deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-4209
Published: 2010-11-07
Description: Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.8.1, as used in Bugzilla 3.7.1 through 3.7.3 and 4.1, allows remote attackers to inject arbitrary web script or HTML via vectors related to swfstore/swfstore.swf.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050813.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050820.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050830.html
CVE: CVE-2010-3436
Published: 2010-11-09
Description: fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to bypass open_basedir restrictions via vectors related to the length of a filename.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://secunia.com/advisories/42729
CVE: CVE-2010-3709
Published: 2010-11-09
Description: The ZipArchive::getArchiveComment function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ZIP archive.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html
CVE: CVE-2010-4211
Published: 2010-11-09
Description: The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate.
CVSS Score: 2.9 (LOW)
CWE: CWE-287
References: http://itunes.apple.com/us/app/paypal/id283646709; http://news.cnet.com/8301-27080_3-20021730-245.html; http://online.wsj.com/article/SB[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED].html
CVE: CVE-2010-4212
Published: 2010-11-09
Description: The USAA application 3.0 for Android stores a mirror image of each visited web page, which might allow physically proximate attackers to obtain sensitive banking information by reading application data.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://news.cnet.com/8301-27080_3-20021874-245.html; http://online.wsj.com/article/SB[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED].html; http://viaforensics.com/appwatchdog/usaa-android.html
CVE: CVE-2010-4213
Published: 2010-11-09
Description: The Bank of America application 2.12 for Android stores a security question's answer in cleartext, which might allow physically proximate attackers to obtain sensitive information by reading application data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://news.cnet.com/8301-27080_3-20021874-245.html; http://online.wsj.com/article/SB[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED].html; http://viaforensics.com/appwatchdog/bank-of-america-android.html
CVE: CVE-2010-4214
Published: 2010-11-09
Description: The Wells Fargo Mobile application 1.1 for Android stores a username and password, along with account balances, in cleartext, which might allow physically proximate attackers to obtain sensitive information by reading application data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://news.cnet.com/8301-27080_3-20021874-245.html; http://online.wsj.com/article/SB[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED].html; http://viaforensics.com/appwatchdog/wells-fargo-android.html
CVE: CVE-2008-7265
Published: 2010-11-09
Description: The pr_data_xfer function in ProFTPD before 1.3.2rc3 allows remote authenticated users to cause a denial of service (CPU consumption) via an ABOR command during a data transfer.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.proftpd.org/show_bug.cgi?id=3131; http://www.debian.org/security/2011/dsa-2191; http://bugs.proftpd.org/show_bug.cgi?id=3131
CVE: CVE-2010-0783
Published: 2010-11-09
Description: Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41722; http://secunia.com/advisories/42136; http://securitytracker.com/id?1024686
CVE: CVE-2010-0784
Published: 2010-11-09
Description: Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41722; http://www-01.ibm.com/support/docview.wss?uid=swg1PM17046; http://www-01.ibm.com/support/docview.wss?uid=swg1PM23872
CVE: CVE-2010-0785
Published: 2010-11-09
Description: Cross-site request forgery (CSRF) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.13 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/41722; http://www-01.ibm.com/support/docview.wss?uid=swg1PM18909; http://www-01.ibm.com/support/docview.wss?uid=swg1PM23874
CVE: CVE-2010-0786
Published: 2010-11-09
Description: The Web Services Security component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.13 does not properly implement the Java API for XML Web Services (aka JAX-WS), which allows remote attackers to cause a denial of service (data corruption) via a crafted JAX-WS request that leads to incorrectly encoded data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM13777; http://www-01.ibm.com/support/docview.wss?uid=swg27014463; https://exchange.xforce.ibmcloud.com/vulnerabilities/62950
CVE: CVE-2010-2635
Published: 2010-11-09
Description: SQL injection vulnerability in IBM WebSphere Commerce 6.0 before 6.0.0.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified parameters to "Commerce Organization Admin Console JavaServer pages."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IZ73130; https://exchange.xforce.ibmcloud.com/vulnerabilities/62951; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ73130
CVE: CVE-2010-2636
Published: 2010-11-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in sample store pages in IBM WebSphere Commerce 7.0 before 7.0.0.1 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR35424; https://exchange.xforce.ibmcloud.com/vulnerabilities/62952; http://www-01.ibm.com/support/docview.wss?uid=swg1JR35424
CVE: CVE-2010-3039
Published: 2010-11-09
Description: /usr/local/cm/bin/pktCap_protectData in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6, 7, and 8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in a request to the administrative interface, aka Bug IDs CSCti52041 and CSCti74930.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: http://seclists.org/fulldisclosure/2010/Nov/40; http://secunia.com/advisories/42129; http://tools.cisco.com/security/center/viewAlert.x?alertId=21656
CVE: CVE-2010-3040
Published: 2010-11-09
