deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-4148
Published: 2010-11-02
Description: Directory traversal vulnerability in AnyConnect 1.2.3.0, and possibly earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9082&w=2; http://packetstormsecurity.org/1010-exploits/anyconnect-traversal.txt; http://secunia.com/advisories/41802
CVE: CVE-2010-4149
Published: 2010-11-02
Description: Directory traversal vulnerability in FreshWebMaster Fresh FTP 5.36, 5.37, and possibly earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1010-exploits/freshftp-traversal.txt; http://secunia.com/advisories/41798; http://www.htbridge.ch/advisory/directory_traversal_vulnerability_in_freshftp.html
CVE: CVE-2010-4030
Published: 2010-11-02
Description: Cross-site scripting (XSS) vulnerability in HP Insight Control Performance Management before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02563642; http://www.securityfocus.com/bid/44585; http://www.securitytracker.com/id?1024672
CVE: CVE-2010-4031
Published: 2010-11-02
Description: Unspecified vulnerability in HP Insight Control Performance Management before 6.2 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 8.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02563642; http://www.securityfocus.com/bid/44582; http://www.securitytracker.com/id?1024672
CVE: CVE-2010-4032
Published: 2010-11-02
Description: Cross-site request forgery (CSRF) vulnerability in HP Insight Control Performance Management before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02563642; http://www.securityfocus.com/bid/44584; http://www.securitytracker.com/id?1024672
CVE: CVE-2010-4100
Published: 2010-11-02
Description: Unspecified vulnerability in HP Insight Control Performance Management before 6.1 update 2 allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02574359; http://www.securityfocus.com/bid/44583; http://www.securitytracker.com/id?1024675
CVE: CVE-2010-4101
Published: 2010-11-02
Description: Cross-site scripting (XSS) vulnerability in HP Insight Recovery before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/42037; http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02571464; http://www.securityfocus.com/bid/44545
CVE: CVE-2010-4102
Published: 2010-11-02
Description: Unspecified vulnerability in HP Insight Recovery before 6.2 allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/42037; http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02571464; http://www.securityfocus.com/bid/44542
CVE: CVE-2010-4103
Published: 2010-11-02
Description: Unspecified vulnerability in HP Insight Managed System Setup Wizard before 6.2 allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/42038; http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02573176; http://www.securityfocus.com/bid/44532
CVE: CVE-2010-4104
Published: 2010-11-02
Description: Unspecified vulnerability in HP Insight Orchestration before 6.2 allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/42036; http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02573285; http://www.securityfocus.com/bid/44534
CVE: CVE-2010-4105
Published: 2010-11-02
Description: Unspecified vulnerability in HP Insight Orchestration before 6.2 allows remote attackers to bypass intended access restrictions, and obtain sensitive information or modify data, via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/42036; http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02573285; http://www.securityfocus.com/bid/44534
CVE: CVE-2010-4106
Published: 2010-11-02
Description: Cross-site request forgery (CSRF) vulnerability in HP Insight Control for Linux before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/42040; http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02573692; http://www.securityfocus.com/bid/44537
CVE: CVE-2010-4142
Published: 2010-11-02
Description: Multiple stack-based buffer overflows in DATAC RealWin 2.0 Build 6.1.8.10 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) SCPC_INITIALIZE, (2) SCPC_INITIALIZE_RF, or (3) SCPC_TXTEVENT packet. NOTE: it was later reported that 1.06 is also affected by one of these requests.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/realwin_1-adv.txt; http://secunia.com/advisories/41849; http://www.exploit-db.com/exploits/15259
CVE: CVE-2010-2583
Published: 2010-11-03
Description: Stack-based buffer overflow in SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX control (Aventail.EPInstaller) before 10.5.2 and 10.0.5 hotfix 3 allows remote attackers to execute arbitrary code via long (1) CabURL and (2) Location arguments to the Install3rdPartyComponent method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/41644; http://secunia.com/secunia_research/2010-117/; http://software.sonicwall.com/Aventail/KB/hotfix/10.0.5/clt-hotfix-10_0_5-003.txt
CVE: CVE-2010-3914
Published: 2010-11-03
Description: Untrusted search path vulnerability in VIM Development Group GVim before 7.3.034, and possibly other versions before 7.3.46, allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse User32.dll or other DLL that is located in the same folder as a .TXT file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
