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a crafted request.
CVSS Score: 4.0 (MEDIUM)
References: http://bugs.mysql.com/bug.php?id=52512; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html; http://dev.mysql.com/doc/refman/5.5/en/news-5-5-5.html
CVE: CVE-2010-0214
Published: 2011-01-12
Description: The administrative interface on the PolyVision RoomWizard with firmware 3.2.3 places the Sync Connector Active Directory (AD) credentials in a web form that is accessed over HTTP on port 80, which allows remote attackers to obtain sensitive information by reading the HTML source code corresponding to the /admin/sign/DeviceSynch URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.org/files/view/97291/roomwizard-disclose.txt; http://seclists.org/fulldisclosure/2011/Jan/58; http://www.kb.cert.org/vuls/id/870601
CVE: CVE-2010-3926
Published: 2011-01-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Shop.cgi in SGX-SP Final before 11.00 and SGX-SP Final NE before 11.00 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN86347943/index.html; http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000002.html; http://osvdb.org/70410
CVE: CVE-2011-0026
Published: 2011-01-12
Description: Integer signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, allows remote attackers to execute arbitrary code via a long string in the Data Source Name (DSN) and a crafted szDSN argument, which bypasses a signed comparison and leads to a buffer overflow, aka "DSN Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://osvdb.org/70443; http://secunia.com/advisories/42804; http://support.avaya.com/css/P8/documents/100124846
CVE: CVE-2011-0027
Published: 2011-01-12
Description: Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, does not properly validate memory allocation for internal data structures, which allows remote attackers to execute arbitrary code, possibly via a large CacheSize property that triggers an integer wrap and a buffer overflow, aka "ADO Record Memory Vulnerability."  NOTE: this might be a duplicate of CVE-2010-1117 or CVE-2010-1118.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://osvdb.org/70444; http://secunia.com/advisories/42804; http://support.avaya.com/css/P8/documents/100124846
CVE: CVE-2011-0314
Published: 2011-01-12
Description: Heap-based buffer overflow in IBM WebSphere MQ 6.0 before 6.0.2.11 and 7.0 before 7.0.1.5 allows remote authenticated users to execute arbitrary code or cause a denial of service (queue manager crash) by inserting an invalid message into the queue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/42941; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ81294; http://www.securityfocus.com/bid/45801
CVE: CVE-2011-0315
Published: 2011-01-12
Description: Cross-site scripting (XSS) vulnerability in the Servlet Engine / Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.15 allows remote attackers to inject arbitrary web script or HTML via vectors related to the lack of an error page for an application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/42938; http://www-01.ibm.com/support/docview.wss?uid=swg1PM18512; http://www-01.ibm.com/support/docview.wss?uid=swg27007951
CVE: CVE-2011-0316
Published: 2011-01-12
Description: The Administrative Console component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.15 does not properly restrict access to console servlets, which allows remote attackers to obtain potentially sensitive status information via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/42938; http://www-01.ibm.com/support/docview.wss?uid=swg1PM24372; http://www-01.ibm.com/support/docview.wss?uid=swg27007951
CVE: CVE-2011-0423
Published: 2011-01-12
Description: The PolyVision RoomWizard with firmware 3.2.3 has a default password of roomwizard for the administrator account, which makes it easier for remote attackers to obtain console access via an HTTP session, a different vulnerability than CVE-2010-0214.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://osvdb.org/70388; http://packetstormsecurity.org/files/view/97291/roomwizard-disclose.txt; http://seclists.org/fulldisclosure/2011/Jan/58
CVE: CVE-2010-2599
Published: 2011-01-13
Description: Unspecified vulnerability in Research In Motion (RIM) BlackBerry Device Software before 6.0.0 allows remote attackers to cause a denial of service (browser hang) via a crafted web page.
