deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-2926
Published: 2010-07-30
Description: SQL injection vulnerability in index.php in sNews 1.7 allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14465; https://exchange.xforce.ibmcloud.com/vulnerabilities/60622; http://www.exploit-db.com/exploits/14465
CVE: CVE-2009-4896
Published: 2010-08-02
Description: Multiple directory traversal vulnerabilities in the mlmmj-php-admin web interface for Mailing List Managing Made Joyful (mlmmj) 1.2.15 through 1.2.17 allow remote authenticated users to overwrite, create, or delete arbitrary files, or determine the existence of arbitrary directories, via a .. (dot dot) in a list name in a (1) edit or (2) save action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://bugs.gentoo.org/show_bug.cgi?id=259968; http://mlmmj.org/node/84; http://secunia.com/advisories/40658
CVE: CVE-2010-1517
Published: 2010-08-02
Description: The GIGABYTE Dldrv2 ActiveX control 1.4.206.11 allows remote attackers to (1) download arbitrary programs onto a client system, and execute these programs, via vectors involving the dl method; and (2) download arbitrary programs onto a client system via vectors involving the SetDLInfo method in conjunction with the Bdl method.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/40161; http://secunia.com/secunia_research/2010-85/; http://secunia.com/advisories/40161
CVE: CVE-2010-1518
Published: 2010-08-02
Description: Array index error in the SetDLInfo method in the GIGABYTE Dldrv2 ActiveX control 1.4.206.11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via the item argument.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/40161; http://secunia.com/secunia_research/2010-86/; http://secunia.com/advisories/40161
CVE: CVE-2010-1794
Published: 2010-08-02
Description: The webdav_mount function in webdav_vfsops.c in the WebDAV kernel extension (aka webdav_fs.kext) for Mac OS X 10.6 allows local users to cause a denial of service (panic) via a mount request with a large integer in the pa_socket_namelen field.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://securitytracker.com/id?1024250; http://www.securityfocus.com/archive/1/512642/100/0/threaded; http://www.securityfocus.com/bid/41958
CVE: CVE-2010-2195
Published: 2010-08-02
Description: bozotic HTTP server (aka bozohttpd) 20090522 through 20100512 allows attackers to cause a denial of service via vectors related to a "wrong code generation interaction with GCC."
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590298; http://security-tracker.debian.org/tracker/CVE-2010-2195; http://www.eterna.com.au/bozohttpd
CVE: CVE-2010-2320
Published: 2010-08-02
Description: bozotic HTTP server (aka bozohttpd) before 20100621 allows remote attackers to list the contents of home directories, and determine the existence of user accounts, via multiple requests for URIs beginning with /~ sequences.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590298; http://secunia.com/advisories/40737; http://security-tracker.debian.org/tracker/CVE-2010-2320
CVE: CVE-2010-2785
Published: 2010-08-02
Description: The IRC Protocol component in KVIrc 3.x and 4.x before r4693 does not properly handle \ (backslash) characters, which allows remote authenticated users to execute arbitrary CTCP commands via vectors involving \r and \40 sequences, a different vulnerability than CVE-2010-2451 and CVE-2010-2452.