References: ftp://ftp.vim.org/pub/vim/patches/7.3/7.3.034; http://jvn.jp/en/jp/JVN27868039/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000051.html
CVE: CVE-2010-3977
Published: 2010-11-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/42006; http://www.conviso.com.br/security-advisory-cform-wordpress-plugin-v-11-cve-2010-3977/; http://www.securityfocus.com/archive/1/514579/100/0/threaded
CVE: CVE-2010-4006
Published: 2010-11-03
Description: Multiple SQL injection vulnerabilities in search.php in WSN Links 5.0.x before 5.0.81, 5.1.x before 5.1.51, and 6.0.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) namecondition or (2) namesearch parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-10/0512.html; http://www.exploit-db.com/exploits/15607; http://www.securityfocus.com/archive/1/514585/100/0/threaded
CVE: CVE-2010-4151
Published: 2010-11-03
Description: SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the xthedateformat parameter in a register action, a different vector than CVE-2005-2989, CVE-2006-2503, and CVE-2009-1033.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/1010-exploits/deluxebb13x-sql.txt; http://secunia.com/advisories/41918; http://www.deluxebb.com/community/topic.php?tid=993
CVE: CVE-2010-4152
Published: 2010-11-03
Description: SQL injection vulnerability in catalog/index.shtml in 4site CMS 2.6, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the cat parameter.  NOTE: the i and th vectors are already covered by CVE-2009-0646.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33733; http://www.htbridge.ch/advisory/sql_injection_in_4site_cms.html; http://www.securityfocus.com/archive/1/514376/100/0/threaded
CVE: CVE-2010-4153
Published: 2010-11-03
Description: Directory traversal vulnerability in CrossFTP Pro 1.65a, and probably earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/41852; http://www.htbridge.ch/advisory/directory_traversal_vulnerability_in_crossftp_pro.html; http://www.osvdb.org/68700
CVE: CVE-2010-4154
Published: 2010-11-03
Description: Directory traversal vulnerability in Rhino Software, Inc. FTP Voyager 15.2.0.11, and possibly earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1920&w=2; http://packetstormsecurity.org/1010-exploits/ftpvoyager-traversal.txt; http://secunia.com/advisories/41719
CVE: CVE-2010-4155
Published: 2010-11-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in eXV2 CMS 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) rssfeedURL parameter to manual/caferss/example.php and the sumb parameter to (2) modules/news/archive.php, (3) modules/news/topics.php, and (4) modules/contact/index.php, different vectors than CVE-2007-1965.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.packetstormsecurity.com/1010-exploits/exv2-xss.txt; http://www.securityfocus.com/bid/44169; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4970.php
CVE: CVE-2010-3611
Published: 2010-11-04
Description: ISC DHCP server 4.0 before 4.0.2, 4.1 before 4.1.2, and 4.2 before 4.2.0-P1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a DHCPv6 packet containing a Relay-Forward message without an address in the Relay-Forward link-address field.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050766.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051287.html; http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html
CVE: CVE-2010-3851
Published: 2010-11-04
Description: libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows local guest OS administrators to read files from the host via a crafted (1) qcow2, (2) VMDK, or (3) VDI header, related to lack of support for a disk format specifier.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050237.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050742.html; http://rwmj.wordpress.com/2010/10/23/new-libguestfs-stable-versions/
CVE: CVE-2010-4181
Published: 2010-11-04
Description: Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files via ..\ (dot dot backslash) and other sequences.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/68962; http://secunia.com/advisories/42066; http://www.exploit-db.com/exploits/15371
CVE: CVE-2010-4182
Published: 2010-11-04
Description: Untrusted search path vulnerability in the Data Access Objects (DAO) library (dao360.dll) in Microsoft Windows XP Professional SP3, Windows Server 2003 R2 Enterprise Edition SP3, Windows Vista Business SP1, and Windows 7 Professional allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse msjet49.dll that is located in the same folder as a file that is processed by dao360.dll.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/68946; http://secunia.com/advisories/41986; http://www.securityfocus.com/bid/44541
CVE: CVE-2010-2941
Published: 2010-11-05
Description: ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050977.html
CVE: CVE-2010-3172
Published: 2010-11-05
Description: CRLF injection vulnerability in Bugzilla before 3.2.9, 3.4.x before 3.4.9, 3.6.x before 3.6.3, and 4.0.x before 4.0rc1, when Server Push is enabled in a web browser, allows remote attackers to inject arbitrary HTTP headers and content, and conduct HTTP response splitting attacks, via a crafted URL.