CVSS Score: 4.3 (MEDIUM)
References: http://blog.tehtri-security.com/2011/01/blackhat-dc-2011-inglourious-hackerds.html; http://osvdb.org/70404; http://www.blackberry.com/btsc/KB24841
CVE: CVE-2010-2604
Published: 2011-01-13
Description: Multiple buffer overflows in the PDF Distiller in the BlackBerry Attachment Service component in Research In Motion (RIM) BlackBerry Enterprise Server 4.1.3 through 5.0.2, and Enterprise Server Express 5.0.1 and 5.0.2, allow remote attackers to execute arbitrary code via a crafted PDF file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/70393; http://secunia.com/advisories/42882; http://www.blackberry.com/btsc/KB25382
CVE: CVE-2010-3912
Published: 2011-01-13
Description: The supportconfig script in supportutils in SUSE Linux Enterprise 11 SP1 and 10 SP3 does not "disguise passwords" in configuration files, which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html; http://osvdb.org/70405; http://secunia.com/advisories/42877
CVE: CVE-2011-0443
Published: 2011-01-13
Description: SQL injection vulnerability in inc/tinybb-settings.php in tinyBB 1.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/70394; http://secunia.com/advisories/42854; http://tinybb.net/forum/?page=thread&post=989525101
CVE: CVE-2011-0444
Published: 2011-01-13
Description: Buffer overflow in the MAC-LTE dissector (epan/dissectors/packet-mac-lte.c) in Wireshark 1.2.0 through 1.2.13 and 1.4.0 through 1.4.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of RARs.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053650.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053669.html; http://osvdb.org/70403
CVE: CVE-2011-0445
Published: 2011-01-13
Description: The ASN.1 BER dissector in Wireshark 1.4.0 through 1.4.2 allows remote attackers to cause a denial of service (assertion failure) via crafted packets, as demonstrated by fuzz-2010-12-30-28473.pcap.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053650.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053669.html; http://osvdb.org/70402
CVE: CVE-2008-7271
Published: 2011-01-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE, possibly 3.3.2, allow remote attackers to inject arbitrary web script or HTML via (1) the searchWord parameter to help/advanced/searchView.jsp or (2) the workingSet parameter in an add action to help/advanced/workingSetManager.jsp, a different issue than CVE-2010-4647.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://r00tin.blogspot.com/2008/04/eclipse-local-web-server-exploitation.html; https://bugs.eclipse.org/bugs/show_bug.cgi?id=223539; http://r00tin.blogspot.com/2008/04/eclipse-local-web-server-exploitation.html
CVE: CVE-2010-3924
Published: 2011-01-13
Description: SQL injection vulnerability in Aimluck Aipo before 5.1.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN50704770/91216/index.html; http://jvn.jp/en/jp/JVN50704770/index.html; http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000003.html
CVE: CVE-2010-3925
Published: 2011-01-13
Description: Contents-Mall before 15 does not properly handle passwords, which allows remote attackers to discover the administrative password, and consequently obtain sensitive information or modify data, via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-255
References: http://jvn.jp/en/jp/JVN53293565/index.html; http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000001.html; http://mag.wb-i.net/2010_05_07.html
CVE: CVE-2010-4051
Published: 2011-01-13
Description: The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a "RE_DUP_MAX overflow."
CVSS Score: 5.0 (MEDIUM)
References: http://cxib.net/stuff/proftpd.gnu.c; http://seclists.org/fulldisclosure/2011/Jan/78; http://secunia.com/advisories/42547
CVE: CVE-2010-4052
Published: 2011-01-13
Description: Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://cxib.net/stuff/proftpd.gnu.c; http://seclists.org/fulldisclosure/2011/Jan/78; http://secunia.com/advisories/42547
CVE: CVE-2010-4527
Published: 2011-01-13
Description: The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel before 2.6.37 incorrectly expects that a certain name field ends with a '\0' character, which allows local users to conduct buffer overflow attacks and gain privileges, or possibly obtain sensitive information from kernel memory, via a SOUND_MIXER_SETLEVELS ioctl call.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-120
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d81a12bc29ae4038770e05dce4ab7f26fd5880fb; http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.html; http://openwall.com/lists/oss-security/2010/12/31/1
CVE: CVE-2010-4529
Published: 2011-01-13
Description: Integer underflow in the irda_getsockopt function in net/irda/af_irda.c in the Linux kernel before 2.6.37 on platforms other than x86 allows local users to obtain potentially sensitive information from kernel heap memory via an IRLMP_ENUMDEVICES getsockopt call.
CVSS Score: 2.1 (LOW)
CWE: CWE-191
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fdac1e0697356ac212259f2147aa60c72e334861; http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.html; http://openwall.com/lists/oss-security/2010/12/23/1
CVE: CVE-2010-4537
Published: 2011-01-13
Description: Unspecified vulnerability in CrawlTrack before 3.2.7, when a public stats page is provided, allows remote attackers to execute arbitrary PHP code via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://openwall.com/lists/oss-security/2010/12/31/3; http://openwall.com/lists/oss-security/2011/01/03/7; http://www.crawltrack.net/changelog.php
CVE: CVE-2010-4647
Published: 2011-01-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE before 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) help/index.jsp or (2) help/advanced/content.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052532.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052554.html; http://openwall.com/lists/oss-security/2011/01/06/16
CVE: CVE-2011-0261
Published: 2011-01-13
Description: Unspecified vulnerability in jovgraph.exe in jovgraph in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a malformed displayWidth option in the arg parameter.
