deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1764
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, follows multiple redirections during form submission, which allows remote web servers to obtain sensitive information by recording the form data.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1770
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Apple Safari before 4.1 on Mac OS X 10.4, and Google Chrome before 5.0.375.70 does not properly handle a transformation of a text node that has the IBM1147 character set, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document containing a BR element, related to a "type checking issue."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://code.google.com/p/chromium/issues/detail?id=43487; http://googlechromereleases.blogspot.com/2010/06/stable-channel-update.html; http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html
CVE: CVE-2010-1771
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving fonts.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html
CVE: CVE-2010-1774
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, accesses out-of-bounds memory during processing of HTML tables, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-2264
Published: 2010-06-11
Description: The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/40105
CVE: CVE-2010-0990
Published: 2010-06-15
Description: Stack-based buffer overflow in Creative Software AutoUpdate Engine ActiveX Control 2.0.12.0, as used in Creative Software AutoUpdate 1.40.01, allows remote attackers to execute arbitrary code via vectors related to the BrowseFolder method.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38970; http://secunia.com/secunia_research/2010-52/; http://www.securityfocus.com/archive/1/511795/100/0/threaded
CVE: CVE-2010-1885
Published: 2010-06-15
Description: The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka "Help Center URL Validation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-06/0197.html; http://blogs.technet.com/b/msrc/archive/2010/06/10/windows-help-vulnerability-disclosure.aspx; http://blogs.technet.com/b/srd/archive/2010/06/10/help-and-support-center-vulnerability-full-disclosure-posting.aspx
CVE: CVE-2010-2263
Published: 2010-06-15
Description: nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://spa-s3c.blogspot.com/2010/06/full-responsible-disclosurenginx-engine.html; http://www.exploit-db.com/exploits/13818; http://www.exploit-db.com/exploits/13822
CVE: CVE-2010-2265
Published: 2010-06-15
Description: Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windows XP and Windows Server 2003 allows remote attackers to inject arbitrary web script or HTML via the svr parameter to sysinfo/sysinfomain.htm.  NOTE: this can be leveraged with CVE-2010-1885 to execute arbitrary commands without user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-06/0197.html; http://blogs.technet.com/b/msrc/archive/2010/06/10/windows-help-vulnerability-disclosure.aspx; http://blogs.technet.com/b/srd/archive/2010/06/10/help-and-support-center-vulnerability-full-disclosure-posting.aspx
CVE: CVE-2010-2266
Published: 2010-06-15
Description: nginx 0.8.36 allows remote attackers to cause a denial of service (crash) via certain encoded directory traversal sequences that trigger memory corruption, as demonstrated using the "%c0.%c0." sequence.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/13818/; http://www.exploit-db.com/exploits/13818/
CVE: CVE-2009-4893
Published: 2010-06-15
Description: Buffer overflow in UnrealIRCd 3.2beta11 through 3.2.8, when allow::options::noident is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://security.gentoo.org/glsa/glsa-201006-21.xml; http://www.openwall.com/lists/oss-security/2010/06/14/13; http://www.securityfocus.com/bid/42077
CVE: CVE-2009-4894
Published: 2010-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in profile.php in PunBB before 1.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) password or (2) e-mail.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://punbb.informer.com/forums/topic/21669/punbb-134/; http://punbb.informer.com/forums/topic/21669/punbb-134/
CVE: CVE-2010-2075
Published: 2010-06-15
Description: UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modification (Trojan Horse) in the DEBUG3_DOLOG_SYSTEM macro, which allows remote attackers to execute arbitrary commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/65445; http://seclists.org/fulldisclosure/2010/Jun/277; http://seclists.org/fulldisclosure/2010/Jun/284
CVE: CVE-2010-2283
Published: 2010-06-15
Description: The SMB dissector in Wireshark 0.99.6 through 1.0.13, and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (NULL pointer dereference) via unknown vectors.
CVSS Score: 3.3 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/40112
CVE: CVE-2010-2284
Published: 2010-06-15
Description: Buffer overflow in the ASN.1 BER dissector in Wireshark 0.10.13 through 1.0.13 and 1.2.0 through 1.2.8 has unknown impact and remote attack vectors.
CVSS Score: 8.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/40112
CVE: CVE-2010-2285
Published: 2010-06-15
Description: The SMB PIPE dissector in Wireshark 0.8.20 through 1.0.13 and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (NULL pointer dereference) via unknown vectors.
CVSS Score: 3.3 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/40112
CVE: CVE-2010-2286
Published: 2010-06-15
Description: The SigComp Universal Decompressor Virtual Machine dissector in Wireshark 0.10.7 through 1.0.13 and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.
CVSS Score: 3.3 (LOW)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/40112
CVE: CVE-2010-2287
Published: 2010-06-15
Description: Buffer overflow in the SigComp Universal Decompressor Virtual Machine dissector in Wireshark 0.10.8 through 1.0.13 and 1.2.0 through 1.2.8 has unknown impact and remote attack vectors.
CVSS Score: 8.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/40112
CVE: CVE-2010-2288
Published: 2010-06-15
Description: Cross-site scripting (XSS) vulnerability in dana/nc/ncrun.cgi in Juniper Networks IVE 6.5R1 (Build 14599) and 6.5R2 (Build 14951) allows remote attackers to inject arbitrary web script or HTML via the DSSignInURL cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/65288; http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2010-05-751&viewMode=view; http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-17
CVE: CVE-2010-2289
Published: 2010-06-15
Description: Open redirect vulnerability in dana/home/homepage.cgi in Juniper Networks IVE 6.5R1 (Build 14599) and 6.5R2 (Build 14951) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the Location parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/65289; http://secunia.com/advisories/40117; http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2010-05-751&viewMode=view
CVE: CVE-2010-2290
Published: 2010-06-15
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/cgix/help in McAfee Unified Threat Management (UTM) Firewall (formerly SnapGear) firmware 3.0.0 through 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ngenuity-is.com/advisories/2010/jun/9/mcafee-utm-firewall-help-cross-site-scripting/; http://secunia.com/advisories/40089; http://secunia.com/advisories/40138
CVE: CVE-2010-2291
Published: 2010-06-15
Description: Unspecified vulnerability in the web interface in snom VoIP Phone firmware 8 before 8.2.35 allows remote attackers to bypass intended restrictions and modify user credentials via unknown vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://osvdb.org/65383; http://secunia.com/advisories/37635; http://wiki.snom.com/Firmware/V8/Release_Notes/8.2.35
CVE: CVE-2010-2292
Published: 2010-06-15
Description: Cross-site scripting (XSS) vulnerability in the Ping tools web interface in Dlink Di-604 router allows remote attackers to inject arbitrary web script or HTML via the IP field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/511751/100/0/threaded; http://www.securityfocus.com/bid/40691; https://exchange.xforce.ibmcloud.com/vulnerabilities/59364
CVE: CVE-2010-2293
Published: 2010-06-15
Description: The Ping tools web interface in Dlink Di-604 router allows remote authenticated users to cause a denial of service via a large "ip textfield" size.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/511751/100/0/threaded; http://www.securityfocus.com/bid/40691; https://exchange.xforce.ibmcloud.com/vulnerabilities/59366
CVE: CVE-2010-2294
Published: 2010-06-15
Description: Cross-site request forgery (CSRF) vulnerability in Plume CMS 1.2.4 and possibly earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/40133; http://www.securityfocus.com/archive/1/511761/100/0/threaded; http://www.vupen.com/english/advisories/2010/1430
CVE: CVE-2010-1514
Published: 2010-06-15
Description: Unrestricted file upload vulnerability in TomatoCMS 2.0.6 and earlier allows remote authenticated users, with certain privileges, to execute arbitrary PHP code by uploading an image file, and then accessing it via a direct request to the file in an unspecified directory.
CVSS Score: 6.0 (MEDIUM)
References: http://holisticinfosec.org/content/view/148/45/; http://secunia.com/advisories/39680; http://secunia.com/secunia_research/2010-57/
CVE: CVE-2010-1515
Published: 2010-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS 2.0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) keyword or (2) article-id parameter in conjunction with a /admin/news/article/list PATH_INFO; the (3) keyword parameter in conjunction with a /admin/multimedia/set/list PATH_INFO; the (4) keyword or (5) fileId parameter in conjunction with a /admin/multimedia/file/list PATH_INFO; or the (6) name, (7) email, or (8) address parameter in conjunction with a /admin/ad/client/list PATH_INFO.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/148/45/; http://secunia.com/advisories/39680; http://secunia.com/secunia_research/2010-58/
CVE: CVE-2010-1937
Published: 2010-06-15
Description: Heap-based buffer overflow in httpAdapter.c in httpAdapter in SBLIM SFCB before 1.3.8 might allow remote attackers to execute arbitrary code via a Content-Length HTTP header that specifies a value too small for the amount of POST data, aka bug #3001896.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9192&w=2; http://sblim.cvs.sourceforge.net/viewvc/sblim/sfcb/httpAdapter.c?r1=1.84&r2=1.85; http://secunia.com/advisories/40018
CVE: CVE-2010-2054
Published: 2010-06-15
Description: Integer overflow in httpAdapter.c in httpAdapter in SBLIM SFCB 1.3.4 through 1.3.7, when the configuration sets httpMaxContentLength to a zero value, allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via a large integer in the Content-Length HTTP header, aka bug #3001915.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9192&w=2; http://sblim.cvs.sourceforge.net/viewvc/sblim/sfcb/httpAdapter.c?r1=1.85&r2=1.86; http://secunia.com/advisories/40018
CVE: CVE-2010-2267
Published: 2010-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Accoria Web Server (aka Rock Web Server) 1.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the getenv sample program, (2) the desc parameter to loadstatic.cgi, (3) the name parameter to httpdcfg.cgi, or (4) the dns parameter to servercfg.cgi.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.ioactive.com/pdfs/AccoriaWebServer.pdf; http://www.kb.cert.org/vuls/id/245081; http://www.ioactive.com/pdfs/AccoriaWebServer.pdf
CVE: CVE-2010-2268
Published: 2010-06-15
Description: Cross-site request forgery (CSRF) vulnerability in authcfg.cgi in Accoria Web Server (aka Rock Web Server) 1.4.7 allows remote attackers to hijack the authentication of administrators for requests that create user accounts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.ioactive.com/pdfs/AccoriaWebServer.pdf; http://www.kb.cert.org/vuls/id/245081; http://www.ioactive.com/pdfs/AccoriaWebServer.pdf
CVE: CVE-2010-2269
Published: 2010-06-15
Description: Directory traversal vulnerability in loadstatic.cgi in Accoria Web Server (aka Rock Web Server) 1.4.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the name parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.ioactive.com/pdfs/AccoriaWebServer.pdf; http://www.kb.cert.org/vuls/id/245081; http://www.ioactive.com/pdfs/AccoriaWebServer.pdf
CVE: CVE-2010-2270
Published: 2010-06-15
Description: Accoria Web Server (aka Rock Web Server) 1.4.7 uses a predictable httpmod-sessionid cookie, which makes it easier for remote attackers to hijack sessions via a modified cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://www.ioactive.com/pdfs/AccoriaWebServer.pdf; http://www.kb.cert.org/vuls/id/245081; http://www.ioactive.com/pdfs/AccoriaWebServer.pdf
CVE: CVE-2010-2271
Published: 2010-06-15
Description: Format string vulnerability in authcfg.cgi in Accoria Web Server (aka Rock Web Server) 1.4.7 allows remote attackers to have an unspecified impact via format string specifiers in the path (aka Password File) parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://www.ioactive.com/pdfs/AccoriaWebServer.pdf; http://www.kb.cert.org/vuls/id/245081; http://www.ioactive.com/pdfs/AccoriaWebServer.pdf
CVE: CVE-2010-2272
Published: 2010-06-15
Description: Unspecified vulnerability in iframe_history.html in Dojo 0.4.x before 0.4.4 has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/; http://secunia.com/advisories/38964; http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/
CVE: CVE-2010-2273
Published: 2010-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.dojotoolkit.org/ticket/10773; http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/; http://secunia.com/advisories/38964
CVE: CVE-2010-2274
Published: 2010-06-15
Description: Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html.
CVSS Score: 4.3 (MEDIUM)
References: http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/; http://secunia.com/advisories/38964; http://secunia.com/advisories/40007
CVE: CVE-2010-2275
Published: 2010-06-15
Description: Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter, as demonstrated by an attack against dijit/tests/form/test_Button.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.dojotoolkit.org/ticket/10773; http://secunia.com/advisories/38964; http://secunia.com/advisories/40007
CVE: CVE-2010-2276
Published: 2010-06-15
Description: The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 has the copyTests=true and mini=false options, which makes it easier for remote attackers to have an unspecified impact via a request to a (1) test or (2) demo component.
CVSS Score: 10.0 (HIGH)
CWE: CWE-16
References: http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/; http://secunia.com/advisories/38964; http://secunia.com/advisories/40007
CVE: CVE-2010-2277
Published: 2010-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Connections 2.5.x before 2.5.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) create or (2) edit form in the Communities component, the (3) verbiage field in the Bookmarks component, or (4) unspecified vectors related to the Mobile Blogs component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40007; http://www-01.ibm.com/support/docview.wss?uid=swg21431472; http://www-1.ibm.com/support/docview.wss?uid=swg1LO47214
CVE: CVE-2010-2278
Published: 2010-06-15
Description: The bookmarklet pop-up in the Bookmarks component in IBM Lotus Connections 2.5.x before 2.5.0.2 does not properly follow the "force SSL" setting, which might make it easier for remote attackers to obtain the cleartext of network communication by sniffing the network, or spoof arbitrary servers via a man-in-the-middle attack.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/40007; http://www-01.ibm.com/support/docview.wss?uid=swg21431472; http://www-1.ibm.com/support/docview.wss?uid=swg1LO47429
CVE: CVE-2010-2279
Published: 2010-06-15
Description: The Top Updates implementation in the Homepage component in IBM Lotus Connections 2.5.x before 2.5.0.2, when "forced SSL" is enabled, uses http for links, which has unspecified impact and remote attack vectors.
CVSS Score: 7.6 (HIGH)
References: http://secunia.com/advisories/40007; http://www-01.ibm.com/support/docview.wss?uid=swg21431472; http://www-1.ibm.com/support/docview.wss?uid=swg1LO48325
CVE: CVE-2010-2280
Published: 2010-06-15
Description: Open redirect vulnerability in the Mobile component in IBM Lotus Connections 2.5.x before 2.5.0.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, related to "mobile edit actions," aka SPR ASRE83PPVH.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/40007; http://www-01.ibm.com/support/docview.wss?uid=swg21431472; http://www.vupen.com/english/advisories/2010/1281
CVE: CVE-2010-2281
Published: 2010-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS 2.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword or (2) bannerid parameter in conjunction with a /admin/ad/banner/list PATH_INFO; and allow remote authenticated users, with certain privileges, to inject arbitrary web script or HTML via the (3) title or (4) answers parameter in conjunction with a /admin/poll/add PATH_INFO, or the (5) name parameter in conjunction with a /admin/category/add PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/148/45/; http://secunia.com/advisories/39680; http://holisticinfosec.org/content/view/148/45/
CVE: CVE-2010-2282
Published: 2010-06-15
Description: Cross-site request forgery (CSRF) vulnerability in TomatoCMS 2.0.6 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://holisticinfosec.org/content/view/148/45/; http://secunia.com/advisories/39680; http://holisticinfosec.org/content/view/148/45/