Description: Multiple stack-based buffer overflows in agent.exe in Setup Manager in Cisco Intelligent Contact Manager (ICM) before 7.0 allow remote attackers to execute arbitrary code via a long parameter in a (1) HandleUpgradeAll, (2) AgentUpgrade, (3) HandleQueryNodeInfoReq, or (4) HandleUpgradeTrace TCP packet, aka Bug IDs CSCti45698, CSCti45715, CSCti45726, and CSCti46164.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/42146; http://securitytracker.com/id?1024693; http://tools.cisco.com/security/center/viewAlert.x?alertId=21726
CVE: CVE-2010-3077
Published: 2010-11-09
Description: Cross-site scripting (XSS) vulnerability in util/icon_browser.php in the Horde Application Framework before 3.3.9 allows remote attackers to inject arbitrary web script or HTML via the subdir parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.horde.org/diff.php/horde/util/icon_browser.php?rt=horde-git&r1=a978a35c3e95e784253508fd4333d2fbb64830b6&r2=9342addbd2b95f184f230773daa4faf5ef6d65e9; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050408.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050423.html
CVE: CVE-2010-3694
Published: 2010-11-09
Description: Cross-site request forgery (CSRF) vulnerability in the Horde Application Framework before 3.3.9 allows remote attackers to hijack the authentication of unspecified victims for requests to a preference form.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050408.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050423.html; http://lists.horde.org/archives/announce/2010/000557.html
CVE: CVE-2010-3867
Published: 2010-11-09
Description: Multiple directory traversal vulnerabilities in the mod_site_misc module in ProFTPD before 1.3.3c allow remote authenticated users to create directories, delete directories, create symlinks, and modify file timestamps via directory traversal sequences in a (1) SITE MKDIR, (2) SITE RMDIR, (3) SITE SYMLINK, or (4) SITE UTIME command.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: http://bugs.proftpd.org/show_bug.cgi?id=3519; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050687.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050703.html
CVE: CVE-2010-3871
Published: 2010-11-09
Description: Cross-site scripting (XSS) vulnerability in blocktype/groupviews/theme/raw/groupviews.tpl in Mahara before 1.3.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/42152; http://wiki.mahara.org/Release_Notes/1.3.3; http://www.securityfocus.com/bid/44705
CVE: CVE-2010-4216
Published: 2010-11-09
Description: IBM Tivoli Directory Server (TDS) 6.0.0.x before 6.0.0.8-TIV-ITDS-IF0007 does not properly handle invalid buffer references in LDAP BER requests, which might allow remote attackers to cause a denial of service (daemon crash) via vectors involving a buffer that has a memory address near the maximum possible address.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/42116; http://www.ibm.com/support/docview.wss?uid=swg1IO13306; http://www.securityfocus.com/bid/44604
CVE: CVE-2010-4217
Published: 2010-11-09
Description: Use-after-free vulnerability in the proxy server in IBM Tivoli Directory Server (TDS) 6.0.0.x before 6.0.0.8-TIV-ITDS-IF0007 and 6.1.x before 6.1.0-TIV-ITDS-FP0005 allows remote attackers to cause a denial of service (daemon crash) via an unbind request that occurs during a certain search operation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/42083; http://securitytracker.com/id?1024670; http://www-01.ibm.com/support/docview.wss?uid=swg1IO13282
CVE: CVE-2010-4218
Published: 2010-11-09
Description: Unspecified vulnerability in Web Services in IBM ENOVIA 6 has unknown impact and attack vectors, related to a system that becomes "exposed to the internet."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/42029; http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1HE01296; http://www-01.ibm.com/support/docview.wss?uid=swg1HE01296
CVE: CVE-2010-4219
Published: 2010-11-09
Description: Cross-site scripting (XSS) vulnerability in SemanticTagService.js in IBM WebSphere Portal 6.1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PK91972; http://www.vupen.com/english/advisories/2010/2827; http://www-01.ibm.com/support/docview.wss?uid=swg1PK91972
CVE: CVE-2010-4220
Published: 2010-11-09
Description: Cross-site scripting (XSS) vulnerability in the Integrated Solution Console in the Administrative Console component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related in part to "URL injection."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41722; http://www-01.ibm.com/support/docview.wss?uid=swg1PM11777; http://www-01.ibm.com/support/docview.wss?uid=swg27014463
CVE: CVE-2010-4221
Published: 2010-11-09
Description: Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.proftpd.org/show_bug.cgi?id=3521; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050687.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050703.html
CVE: CVE-2010-2572
Published: 2010-11-10
Description: Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 document, aka "PowerPoint Parsing Buffer Overflow Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: http://www.us-cert.gov/cas/techalerts/TA10-313A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-088; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12195
CVE: CVE-2010-2573
Published: 2010-11-10
Description: Integer underflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3, PowerPoint Viewer SP2, and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "PowerPoint Integer Underflow Causes Heap Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/cas/techalerts/TA10-313A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-088; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12122
CVE: CVE-2010-2732
Published: 2010-11-10
