deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-3306
Published: 2010-09-24
Description: Directory traversal vulnerability in the modURL function in instance.c in Weborf before 0.12.3 allows remote attackers to read arbitrary files via ..%2f sequences in a URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://code.google.com/p/weborf/source/detail?r=464; http://galileo.dmi.unict.it/wiki/weborf/doku.php?id=news:released_0.12.3; http://secunia.com/advisories/41286
CVE: CVE-2010-3081
Published: 2010-09-24
Description: The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0273.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0278.html; http://blog.ksplice.com/2010/09/cve-2010-3081/
CVE: CVE-2010-3601
Published: 2010-09-24
Description: SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1009-exploits/ibphotohost-sql.txt; http://www.exploit-db.com/exploits/15070; http://www.securityfocus.com/bid/43374
CVE: CVE-2010-3602
Published: 2010-09-24
Description: Cross-site scripting (XSS) vulnerability in ProfileView.aspx in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers to inject arbitrary web script or HTML via the User ID parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/68059; http://packetstormsecurity.org/1009-advisories/moaub16-mojoportal.pdf; http://packetstormsecurity.org/1009-exploits/moaub-mojoportal.txt
CVE: CVE-2010-3603
Published: 2010-09-24
Description: Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers to hijack the authentication of administrators for requests that rename arbitrary files, as demonstrated by causing the user.config file to be moved, leading to a denial of service (service stop) and possibly the exposure of sensitive information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/68060; http://packetstormsecurity.org/1009-advisories/moaub16-mojoportal.pdf; http://packetstormsecurity.org/1009-exploits/moaub-mojoportal.txt
CVE: CVE-2010-3604
Published: 2010-09-24
Description: SQL injection vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/41530; http://typo3.org/extensions/repository/view/powermail/1.5.4/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-019
CVE: CVE-2010-3605
Published: 2010-09-24
Description: Cross-site scripting (XSS) vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41530; http://typo3.org/extensions/repository/view/powermail/1.5.4; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-019
CVE: CVE-2010-3606
Published: 2010-09-24
Description: Multiple directory traversal vulnerabilities in AGENTS/index.php in NetArt MEDIA Real Estate Portal 2.0 allow remote emote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) folder and (2) action parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/68062; http://pridels-team.blogspot.com/2010/09/netartmedia-real-estate-portal-v20-xss.html; http://secunia.com/advisories/41377
CVE: CVE-2010-3607
Published: 2010-09-24
Description: Cross-site scripting (XSS) vulnerability in AGENTS/index.php in NetArt MEDIA Real Estate Portal 2.0 allows remote authenticated users to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/68061; http://pridels-team.blogspot.com/2010/09/netartmedia-real-estate-portal-v20-xss.html; http://secunia.com/advisories/41377
CVE: CVE-2010-3608
Published: 2010-09-24
Description: Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) password (pw) parameters to (a) admin.php or (b) user.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1009-exploits/wpquiz27-sql.txt; http://www.exploit-db.com/exploits/15075; http://www.securityfocus.com/bid/43384
CVE: CVE-2010-0405
Published: 2010-09-28
Description: Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-189
References: http://blogs.sun.com/security/entry/cve_2010_0405_integer_overflow; http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=clamav-0.96.3; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2010-2950
Published: 2010-09-28
Description: Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7777&w=2
CVE: CVE-2010-3070
Published: 2010-09-28
Description: Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to an arbitrary PHP script that uses NuSOAP classes.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=595248; http://git.debian.org/?p=users/olberger-guest/nusoap.git%3Ba=blob%3Bf=debian/patches/595248.patch%3Bh=6af3d725fe74d839764d9755c5bb18458a192518%3Bhb=268f03b88c6900d1a87b17734c248c705c22cb07; http://git.debian.org/?p=users/olberger-guest/nusoap.git%3Ba=blobdiff%3Bf=debian/patches/595248.patch%3Bh=11202fa70433b62aeab7dfc68af668329bc0fe7e%3Bhp=6af3d725fe74d839764d9755c5bb18458a192518%3Bhb=3ac7a26a49086c6b91fb79e5acafcfcdc5d6980a%3Bhpb=268f03b88c6900d1a87b17734c248c705c22cb07
CVE: CVE-2010-3087
Published: 2010-09-28
Description: LibTIFF before 3.9.2-5.2.1 in SUSE openSUSE 11.3 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TIFF image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://blackberry.com/btsc/KB27244; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html; http://secunia.com/advisories/50726
CVE: CVE-2010-3277
Published: 2010-09-28
Description: The installer in VMware Workstation 7.x before 7.1.2 build 301548 and VMware Player 3.x before 3.1.2 build 301548 renders an index.htm file if present in the installation directory, which might allow local users to trigger unintended interpretation of web script or HTML by creating this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.vmware.com/pipermail/security-announce/2010/000105.html; http://secunia.com/advisories/41574; http://securitytracker.com/id?1024481
CVE: CVE-2010-3490
Published: 2010-09-28
Description: Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earlier allows remote authenticated administrators to create arbitrary files via a .. (dot dot) in the usersnum parameter to admin/config.php, as demonstrated by creating a .php file under the web root.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/15098; http://www.freepbx.org/trac/ticket/4553; http://www.securityfocus.com/archive/1/513947/100/0/threaded
CVE: CVE-2010-2453
Published: 2010-09-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in Synology Disk Station 2.x before DSM3.0-1337 allow remote attackers to inject arbitrary web script or HTML by connecting to the FTP server and providing a crafted (1) USER or (2) PASS command, which is written by the FTP logging module to a web-interface log window, related to a "web commands injection" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/513970/100/0/threaded; http://www.securityfocus.com/archive/1/513970/100/0/threaded
CVE: CVE-2010-2478
Published: 2010-09-29
Description: Integer overflow in the ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.33.7 on 32-bit platforms allows local users to cause a denial of service or possibly have unspecified other impact via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value that triggers a buffer overflow, a different vulnerability than CVE-2010-3084.