CVSS Score: 6.5 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=330111; http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044625.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044643.html
CVE: CVE-2010-2927
Published: 2010-08-02
Description: The slapi_printmessage function in IBM Tivoli Directory Server (ITDS) before 6.0.0.8-TIV-ITDS-IF0006 allows remote attackers to cause a denial of service (daemon crash) via multiple incomplete DIGEST-MD5 connection attempts.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/66782; http://secunia.com/advisories/40791; http://www-01.ibm.com/support/docview.wss?uid=swg1IO12399
CVE: CVE-2009-4975
Published: 2010-08-02
Description: Cross-site scripting (XSS) vulnerability in webview.cpp in QtDemoBrowser allows remote attackers to inject arbitrary web script or HTML via a URL associated with a nonexistent domain name, related to a "universal XSS" issue, a similar vulnerability to CVE-2010-2536.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugreports.qt.nokia.com/browse/QTWEBKIT-22; https://bugs.kde.org/show_bug.cgi?id=217464; https://bugs.webkit.org/show_bug.cgi?id=32252
CVE: CVE-2009-4976
Published: 2010-08-02
Description: Cross-site scripting (XSS) vulnerability in webkitpart.cpp in kwebkitpart allows remote attackers to inject arbitrary web script or HTML via a URL associated with a nonexistent domain name, related to a "universal XSS" issue, a similar vulnerability to CVE-2010-2536.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://websvn.kde.org/?view=rev&revision=1059140; https://bugs.kde.org/show_bug.cgi?id=217464; https://exchange.xforce.ibmcloud.com/vulnerabilities/60878
CVE: CVE-2010-1671
Published: 2010-08-02
Description: hsolinkcontrol in hsolink 1.0.118 allows local users to gain privileges via shell metacharacters in command-line arguments, as demonstrated by the second argument in a down action.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590670; http://ftp.de.debian.org/debian/pool/main/h/hsolink/hsolink_1.0.118.orig.tar.gz; http://secunia.com/advisories/40713
CVE: CVE-2010-2536
Published: 2010-08-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in rekonq 0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) a URL associated with a nonexistent domain name, related to webpage.cpp, aka a "universal XSS" issue; (2) unspecified vectors related to webview.cpp; and the about: views for (3) favorites, (4) bookmarks, (5) closed tabs, and (6) history.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049406.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]0788&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]7945&w=2
CVE: CVE-2010-2929
Published: 2010-08-02
Description: Untrusted search path vulnerability in hsolinkcontrol in hsolink 1.0.118 allows local users to gain privileges via a modified PATH environment variable, which is used during execution of the (1) route, (2) mv, and (3) cp programs, a different vulnerability than CVE-2010-1671.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590670; http://ftp.de.debian.org/debian/pool/main/h/hsolink/hsolink_1.0.118.orig.tar.gz; http://osvdb.org/66837
CVE: CVE-2010-2930
Published: 2010-08-02
Description: Multiple stack-based buffer overflows in hsolinkcontrol in hsolink 1.0.118 allow local users to gain privileges via long command-line arguments, a different vulnerability than CVE-2010-1671.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590670; http://ftp.de.debian.org/debian/pool/main/h/hsolink/hsolink_1.0.118.orig.tar.gz; http://osvdb.org/66836
CVE: CVE-2010-2539
Published: 2010-08-02
Description: Buffer overflow in the msTmpFile function in maputil.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 allows local users to cause a denial of service via vectors involving names of temporary files.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://lists.osgeo.org/pipermail/mapserver-users/2010-July/066052.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]5859&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]1922&w=2
CVE: CVE-2010-2540
Published: 2010-08-02
Description: mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debugging, which allows remote attackers to have an unspecified impact via crafted arguments.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://lists.osgeo.org/pipermail/mapserver-users/2010-July/066052.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]5859&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]1922&w=2
CVE: CVE-2010-2633
Published: 2010-08-02
Description: Unspecified vulnerability in EMC Disk Library (EDL) before 3.2.7, 3.3.x before 3.3.2 epatch 8, and 4.0.x before 4.0.1 epatch 4 allows remote attackers to cause a denial of service (communication-module crash) by sending a crafted message through TCP.
