deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-0502
Published: 2011-01-20
Description: Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a long line in a MIDI (.mid) file.
CVSS Score: 9.3 (HIGH)
References: http://www.exploit-db.com/exploits/15897; http://www.exploit-db.com/exploits/15897
CVE: CVE-2011-0503
Published: 2011-01-20
Description: Cross-site request forgery (CSRF) vulnerability in VaM Shop 1.6, 1.6.1, and probably earlier versions allows remote attackers to hijack the authentication of administrators for requests that (1) change user status via admin/customers.php or (2) change user permissions via admin/accounting.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/70431; http://secunia.com/advisories/42869; http://www.exploit-db.com/exploits/15968
CVE: CVE-2011-0504
Published: 2011-01-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in VaM Shop 1.6, 1.6.1, and probably earlier versions llow remote attackers to inject arbitrary web script or HTML via the (1) status parameter to admin/orders.php, (2) search parameter to admin/customers.php, or (3) STORE_NAME parameter to admin/configuration.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/70429; http://osvdb.org/70430; http://secunia.com/advisories/42869
CVE: CVE-2011-0505
Published: 2011-01-20
Description: Directory traversal vulnerability in system/system.php in Zwii 2.1.1, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the set[template][value] parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/42858; http://www.exploit-db.com/exploits/15945; http://www.osvdb.org/70395
CVE: CVE-2011-0506
Published: 2011-01-20
Description: Directory traversal vulnerability in modules/profile/user.php in Ax Developer CMS (AxDCMS) 0.1.1 allows remote attackers to execute arbitrary code via a .. (dot dot) in the aXconf[default_language] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/15938; http://www.securityfocus.com/bid/45735; http://www.vupen.com/english/advisories/2011/0071
CVE: CVE-2011-0507
Published: 2011-01-20
Description: FTPService.exe in Blackmoon FTP 3.1 Build 1735 and Build 1736 (3.1.7.1736), and possibly other versions before 3.1.8.1737, allows remote attackers to cause a denial of service (crash) via a large number of PORT commands with long arguments, which triggers a NULL pointer dereference.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/70452; http://secunia.com/advisories/42933; http://www.exploit-db.com/exploits/15986
CVE: CVE-2011-0508
Published: 2011-01-20
Description: Cross-site scripting (XSS) vulnerability in system/modules/comments/Comments.php in Contao CMS 2.9.2, and possibly other versions before 2.9.3, allows remote attackers to inject arbitrary web script or HTML via the HTTP X_FORWARDED_FOR header, which is stored by system/libraries/Environment.php but not properly handled by a comments action to main.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dev.contao.org/issues/2751; http://secunia.com/advisories/42899; http://www.contao.org/changelog.html
CVE: CVE-2011-0509
Published: 2011-01-20
Description: Cross-site scripting (XSS) vulnerability in Vaadin before 6.4.9 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the index page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dev.vaadin.com/ticket/6257; http://osvdb.org/70398; http://secunia.com/advisories/42879
CVE: CVE-2011-0510
Published: 2011-01-20
Description: SQL injection vulnerability in cart.php in Advanced Webhost Billing System (AWBS) 2.9.2 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the oid parameter in an add_other action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/42944; http://www.exploit-db.com/exploits/16003; https://exchange.xforce.ibmcloud.com/vulnerabilities/64726
CVE: CVE-2011-0511
Published: 2011-01-20
Description: SQL injection vulnerability in the allCineVid component (com_allcinevid) 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://adv.salvatorefresta.net/allCineVid_Joomla_Component_1.0.0_Blind_SQL_Injection_Vulnerability-18012011.txt; http://secunia.com/advisories/42967; http://www.exploit-db.com/exploits/16010
CVE: CVE-2011-0512
Published: 2011-01-20
Description: SQL injection vulnerability in team.php in the Teams Structure module 3.0 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the team_id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/70451; http://secunia.com/advisories/42943; http://www.exploit-db.com/exploits/16004
CVE: CVE-2011-0513