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/archive/1/515628; http://www.securityfocus.com/bid/45762; http://www.securitytracker.com/id?1024951
CVE: CVE-2011-0262
Published: 2011-01-13
Description: Buffer overflow in the stringToSeconds function in ovutil.dll in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via large values of variables to jovgraph.exe.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/515628; http://www.securityfocus.com/bid/45762; http://www.securitytracker.com/id?1024951
CVE: CVE-2011-0263
Published: 2011-01-13
Description: Multiple stack-based buffer overflows in ovas.exe in the OVAS service in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allow remote attackers to execute arbitrary code via a long (1) Source Node or (2) Destination Node variable.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/515628; http://www.securityfocus.com/bid/45762; http://www.securitytracker.com/id?1024951
CVE: CVE-2011-0264
Published: 2011-01-13
Description: Stack-based buffer overflow in ovutil.dll in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long COOKIE variable.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/515628; http://www.securityfocus.com/bid/45762; http://www.securitytracker.com/id?1024951
CVE: CVE-2011-0265
Published: 2011-01-13
Description: Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long data_select1 parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/515628; http://www.securityfocus.com/bid/45762; http://www.securitytracker.com/id?1024951
CVE: CVE-2011-0266
Published: 2011-01-13
Description: Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long nameParams parameter, a different vulnerability than CVE-2011-0267.2.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/8151; http://www.securityfocus.com/archive/1/515628; http://www.securityfocus.com/bid/45762
CVE: CVE-2011-0267
Published: 2011-01-13
Description: Multiple buffer overflows in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allow remote attackers to execute arbitrary code via a long (1) schdParams or (2) nameParams parameter, a different vulnerability than CVE-2011-0266.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/8156; http://www.exploit-db.com/exploits/17038; http://www.securityfocus.com/archive/1/515628
CVE: CVE-2011-0268
Published: 2011-01-13
Description: Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long text1 parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/515628; http://www.securityfocus.com/bid/45762; http://www.securitytracker.com/id?1024951
CVE: CVE-2011-0269
Published: 2011-01-13
Description: Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long schd_select1 parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/515628; http://www.securityfocus.com/bid/45762; http://www.securitytracker.com/id?1024951
CVE: CVE-2011-0270
Published: 2011-01-13
Description: Format string vulnerability in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via format string specifiers in input data that involves an invalid template name.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://osvdb.org/70474; http://www.securityfocus.com/archive/1/515628; http://www.securityfocus.com/bid/45762
CVE: CVE-2011-0271
Published: 2011-01-13
Description: The CGI scripts in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 do not properly validate an unspecified parameter, which allows remote attackers to execute arbitrary commands by using a command string for this parameter's value, related to a "command injection vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=887; http://www.securityfocus.com/archive/1/515628; http://www.securityfocus.com/bid/45762
CVE: CVE-2011-0310
Published: 2011-01-13
Description: Buffer overflow in IBM WebSphere MQ 7.0 before 7.0.1.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted header field in a message.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/70476; http://secunia.com/advisories/42958; http://www-01.ibm.com/support/docview.wss?uid=swg27014224
CVE: CVE-2010-4334
Published: 2011-01-14
Description: The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606058; http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.35/Changes; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052594.html
CVE: CVE-2009-5018
Published: 2011-01-14
Description: Stack-based buffer overflow in gif2png.c in gif2png 2.5.3 and earlier might allow context-dependent attackers to execute arbitrary code via a long command-line argument, as demonstrated by a CGI program that launches gif2png.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550978; http://bugs.gentoo.org/show_bug.cgi?id=346501; http://cvs.fedoraproject.org/viewvc/rpms/gif2png/devel/gif2png-overflow.patch?root=extras&view=log
CVE: CVE-2011-0470
Published: 2011-01-14
Description: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle extensions notification, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=58053; http://googlechromereleases.blogspot.com/2011/01/chrome-stable-release.html; http://osvdb.org/70453