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2010-07/0272.html; http://osvdb.org/66826; http://secunia.com/advisories/40828
CVE: CVE-2010-2786
Published: 2010-08-02
Description: Directory traversal vulnerability in Piwik 0.6 through 0.6.3 allows remote attackers to include arbitrary local files and possibly have unspecified other impact via directory traversal sequences in a crafted data-renderer request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]0346&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]2498&w=2; http://piwik.org/blog/2010/07/piwik-0-6-4-security-advisory/
CVE: CVE-2010-2487
Published: 2010-08-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809; http://hg.moinmo.in/moin/1.7/rev/37306fba2189; http://hg.moinmo.in/moin/1.8/raw-file/1.8.8/docs/CHANGES
CVE: CVE-2010-2526
Published: 2010-08-05
Description: The cluster logical volume manager daemon (clvmd) in lvm2-cluster in LVM2 before 2.02.72, as used in Red Hat Global File System (GFS) and other products, does not verify client credentials upon a socket connection, which allows local users to cause a denial of service (daemon exit or logical-volume change) or possibly have unspecified other impact via crafted control commands.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html; http://secunia.com/advisories/40759; http://securitytracker.com/id?1024258
CVE: CVE-2010-2546
Published: 2010-08-05
Description: Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file, related to panpts, pitpts, and IT_ProcessEnvelope.  NOTE: some of these details are obtained from third party information.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3995.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/40799; http://secunia.com/advisories/48244; http://security.gentoo.org/glsa/glsa-201203-10.xml
CVE: CVE-2010-2860
Published: 2010-08-05
Description: The EMC Celerra Network Attached Storage (NAS) appliance accepts external network traffic to IP addresses intended for an intranet network within the appliance, which allows remote attackers to read, create, or modify arbitrary files in the user data directory via NFS requests.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0018.html; http://securitytracker.com/id?1024271; http://www.exploit-db.com/exploits/14536
CVE: CVE-2010-2965
Published: 2010-08-05
Description: The WDB target agent debug service in Wind River VxWorks 6.x, 5.x, and earlier, as used on the Rockwell Automation 1756-ENBT series A with firmware 3.2.6 and 3.6.1 and other products, allows remote attackers to read or modify arbitrary memory locations, perform function calls, or manage tasks via requests to UDP port 17185, a related issue to CVE-2005-3804.
CVSS Score: 10.0 (HIGH)
CWE: CWE-863
References: http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html; http://rockwellautomation.custhelp.com/cgi-bin/rockwellautomation.cfg/php/enduser/std_adp.php?p_faqid=69735; http://www.kb.cert.org/vuls/id/362332
CVE: CVE-2010-2966
Published: 2010-08-05
Description: The INCLUDE_SECURITY functionality in Wind River VxWorks 6.x, 5.x, and earlier uses the LOGIN_USER_NAME and LOGIN_USER_PASSWORD (aka LOGIN_PASSWORD) parameters to create hardcoded credentials, which makes it easier for remote attackers to obtain access via a (1) telnet, (2) rlogin, or (3) FTP session.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html; http://www.kb.cert.org/vuls/id/840249; http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html
CVE: CVE-2010-2967
Published: 2010-08-05
Description: The loginDefaultEncrypt algorithm in loginLib in Wind River VxWorks before 6.9 does not properly support a large set of distinct possible passwords, which makes it easier for remote attackers to obtain access via a (1) telnet, (2) rlogin, or (3) FTP session.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html; http://www.kb.cert.org/vuls/id/840249; http://www.kb.cert.org/vuls/id/MAPG-863QH9
CVE: CVE-2010-2968
Published: 2010-08-05
Description: The FTP daemon in Wind River VxWorks does not close the TCP connection after a number of failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html; http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html
CVE: CVE-2010-2969
Published: 2010-08-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/LikePages.py, (2) action/chart.py, and (3) action/userprofile.py, a similar issue to CVE-2010-2487.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809; http://hg.moinmo.in/moin/1.7/rev/37306fba2189; http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES
CVE: CVE-2010-2970
Published: 2010-08-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809; http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES; http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb
CVE: CVE-2010-2971
Published: 2010-08-05
Description: loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546.  NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/48244; http://security.gentoo.org/glsa/glsa-201203-10.xml; http://sourceforge.net/tracker/?func=detail&aid=3033086&group_id=40531&atid=428227
CVE: CVE-2010-1871
Published: 2010-08-05
Description: JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL.  NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
CVSS Score: 8.8 (HIGH)
CWE: CWE-917, CWE-917
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0117.html; http://www.redhat.com/support/errata/RHSA-2010-0564.html; http://www.securityfocus.com/bid/41994