Published: 2011-01-20
Description: DCR.sys driver in SecurStar DriveCrypt 5.4, 5.3, and earlier allows local users to execute arbitrary code via a crafted argument to the 0x00073800 IOCTL.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://osvdb.org/70426; http://secunia.com/advisories/42881; http://www.exploit-db.com/exploits/15972
CVE: CVE-2011-0514
Published: 2011-01-20
Description: The RDS service (rds.exe) in HP Data Protector Manager 6.11 allows remote attackers to cause a denial of service (crash) via a packet with a large data size to TCP port 1530.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/15940; http://www.vupen.com/english/advisories/2011/0064; http://www.exploit-db.com/exploits/15940
CVE: CVE-2011-0515
Published: 2011-01-20
Description: KisKrnl.sys 2011.1.13.89 and earlier in Kingsoft AntiVirus 2011 SP5.2 allows local users to cause a denial of service (crash) via a crafted request that is not properly handled by the KiFastCallEntry hook.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/42937; http://www.exploit-db.com/exploits/15998; http://www.securityfocus.com/archive/1/515767/100/0/threaded
CVE: CVE-2011-0516
Published: 2011-01-20
Description: SQL injection vulnerability in mainx_a.php in E-PROMPT C BetMore Site Suite 4.0 through 4.2.0 allows remote attackers to execute arbitrary SQL commands via the bid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://epromptc.com/media/nwsatcl/betmore-4-2-1-software-update.html; http://secunia.com/advisories/42945; http://www.exploit-db.com/exploits/15999
CVE: CVE-2011-0517
Published: 2011-01-20
Description: Stack-based buffer overflow in Sielco Sistemi Winlog Pro 2.07.00 and earlier, when Run TCP/IP server is enabled, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a crafted 0x02 opcode to TCP port 46823.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/winlog_1-adv.txt; http://osvdb.org/70418; http://secunia.com/advisories/42894
CVE: CVE-2011-0518
Published: 2011-01-20
Description: Directory traversal vulnerability in core/lib/router.php in LotusCMS Fraise 3.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via the system parameter to index.php.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/70409; http://secunia.com/advisories/42835; http://www.exploit-db.com/exploits/15964
CVE: CVE-2011-0519
Published: 2011-01-20
Description: SQL injection vulnerability in gallery.php in Gallarific PHP Photo Gallery script 2.1 and possibly other versions allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/42792; http://www.exploit-db.com/exploits/15891; http://secunia.com/advisories/42792
CVE: CVE-2010-2743
Published: 2011-01-20
Description: The kernel-mode drivers in Microsoft Windows XP SP3 do not properly perform indexing of a function-pointer table during the loading of keyboard layouts from disk, which allows local users to gain privileges via a crafted application, as demonstrated in the wild in July 2010 by the Stuxnet worm, aka "Win32k Keyboard Layout Vulnerability."  NOTE: this might be a duplicate of CVE-2010-3888 or CVE-2010-3889.
CVSS Score: 7.2 (HIGH)
References: http://www.us-cert.gov/cas/techalerts/TA10-285A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-073; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7514
CVE: CVE-2010-3932
Published: 2011-01-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2010.  Notes: none
CVE: CVE-2010-3879
Published: 2011-01-22
Description: FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesystem, via a symlink attack on the parent directory of the mountpoint of a FUSE filesystem, a different vulnerability than CVE-2010-0789.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602333; http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053792.html; http://lists.grok.org.uk/pipermail/full-disclosure/2010-November/077247.html
CVE: CVE-2010-4238
Published: 2011-01-22
Description: The vbd_create function in Xen 3.1.2, when the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 is used, allows guest OS users to cause a denial of service (host OS panic) via an attempted access to a virtual CD-ROM device through the blkback driver.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://bugs.centos.org/bug_view_advanced_page.php?bug_id=4517; http://secunia.com/advisories/42884; http://secunia.com/advisories/46397
CVE: CVE-2010-4243
Published: 2011-01-22