CVSS Score: 7.2 (HIGH)
CWE: CWE-190
References: http://article.gmane.org/gmane.linux.network/164869; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=db048b69037e7fa6a7d9e95a1271a50dc08ae233; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html
CVE: CVE-2010-2530
Published: 2010-09-29
Description: Multiple integer signedness errors in smb_subr.c in the netsmb module in the kernel in NetBSD 5.0.2 and earlier, FreeBSD, and Apple Mac OS X allow local users to cause a denial of service (panic) via a negative size value in a /dev/nsmb ioctl operation, as demonstrated by a (1) SMBIOC_LOOKUP or (2) SMBIOC_OPENSESSION ioctl call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netsmb/smb_subr.c.diff?r1=1.34&r2=1.35&only_with_tag=MAIN&f=h; http://www.openwall.com/lists/oss-security/2010/07/12/6; http://www.openwall.com/lists/oss-security/2010/07/16/2
CVE: CVE-2010-2946
Published: 2010-09-29
Description: fs/jfs/xattr.c in the Linux kernel before 2.6.35.2 does not properly handle a certain legacy format for storage of extended attributes, which might allow local users by bypass intended xattr namespace restrictions via an "os2." substring at the beginning of a name.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=aca0fa34bdaba39bfddddba8ca70dba4782e8fe6; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html
CVE: CVE-2010-3084
Published: 2010-09-29
Description: Buffer overflow in the niu_get_ethtool_tcam_all function in drivers/net/niu.c in the Linux kernel before 2.6.36-rc4 allows local users to cause a denial of service or possibly have unspecified other impact via the ETHTOOL_GRXCLSRLALL ethtool command.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ee9c5cfad29c8a[PII_REDACTED]b9b16f1c4137ac9; http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html; http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.36-rc4
CVE: CVE-2010-3091
Published: 2010-09-29
Description: The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not verifying the openid.return_to value, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://drupal.org/node/880476; http://drupal.org/node/880480; http://marc.info/?l=oss-security&m=[PII_REDACTED]5305&w=2
CVE: CVE-2010-3310
Published: 2010-09-29
Description: Multiple integer signedness errors in net/rose/af_rose.c in the Linux kernel before 2.6.36-rc5-next-20100923 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a rose_getname function call, related to the rose_bind and rose_connect functions.
CVSS Score: 1.9 (LOW)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=9828e6e6e3f19efcb476c567b9999891d051f52f; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00004.html
CVE: CVE-2010-3380
Published: 2010-09-29
Description: The (1) init.d/slurm and (2) init.d/slurmdbd scripts in SLURM before 2.1.14 place the . (dot) directory in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/41614; http://sourceforge.net/projects/slurm/files//slurm/version_2.1/2.1.14/RELEASE_NOTES_2.1.14/view; http://www.securityfocus.com/bid/43537
CVE: CVE-2010-3468
Published: 2010-09-29
Description: Directory traversal vulnerability in fileManager.cfc in Mura CMS 5.1 before 5.1.498 and 5.2 before 5.2.2809, and Sava CMS 5 through 5.2, allows remote attackers to read arbitrary files via a .. (dot dot) in the FILEID parameter to the default URI under tasks/render/file/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/41591; http://www.exploit-db.com/exploits/15120; http://www.getmura.com/index.cfm/blog/critical-security-patch/
CVE: CVE-2010-3684
Published: 2010-09-29
Description: The FTP authentication module in Synology Disk Station 2.x logs passwords to the web application interface in cases of incorrect login attempts, which allows local users to obtain sensitive information by reading a log, a different vulnerability than CVE-2010-2453.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://www.securityfocus.com/archive/1/513970/100/0/threaded; http://www.securityfocus.com/archive/1/513970/100/0/threaded
CVE: CVE-2010-3685
Published: 2010-09-29
Description: The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://drupal.org/node/880476; http://drupal.org/node/880480; http://marc.info/?l=oss-security&m=[PII_REDACTED]5305&w=2
CVE: CVE-2010-3686
Published: 2010-09-29
Description: The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://drupal.org/node/880476; http://drupal.org/node/880480; http://marc.info/?l=oss-security&m=[PII_REDACTED]5305&w=2
CVE: CVE-2010-3687
Published: 2010-09-29
Description: Unspecified vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to bypass validation have an unspecified impact by "[injecting] arbitrary values into validated fields," as demonstrated using the (1) Email and (2) URL fields.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/41530; http://typo3.org/extensions/repository/view/powermail/1.5.4; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-019
CVE: CVE-2010-3688
Published: 2010-09-29
Description: Directory traversal vulnerability in ADMIN/login.php in NetArtMEDIA WebSiteAdmin allows remote emote attackers to include and execute arbitrary local files via directory traversal sequences in the lng parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://pridels-team.blogspot.com/2010/09/netartmedia-real-estate-portal-v20-xss.html; http://pridels-team.blogspot.com/2010/09/netartmedia-real-estate-portal-v20-xss.html
CVE: CVE-2010-2537
Published: 2010-09-30
Description: The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a (1) BTRFS_IOC_CLONE or (2) BTRFS_IOC_CLONE_RANGE ioctl call that specifies this file as a donor.