Description: Open redirect vulnerability in the web interface in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka "UAG Redirection Spoofing Vulnerability."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.us-cert.gov/cas/techalerts/TA10-313A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-089; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12257
CVE: CVE-2010-2733
Published: 2010-11-10
Description: Cross-site scripting (XSS) vulnerability in the Web Monitor in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "UAG XSS Allows EOP Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.us-cert.gov/cas/techalerts/TA10-313A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-089; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12127
CVE: CVE-2010-2734
Published: 2010-11-10
Description: Cross-site scripting (XSS) vulnerability in the mobile portal in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS Issue on UAG Mobile Portal Website in Forefront Unified Access Gateway Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.us-cert.gov/cas/techalerts/TA10-313A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-089; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12058
CVE: CVE-2010-3333
Published: 2010-11-10
Description: Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880; http://secunia.com/advisories/38521; http://secunia.com/advisories/42144
CVE: CVE-2010-3334
Published: 2010-11-10
Description: Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via an Office document containing an Office Art Drawing record with crafted msofbtSp records and unspecified flags, which triggers memory corruption, aka "Office Art Drawing Records Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38521; http://secunia.com/advisories/42144; http://secunia.com/secunia_research/2010-4/
CVE: CVE-2010-3335
Published: 2010-11-10
Description: Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "Drawing Exception Handling Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38521; http://secunia.com/advisories/42144; http://www.securityfocus.com/bid/44659
CVE: CVE-2010-3336
Published: 2010-11-10
Description: Microsoft Office XP SP3, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "MSO Large SPID Read AV Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38521; http://secunia.com/advisories/42144; http://www.securityfocus.com/bid/44660
CVE: CVE-2010-3337
Published: 2010-11-10
Description: Untrusted search path vulnerability in Microsoft Office 2007 SP2 and 2010 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Insecure Library Loading Vulnerability." NOTE: this might overlap CVE-2010-3141 and CVE-2010-3142.
CVSS Score: 9.3 (HIGH)
References: http://www.securitytracker.com/id?1024705; http://www.us-cert.gov/cas/techalerts/TA10-313A.html; http://www.vupen.com/english/advisories/2010/2923
CVE: CVE-2010-3633
Published: 2010-11-10
Description: Memory leak in Adobe Flash Media Server (FMS) 3.0.x before 3.0.7, 3.5.x before 3.5.5, and 4.0.x before 4.0.1 allows attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.adobe.com/support/security/bulletins/apsb10-27.html; http://www.securityfocus.com/bid/44757; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11955
CVE: CVE-2010-3634
Published: 2010-11-10
Description: Unspecified vulnerability in the edge process in Adobe Flash Media Server (FMS) 3.0.x before 3.0.7, 3.5.x before 3.5.5, and 4.0.x before 4.0.1 allows attackers to cause a denial of service via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.adobe.com/support/security/bulletins/apsb10-27.html; http://www.securityfocus.com/bid/44756; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11938
CVE: CVE-2010-3635
Published: 2010-11-10
Description: Adobe Flash Media Server (FMS) 3.0.x before 3.0.7, 3.5.x before 3.5.5, and 4.0.x before 4.0.1 allows attackers to execute arbitrary code via unspecified vectors, related to a "segmentation fault vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www.adobe.com/support/security/bulletins/apsb10-27.html; http://www.securityfocus.com/bid/44753; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11333
CVE: CVE-2010-3936
Published: 2010-11-10
Description: Cross-site scripting (XSS) vulnerability in Signurl.asp in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS in Signurl.asp Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.us-cert.gov/cas/techalerts/TA10-313A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-089; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12218
CVE: CVE-2010-4156
Published: 2010-11-10
Description: The mb_strcut function in Libmbfl 1.1.0, as used in PHP 5.3.x through 5.3.3, allows context-dependent attackers to obtain potentially sensitive information via a large value of the third parameter (aka the length parameter).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7777&w=2
CVE: CVE-2010-2637
Published: 2010-11-12
Description: IBM WebSphere MQ 6.0 before 6.0.2.9 and 7.0 before 7.0.1.1 does not encrypt the username and password in the security parameters field, which allows remote attackers to obtain sensitive information by sniffing the network traffic from a .NET client application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IZ56005; http://www-01.ibm.com/support/docview.wss?uid=swg27007069; http://www-01.ibm.com/support/docview.wss?uid=swg27014224
CVE: CVE-2010-3870
Published: 2010-11-12
Description: The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://bugs.php.net/bug.php?id=48230; http://bugs.php.net/bug.php?id=49687; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2010-3890
Published: 2010-11-12
Description: Cross-site scripting (XSS) vulnerability in IBM OmniFind Enterprise Edition before 9.1 allows remote attackers to inject arbitrary web script or HTML via the command parameter to the administration interface, as demonstrated by the command parameter to ESAdmin/collection.do.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt; http://www.securityfocus.com/archive/1/514688/100/0/threaded; http://www.securityfocus.com/bid/44740