Description: fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial of service (memory consumption) via a crafted exec system call, aka an "OOM dodging issue," a related issue to CVE-2010-3858.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3c77f[PII_REDACTED]06a7209c45ccddc264d19319c; http://grsecurity.net/~spender/64bit_dos.c; http://linux.derkeiler.com/Mailing-Lists/Kernel/2010-11/msg13278.html
CVE: CVE-2010-4704
Published: 2011-01-22
Description: libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg 0.6.1 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted .ogg file, related to the vorbis_floor0_decode function.  NOTE: this might overlap CVE-2011-0480.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://ffmpeg.mplayerhq.hu/; http://git.ffmpeg.org/?p=ffmpeg.git%3Ba=commit%3Bh=3dde66752d59dfdd0f3727efd66e7202b3c75078; http://secunia.com/advisories/43323
CVE: CVE-2010-4705
Published: 2011-01-22
Description: Integer overflow in the vorbis_residue_decode_internal function in libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg, possibly 0.6, has unspecified impact and remote attack vectors, related to the sizes of certain integer data types.  NOTE: this might overlap CVE-2011-0480.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://git.ffmpeg.org/?p=ffmpeg.git%3Ba=commit%3Bh=366d919016a679d3955f6fe5278fa7ce4f47b81e; http://secunia.com/advisories/43323; http://www.debian.org/security/2011/dsa-2165
CVE: CVE-2011-0002
Published: 2011-01-22
Description: libuser before 0.57 uses a cleartext password value of (1) !! or (2) x for new LDAP user accounts, which makes it easier for remote attackers to obtain access by specifying one of these values.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053365.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053378.html
CVE: CVE-2011-0635
Published: 2011-01-22
Description: Static code injection vulnerability in Simploo CMS 1.7.1 and earlier allows remote authenticated users to inject arbitrary PHP code into config/custom/base.ini.php via the ftpserver parameter (FTP-Server field) to the sicore/updates/optionssav operation for index.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/70487; http://secunia.com/advisories/42953; http://www.exploit-db.com/exploits/16016
CVE: CVE-2011-0636
Published: 2011-01-22
Description: The (1) cudaHostAlloc and (2) cuMemHostAlloc functions in the NVIDIA CUDA Toolkit 3.2 developer drivers for Linux 260.19.26, and possibly other versions, do not initialize pinned memory, which allows local users to read potentially sensitive memory, such as file fragments during read or write operations.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://classic.chem.msu.su/cgi-bin/ceilidh.exe/gran/gamess/forum/?C35e9ea936bHW-7675-1380-00.htm; http://classic.chem.msu.su/cgi-bin/ceilidh.exe/gran/gamess/forum/?C35e9ea936bHW-7676-1022+00.htm; http://classic.chem.msu.su/cgi-bin/ceilidh.exe/gran/gamess/forum/?C35e9ea936bHW-7677-1391+00.htm
CVE: CVE-2010-3316
Published: 2011-01-24
Description: The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.
CVSS Score: 3.3 (LOW)
References: http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=06f882f30092a39a1db867c9744b2ca8d60e4ad6; http://lists.vmware.com/pipermail/security-announce/2011/000126.html; http://openwall.com/lists/oss-security/2010/08/16/2
CVE: CVE-2010-3430
Published: 2011-01-24
Description: The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.
CVSS Score: 4.7 (MEDIUM)
References: http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=843807a3a90f52e7538be[PII_REDACTED]30a24739a; http://openwall.com/lists/oss-security/2010/09/21/10; http://openwall.com/lists/oss-security/2010/09/21/3
CVE: CVE-2010-3431
Published: 2011-01-24
Description: The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.
CVSS Score: 1.9 (LOW)
References: http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=843807a3a90f52e7538be[PII_REDACTED]30a24739a; http://openwall.com/lists/oss-security/2010/09/21/10; http://openwall.com/lists/oss-security/2010/09/21/3
CVE: CVE-2010-3435
Published: 2011-01-24
Description: The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.
CVSS Score: 4.7 (MEDIUM)
References: http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=06f882f30092a39a1db867c9744b2ca8d60e4ad6; http://lists.vmware.com/pipermail/security-announce/2011/000126.html; http://openwall.com/lists/oss-security/2010/09/21/3
CVE: CVE-2010-3853
Published: 2011-01-24
Description: pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.
CVSS Score: 6.9 (MEDIUM)
References: http://lists.vmware.com/pipermail/security-announce/2011/000126.html; http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_namespace/pam_namespace.c?view=log#rev1.13; http://secunia.com/advisories/49711
CVE: CVE-2010-3927
Published: 2011-01-24
Description: Untrusted search path vulnerability in Lunascape before 6.4.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://help.lunascape.tv/LunascapeHelp-en/page.aspx?pageid=ver_6_4_11; http://jvn.jp/en/jp/JVN94695018/296426/index.html; http://jvn.jp/en/jp/JVN94695018/index.html
CVE: CVE-2011-0020
Published: 2011-01-24
Description: Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file, related to the glyph box for an FT_Bitmap object.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html; http://openwall.com/lists/oss-security/2011/01/18/6; http://openwall.com/lists/oss-security/2011/01/20/2
CVE: CVE-2011-0274
Published: 2011-01-24
Description: Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 7.x through 7.55 and 8.x through 8.05, and Business Service Management (BSM) through 9.01, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5203&w=2; http://secunia.com/advisories/43014; http://secunia.com/advisories/43018
CVE: CVE-2011-0352
Published: 2011-01-24
Description: Buffer overflow in the web-based management interface on the Cisco Linksys WRT54GC router with firmware before 1.06.1 allows remote attackers to cause a denial of service (device crash) via a long string in a POST request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN26605630/index.html; http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000007.html; http://secunia.com/advisories/43017
CVE: CVE-2011-0410
Published: 2011-01-24
Description: CollabNet ScrumWorks Basic 1.8.4 uses cleartext credentials for network communication and the internal database, which makes it easier for context-dependent attackers to obtain sensitive information by (1) sniffing the network for transmissions of Java objects or (2) reading the database.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://osvdb.org/70601; http://osvdb.org/70602; http://secunia.com/advisories/43010
CVE: CVE-2010-4706
Published: 2011-01-24
Description: The pam_sm_close_session function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not properly handle a failure to determine a certain target uid, which might allow local users to delete unintended files by executing a program that relies on the pam_xauth PAM check.
CVSS Score: 4.9 (MEDIUM)
References: http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=Linux-PAM-1_1_2-3-g05dafc06cd3dfeb7c4b24942e4e1ae33ff75a123; http://openwall.com/lists/oss-security/2010/10/03/1; http://secunia.com/advisories/49711
CVE: CVE-2010-4707
Published: 2011-01-24
Description: The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=Linux-PAM-1_1_2-2-gffe7058c70253d574b1963c7c93002bd410fddc9; http://openwall.com/lists/oss-security/2010/10/03/1; http://secunia.com/advisories/49711
CVE: CVE-2010-4708
Published: 2011-01-24
Description: The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check.
CVSS Score: 7.2 (HIGH)
References: http://openwall.com/lists/oss-security/2010/09/27/7; http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.8.xml?r1=1.7&r2=1.8; http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.c?r1=1.22&r2=1.23
CVE: CVE-2010-4255
Published: 2011-01-25
Description: The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to call the handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS BUG_ON) via a crafted memory access.
CVSS Score: 6.1 (MEDIUM)
References: http://lists.xensource.com/archives/html/xen-devel/2010-11/msg01650.html; http://openwall.com/lists/oss-security/2010/11/30/5; http://openwall.com/lists/oss-security/2010/11/30/8
CVE: CVE-2010-4341
Published: 2011-01-25
Description: The pam_parse_in_data_v2 function in src/responder/pam/pamsrv_cmd.c in the PAM responder in SSSD 1.5.0, 1.4.x, and 1.3 allows local users to cause a denial of service (infinite loop, crash, and login prevention) via a crafted packet.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053319.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053337.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-4353
Published: 2011-01-25
Description: Unrestricted file upload vulnerability in modules/gallery/models/item.php in Menalto Gallery before 3.0 and beta allows remote authenticated users with upload permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
CVSS Score: 6.0 (MEDIUM)
References: http://gallery.menalto.com/gallery_3.0.1_released; http://osvdb.org/70628; http://secunia.com/advisories/43028
CVE: CVE-2011-0273
Published: 2011-01-25
Description: Buffer overflow in crs.exe in HP OpenView Storage Data Protector Cell Manager 6.11 allows remote attackers to execute arbitrary code via unspecified message types.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/70621; http://secunia.com/advisories/42997; http://securitytracker.com/id?1024983
CVE: CVE-2011-0637
Published: 2011-01-25
Description: The FC SCSI protocol driver in IBM AIX 6.1 does not verify that a timer is unused before deallocating this timer, which might allow attackers to cause a denial of service (system crash) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/70519; http://secunia.com/advisories/42962; http://www-01.ibm.com/support/docview.wss?uid=isg1IZ92478