CVSS Score: 2.6 (LOW)
CWE: CWE-94
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050813.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050820.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050830.html
CVE: CVE-2010-3764
Published: 2010-11-05
Description: The Old Charts implementation in Bugzilla 2.12 through 3.2.8, 3.4.8, 3.6.2, 3.7.3, and 4.1 creates graph files with predictable names in graphs/, which allows remote attackers to obtain sensitive information via a modified URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050813.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050820.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050830.html
CVE: CVE-2010-3846
Published: 2010-11-05
Description: Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://cvs.savannah.gnu.org/viewvc/cvs/ccvs/src/rcs.c?r1=1.262.4.65&r2=1.262.4.66&sortby=rev; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050212.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050287.html
CVE: CVE-2010-3863
Published: 2010-11-05
Description: Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html; http://osvdb.org/69067; http://secunia.com/advisories/41989
CVE: CVE-2010-3913
Published: 2010-11-05
Description: CRLF injection vulnerability in TransWARE Active! mail 6 build 6.40.010047750 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN72541530/index.html; http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000050.html; http://secunia.com/advisories/42039
CVE: CVE-2010-3962
Published: 2010-11-05
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-416
References: http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx; http://secunia.com/advisories/42091; http://www.exploit-db.com/exploits/15418
CVE: CVE-2010-3996
Published: 2010-11-05
Description: festival_server in Centre for Speech Technology Research (CSTR) Festival, probably 2.0.95-beta and earlier, places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html; http://lists.opensuse.org/opensuse-updates/2010-10/msg00028.html
CVE: CVE-2010-3999
Published: 2010-11-05
Description: gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050269.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050164.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050177.html
CVE: CVE-2010-4183
Published: 2010-11-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://htmlpurifier.org/news/2010/0915-4.2.0-released; http://htmlpurifier.org/security/2010/css-quoting; http://htmlpurifier.org/news/2010/0915-4.2.0-released
CVE: CVE-2010-4184
Published: 2010-11-05
Description: NetSupport Manager (NSM) before 11.00.0005 sends HTTP headers with cleartext fields containing details about client machines, which allows remote attackers to obtain potentially sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/465239; http://www.netsupportsoftware.com/support/td.asp?td=634; https://exchange.xforce.ibmcloud.com/vulnerabilities/62984
CVE: CVE-2010-3702
Published: 2010-11-05
Description: The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl5.patch; http://cgit.freedesktop.org/poppler/poppler/commit/?id=e853106b58d6b4b0467dbd6436c9bb1cfbd372cf; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050268.html
CVE: CVE-2010-3703
Published: 2010-11-05
Description: The PostScriptFunction::PostScriptFunction function in poppler/Function.cc in the PDF parser in poppler 0.8.7 and possibly other versions up to 0.15.1, and possibly other products, allows context-dependent attackers to cause a denial of service (crash) via a PDF file that triggers an uninitialized pointer dereference.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://cgit.freedesktop.org/poppler/poppler/commit/?id=bf2055088a3a2d3bb3d3c37d464954ec1a25771f; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049392.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049523.html
CVE: CVE-2010-3704
Published: 2010-11-05
Description: The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PDF file with a crafted PostScript Type1 font that contains a negative array index, which bypasses input validation and triggers memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl5.patch; http://cgit.freedesktop.org/poppler/poppler/commit/?id=39d140bfc0b8239bdd96d6a55842034ae5c05473; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050268.html
CVE: CVE-2010-4185
Published: 2010-11-05
Description: SQL injection vulnerability in index.php in Energine, possibly 2.3.8 and earlier, allows remote attackers to execute arbitrary SQL commands via the NRGNSID cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/41973; http://www.exploit-db.com/exploits/15327; http://www.securityfocus.com/archive/1/514494/100/0/threaded
CVE: CVE-2010-4186
Published: 2010-11-05
Description: SQL injection vulnerability in process.asp in OnlineTechTools Online Work Order System (OWOS) Professional Edition 2.10 allows remote attackers to execute arbitrary SQL commands via the password parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/68972; http://secunia.com/advisories/42111; http://www.exploit-db.com/exploits/15397
CVE: CVE-2010-4092
Published: 2010-11-05
Description: Use-after-free vulnerability in an unspecified compatibility component in Adobe Shockwave Player before 11.5.9.620 allows user-assisted remote attackers to execute arbitrary code via a crafted web site, related to the Shockwave Settings window and an unloaded library. NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://osvdb.org/68982; http://secunia.com/advisories/42112; http://www.adobe.com/support/security/bulletins/apsb11-01.html
CVE: CVE-2009-5014
Published: 2010-11-06
Description: The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt, which makes it easier for remote attackers to bypass repoze.who authentication via a forged authorization cookie, a related issue to CVE-2010-3852.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://groups.google.com/group/turbogears-announce/msg/09ec26696b1761bb?dmode=source&output=gplain; http://groups.google.com/group/turbogears-announce/msg/09ec26696b1761bb?dmode=source&output=gplain
CVE: CVE-2009-5015
Published: 2010-11-06
Description: The URL dispatch mechanism in TurboGears2 (aka tg2) before 2.0.2 exposes controller methods even when an @expose decoration is not used, which has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://groups.google.com/group/turbogears-announce/msg/09ec26696b1761bb?dmode=source&output=gplain; http://groups.google.com/group/turbogears-announce/msg/09ec26696b1761bb?dmode=source&output=gplain
CVE: CVE-2010-1523
Published: 2010-11-06
Description: Multiple heap-based buffer overflows in vp6.w5s (aka the VP6 codec) in Winamp before 5.59 Beta build 3033 might allow remote attackers to execute arbitrary code via a crafted VP6 (1) video file or (2) video stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://forums.winamp.com/showthread.php?t=322995; http://secunia.com/secunia_research/2010-95/; http://www.securityfocus.com/archive/1/514484/100/0/threaded