CVSS Score: 7.1 (HIGH)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2ebc3464781ad24474abcbd2274e[PII_REDACTED]b5; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html; http://secunia.com/advisories/42758
CVE: CVE-2010-2538
Published: 2010-09-30
Description: Integer overflow in the btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 might allow local users to obtain sensitive information via a BTRFS_IOC_CLONE_RANGE ioctl call.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2ebc3464781ad24474abcbd2274e[PII_REDACTED]b5; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html; http://secunia.com/advisories/42758
CVE: CVE-2010-2943
Published: 2010-09-30
Description: The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: http://article.gmane.org/gmane.comp.file-systems.xfs.general/33767; http://article.gmane.org/gmane.comp.file-systems.xfs.general/33768; http://article.gmane.org/gmane.comp.file-systems.xfs.general/33769
CVE: CVE-2010-3079
Published: 2010-09-30
Description: kernel/trace/ftrace.c in the Linux kernel before 2.6.35.5, when debugfs is enabled, does not properly handle interaction between mutex possession and llseek operations, which allows local users to cause a denial of service (NULL pointer dereference and outage of all function tracing files) via an lseek call on a file descriptor associated with the set_ftrace_filter file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9c55cb12c1c172e2d51e85fbb5a4796ca86b77e7; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
CVE: CVE-2010-3296
Published: 2010-09-30
Description: The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=49c37c0334a9b85d30ab3d6b5d1acb05ef2ef6de; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html
CVE: CVE-2010-3297
Published: 2010-09-30
Description: The eql_g_master_cfg function in drivers/net/eql.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an EQL_GETMASTRCFG ioctl call.
CVSS Score: 2.1 (LOW)
CWE: CWE-909
References: http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=44467187dc22fdd33a1a06ea0ba86ce20be3fe3c; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html
CVE: CVE-2010-3298
Published: 2010-09-30
Description: The hso_get_count function in drivers/net/usb/hso.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=7011e660938fc44ed86319c18a5954e95a82ab3e; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
CVE: CVE-2010-3429
Published: 2010-09-30
Description: flicvideo.c in libavcodec 0.6 and earlier in FFmpeg, as used in MPlayer and other products, allows remote attackers to execute arbitrary code via a crafted flic file, related to an "arbitrary offset dereference vulnerability."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://git.ffmpeg.org/?p=ffmpeg%3Ba=commit%3Bh=16c592155f117ccd7b86006c45aacc692a81c23b; http://secunia.com/advisories/41626; http://secunia.com/advisories/43323
CVE: CVE-2010-3434
Published: 2010-09-30
Description: Buffer overflow in the find_stream_bounds function in pdf.c in libclamav in ClamAV before 0.96.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=clamav-0.96.3; http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=commit%3Bh=dc5143b4669ae39c79c9af50d569c28c798f33da; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2010-1623
Published: 2010-10-04
Description: Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://blogs.sun.com/security/entry/cve_2010_1623_memory_leak; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049885.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049939.html
CVE: CVE-2010-1822
Published: 2010-10-04
Description: WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3 and Google Chrome before 6.0.472.62, does not properly perform a cast of an unspecified variable, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an SVG element in a non-SVG document.
CVSS Score: 8.8 (HIGH)
CWE: CWE-704
References: http://code.google.com/p/chromium/issues/detail?id=55114; http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_17.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html
CVE: CVE-2010-3315
Published: 2010-10-04
Description: authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-16
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html; http://secunia.com/advisories/41652