CVE: CVE-2010-2725
Published: 2010-08-05
Description: BarnOwl before 1.6.2 does not check the return code of calls to the (1) ZPending and (2) ZReceiveNotice functions in libzephyr, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://barnowl.mit.edu/wiki/release-notes/1.6.2; http://github.com/barnowl/barnowl/blob/barnowl-1.6.2/ChangeLog; http://barnowl.mit.edu/wiki/release-notes/1.6.2
CVE: CVE-2010-2790
Published: 2010-08-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery function in frontends/php/include/classes/class.curl.php in Zabbix before 1.8.3rc1 allow remote attackers to inject arbitrary web script or HTML via the (1) filter_set, (2) show_details, (3) filter_rst, or (4) txt_select parameters to the triggers page (tr_status.php).  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40679; http://www.securityfocus.com/bid/42017; http://www.vupen.com/english/advisories/2010/1908
CVE: CVE-2010-2931
Published: 2010-08-05
Description: Stack-based buffer overflow in SigPlus Pro 3.74 ActiveX control allows remote attackers to execute arbitrary code via a long eighth argument (HexString) to the LCDWriteString method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/40818; http://www.exploit-db.com/exploits/14514; https://exchange.xforce.ibmcloud.com/vulnerabilities/60839
CVE: CVE-2010-2932
Published: 2010-08-05
Description: Buffer overflow in BarCodeWiz BarCode 3.29 ActiveX control (BarcodeWiz.dll) allows remote attackers to execute arbitrary code via a long argument to the LoadProperties method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/40786; http://www.exploit-db.com/exploits/14504; http://www.exploit-db.com/exploits/14505
CVE: CVE-2010-2933
Published: 2010-08-05
Description: SQL injection vulnerability in AV Scripts AV Arcade 3 allows remote attackers to execute arbitrary SQL commands via the ava_code cookie to the "main page," related to index.php and the login task.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14494; http://www.securityfocus.com/bid/42023; https://exchange.xforce.ibmcloud.com/vulnerabilities/60799
CVE: CVE-2009-2696
Published: 2010-08-05
Description: Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40813; http://www.redhat.com/support/errata/RHSA-2010-0580.html; http://www.vupen.com/english/advisories/2010/1986
CVE: CVE-2010-2547
Published: 2010-08-05
Description: Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-August/044935.html; http://lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.html; http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html
CVE: CVE-2010-2709
Published: 2010-08-05
Description: Stack-based buffer overflow in webappmon.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long OvJavaLocale value in a cookie.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://seclists.org/bugtraq/2010/Aug/21; http://securityreason.com/securityalert/8150; http://securitytracker.com/id?1024274
CVE: CVE-2010-2713
Published: 2010-08-05
Description: The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE 0.25.1 and earlier, as used in gnome-terminal, does not properly handle escape sequences, which allows remote attackers to execute arbitrary commands or obtain potentially sensitive information via a (1) window title or (2) icon title sequence.  NOTE: this issue exists because of a CVE-2003-0070 regression.
CVSS Score: 6.8 (MEDIUM)
References: http://git.gnome.org/browse/vte/commit/?id=8b971a7b2c59902914ecbbc3915c45dd21530a91; http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html; http://secunia.com/advisories/40635
CVE: CVE-2010-2791
Published: 2010-08-05
Description: mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.  NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.mandriva.com/security/advisories?name=MDVSA-2013:150; http://www.openwall.com/lists/oss-security/2010/07/30/1; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html
CVE: CVE-2010-2795
Published: 2010-08-05
Description: phpCAS before 1.1.2 allows remote authenticated users to hijack sessions via a query string containing a crafted ticket value.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046576.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046584.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html
CVE: CVE-2010-2796
Published: 2010-08-05
Description: Cross-site scripting (XSS) vulnerability in phpCAS before 1.1.2, when proxy mode is enabled, allows remote attackers to inject arbitrary web script or HTML via a callback URL.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046576.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046584.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html
CVE: CVE-2010-2862
Published: 2010-08-05
Description: Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3, and Acrobat 9.3.3, allows remote attackers to execute arbitrary code via a TrueType font with a large maxCompositePoints value in a Maximum Profile (maxp) table.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/40766; http://securityevaluators.com/files/papers/CrashAnalysis.pdf; http://www.us-cert.gov/cas/techalerts/TA10-231A.html
CVE: CVE-2010-2972
Published: 2010-08-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-1797.  Reason: This candidate is a duplicate of CVE-2010-1797.  Notes: All CVE users should reference CVE-2010-1797 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage