deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-0010
Published: 2010-02-02
Description: Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0589.html; http://blog.pi3.com.pl/?p=69; http://httpd.apache.org/dev/dist/CHANGES_1.3.42
CVE: CVE-2010-0467
Published: 2010-02-02
Description: Directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a ccnewsletter action to index.php.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/38378; http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.html; http://www.exploit-db.com/exploits/11277
CVE: CVE-2010-0468
Published: 2010-02-02
Description: Cross-site scripting (XSS) vulnerability in utilities/longproc.cfm in PaperThin CommonSpot Content Server allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0601.html; http://osvdb.org/62087; http://www.securityfocus.com/archive/1/509239/100/0/threaded
CVE: CVE-2010-0469
Published: 2010-02-02
Description: SQL injection vulnerability in Files2Links F2L 3000 appliance 4.0.0, and possibly other versions and models, allows remote attackers to execute arbitrary SQL commands via unspecified parameters to the login page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0499.html; http://osvdb.org/61976; http://packetstormsecurity.org/1001-advisories/DDIVRT-2009-27.txt
CVE: CVE-2010-0470
Published: 2010-02-02
Description: Cross-site scripting (XSS) vulnerability in scvrtsrv.cmd in Comtrend CT-507IT ADSL Router allows remote attackers to inject arbitrary web script or HTML via the srvName parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1001-exploits/comtrend-xss.txt; http://secunia.com/advisories/38309; http://www.securityfocus.com/bid/38004
CVE: CVE-2010-0471
Published: 2010-02-02
Description: SQL injection vulnerability in the comment submission interface (includes/comment.php) in Enano CMS before 1.0.6pl1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://enanocms.org/Release_notes/1.0.6pl1; http://secunia.com/advisories/38253; http://www.osvdb.org/61974
CVE: CVE-2010-0442
Published: 2010-02-02
Description: The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-189
References: http://archives.postgresql.org/pgsql-committers/2010-01/msg00125.php; http://archives.postgresql.org/pgsql-hackers/2010-01/msg00634.php; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567058
CVE: CVE-2010-0472
Published: 2010-02-02
Description: kuddb2 in Tivoli Monitoring for DB2, as distributed in IBM DB2 9.7 FP1 on Linux, allows remote attackers to cause a denial of service (daemon crash) via a certain byte sequence.
CVSS Score: 5.0 (MEDIUM)
References: http://intevydis.blogspot.com/2010/01/ibm-db2-97-kuddb2-dos.html; http://www-01.ibm.com/support/docview.wss?uid=swg1IC68762; http://www-01.ibm.com/support/docview.wss?uid=swg21432298
CVE: CVE-2009-4184
Published: 2010-02-03
Description: Unspecified vulnerability in HP Enterprise Cluster Master Toolkit (ECMT) B.05.00 on HP-UX B.11.23 (11i v2) and HP-UX B.11.31 (11i v3) allows local users to gain access to an Oracle or Sybase database via unknown vectors.
CVSS Score: 6.2 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01894850; http://secunia.com/advisories/38423; http://www.securityfocus.com/bid/38035
CVE: CVE-2010-0185
Published: 2010-02-03
Description: The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://kb2.adobe.com/cps/807/cpsid_80719.html; http://osvdb.org/62037; http://secunia.com/advisories/38387
CVE: CVE-2010-0304
Published: 2010-02-03
Description: Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://anonsvn.wireshark.org/viewvc/trunk-1.2/epan/dissectors/packet-lwres.c?view=diff&r1=31596&r2=28492&diff_format=h; http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036415.html; http://osvdb.org/61987
CVE: CVE-2010-0308
Published: 2010-02-03
Description: lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://events.ccc.de/congress/2009/Fahrplan/attachments/1483_26c3_ipv4_fuckups.pdf; http://osvdb.org/62044; http://secunia.com/advisories/38451
CVE: CVE-2010-0440
Published: 2010-02-03
Description: Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048, and other versions before 3.5; as used in Cisco ASA appliance before 8.2(1), 8.1(2.7), and 8.0(5); allows remote attackers to inject arbitrary web script or HTML via a crafted POST parameter, which is not properly handled by an eval statement in binary/mainv.js that writes to start.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38397; http://tools.cisco.com/security/center/viewAlert.x?alertId=19843; http://www.coresecurity.com/content/cisco-secure-desktop-xss
CVE: CVE-2010-0453
Published: 2010-02-03
Description: The ucode_ioctl function in intel/io/ucode_drv.c in Sun Solaris 10 and OpenSolaris snv_69 through snv_133, when running on x86 architectures, allows local users to cause a denial of service (panic) via a request with a 0 size value to the UCODE_GET_VERSION IOCTL, which triggers a NULL pointer dereference in the ucode_get_rev function, related to retrieval of the microcode revision.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/62046; http://secunia.com/advisories/38452; http://sunsolve.sun.com/search/document.do?assetkey=1-21-143913-01-1
CVE: CVE-2009-3387
Published: 2010-02-03
Description: Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a different product category, which allows remote attackers to obtain sensitive information via a request for a bug in opportunistic circumstances.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/38443; http://www.securityfocus.com/archive/1/509282/100/0/threaded; http://www.securityfocus.com/bid/38026
CVE: CVE-2009-3989
Published: 2010-02-03
Description: Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/38443; http://www.securityfocus.com/archive/1/509282/100/0/threaded; http://www.securityfocus.com/bid/38025
CVE: CVE-2010-0038
Published: 2010-02-03
Description: Recovery Mode in Apple iPhone OS 1.0 through 3.1.2, and iPhone OS for iPod touch 1.1 through 3.1.2, allows physically proximate attackers to bypass device locking, and read or modify arbitrary data, via a USB control message that triggers memory corruption.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010/Feb/msg00000.html; http://osvdb.org/62128; http://support.apple.com/kb/HT4013
CVE: CVE-2010-0295
Published: 2010-02-03
Description: lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://blogs.sun.com/security/entry/cve_2010_0295_vulnerability_in; http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow_request_dos.patch; http://download.lighttpd.net/lighttpd/security/lighttpd-1.5_fix_slow_request_dos.patch
CVE: CVE-2010-0305
Published: 2010-02-03
Description: ejabberd_c2s.erl in ejabberd before 2.1.3 allows remote attackers to cause a denial of service (daemon crash) via a large number of c2s (aka client2server) messages that trigger a queue overload.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/38337; http://secunia.com/advisories/39423; http://www.debian.org/security/2010/dsa-2033
CVE: CVE-2010-0496
Published: 2010-02-03
Description: FreeBit ServersMan 3.1.5 on Apple iPhone OS 3.1.2, and iPhone OS for iPod touch, allows remote attackers to cause a denial of service (daemon crash) via a HEAD request for the / URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0580.html; http://secunia.com/advisories/38315; https://exchange.xforce.ibmcloud.com/vulnerabilities/55949
CVE: CVE-2009-2750
Published: 2010-02-04
Description: IBM WebSphere Service Registry and Repository (WSRR) 6.3.0 before FP2 does not have the intended configuration properties, which allows remote authenticated users to obtain unspecified data access via a property query.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-16
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IZ66279; http://www-01.ibm.com/support/docview.wss?uid=swg24025456; https://exchange.xforce.ibmcloud.com/vulnerabilities/55744
CVE: CVE-2009-4016
Published: 2010-02-04
Description: Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000891.html; http://secunia.com/advisories/38210; http://secunia.com/advisories/38381
CVE: CVE-2010-0300
Published: 2010-02-04
Description: cache.c in ircd-ratbox before 2.2.9 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a HELP command.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000891.html; http://secunia.com/advisories/38210; http://secunia.com/advisories/38383
CVE: CVE-2010-0301
Published: 2010-02-04
Description: main.C in maildrop 2.3.0 and earlier, when run by root with the -d option, uses the gid of root for execution of the .mailfilter file in a user's home directory, which allows local users to gain privileges via a crafted file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=564601; http://marc.info/?l=oss-security&m=[PII_REDACTED]8840&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]3920&w=2
CVE: CVE-2010-0303
Published: 2010-02-04
Description: mystring.c in hybserv in IRCD-Hybrid (aka Hybrid2 IRC Services) 1.9.2 through 1.9.4 allows remote attackers to cause a denial of service (daemon crash) via a ":help \t" private message to the MemoServ service.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550389; http://marc.info/?l=oss-security&m=[PII_REDACTED]5300&w=2; http://secunia.com/advisories/38350
CVE: CVE-2010-0441
Published: 2010-02-04
Description: Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service (daemon crash) via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is (1) missing, (2) modified to contain a negative number, or (3) modified to contain a large number.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.0.diff; http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.1.diff; http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.2.diff
CVE: CVE-2010-0443
Published: 2010-02-04
Description: Unspecified vulnerability in Record Management Services (RMS) before VMS83A_RMS-V1100 for HP OpenVMS on the Alpha platform allows local users to gain privileges via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0671&w=2; http://secunia.com/advisories/38366; http://www.securityfocus.com/bid/38048
CVE: CVE-2010-0547
Published: 2010-02-04
Description: client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://git.samba.org/?p=samba.git%3Ba=commit%3Bh=a065c177dfc8f968775593ba00dffafeebb2e054; http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
CVE: CVE-2010-0555
Published: 2010-02-04
Description: Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows remote attackers to bypass intended access restrictions and read arbitrary files via vectors involving the product's use of text/html as the default content type for files that are encountered after a redirection, aka the URLMON sniffing vulnerability, a variant of CVE-2009-1140 and related to CVE-2008-1448.
CVSS Score: 9.3 (HIGH)
References: http://blogs.technet.com/msrc/archive/2010/02/03/security-advisory-980088-released.aspx; http://isc.sans.org/diary.html?n&storyid=8152; http://osvdb.org/62157
CVE: CVE-2010-0255
Published: 2010-02-04
Description: Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows remote attackers to bypass intended access restrictions and read arbitrary files via vectors involving JavaScript exploit code that constructs a reference to a file://127.0.0.1 URL, aka the dynamic OBJECT tag vulnerability, as demonstrated by obtaining the data from an index.dat file, a variant of CVE-2009-1140 and related to CVE-2008-1448.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://blogs.technet.com/msrc/archive/2010/02/03/security-advisory-980088-released.aspx; http://isc.sans.org/diary.html?n&storyid=8152; http://osvdb.org/62156
CVE: CVE-2010-0548
Published: 2010-02-04
Description: Multiple unspecified vulnerabilities in the Network Controller and Web Server in Xerox WorkCentre 5632, 5638, 5645, 5655, 5665, 5675, and 5687 allow remote attackers to (1) access mailboxes via unknown vectors that bypass Scan to Mailbox authorization or (2) read device configuration information via via unknown vectors that bypass web server authorization.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/38139; http://www.vupen.com/english/advisories/2010/0209; http://www.xerox.com/downloads/usa/en/c/cert_XRX10-002_v1.0.pdf
CVE: CVE-2010-0549
Published: 2010-02-04
Description: Unspecified vulnerability in the Network Controller in Xerox WorkCentre 6400 System Software 060[PII_REDACTED]7 through 060[PII_REDACTED]0, and Net Controller[PII_REDACTED]0 through[PII_REDACTED]0, allows remote attackers to access "directory structure" via a crafted PostScript file, aka "Unauthorized Directory Structure Access Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/38339; http://www.securitytracker.com/id?1023500; http://www.vupen.com/english/advisories/2010/0208
CVE: CVE-2010-0550
Published: 2010-02-04
Description: admin.htm in Geo++ GNCASTER 1.4.0.7 and earlier does not properly enforce HTTP Digest Authentication, which allows remote authenticated users to use HTTP Basic Authentication, bypassing intended server policy.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/62013; http://secunia.com/advisories/38323; http://www.redteam-pentesting.de/en/advisories/rt-sa-2010-003/-geo-r-gncaster-faulty-implementation-of-http-digest-authentication
CVE: CVE-2010-0551
Published: 2010-02-04
Description: HTTP authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to read authentication headers of other users via a large request with an incorrect authentication attempt, which includes sensitive memory in the response.  NOTE: this is referred to as a "memory leak" by some sources, but is better characterized as "memory disclosure."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/62015; http://secunia.com/advisories/38323; http://www.redteam-pentesting.de/en/advisories/rt-sa-2010-003/-geo-r-gncaster-faulty-implementation-of-http-digest-authentication
CVE: CVE-2010-0552
Published: 2010-02-04
Description: Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via multiple requests for a non-existent file using a long URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/62011; http://secunia.com/advisories/38323; http://www.redteam-pentesting.de/en/advisories/rt-sa-2010-001/-geo-r-gncaster-insecure-handling-of-long-urls
CVE: CVE-2010-0553
Published: 2010-02-04
Description: Geo++ GNCASTER 1.4.0.7 and earlier allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a long NMEA data sentence.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/62012; http://secunia.com/advisories/38323; http://www.redteam-pentesting.de/en/advisories/rt-sa-2010-002/-geo-r-gncaster-insecure-handling-of-nmea-data
CVE: CVE-2010-0554
Published: 2010-02-04
Description: The HTTP Authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier uses the same nonce for all authentication, which allows remote attackers to hijack web sessions or bypass authentication via a replay attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/62014; http://secunia.com/advisories/38323; http://www.redteam-pentesting.de/en/advisories/rt-sa-2010-003/-geo-r-gncaster-faulty-implementation-of-http-digest-authentication
CVE: CVE-2003-1577
Published: 2010-02-05
Description: Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files, and conduct cross-site scripting (XSS) attacks involving the iPlanet Log Analyzer, via an HTTP request in conjunction with a crafted DNS response, related to an "Inverse Lookup Log Corruption (ILLC)" issue, a different vulnerability than CVE-2002-1315 and CVE-2002-1316.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://sunsolve.sun.com/search/document.do?assetkey=1-66-201453-1; http://www.securityfocus.com/archive/1/313867; https://exchange.xforce.ibmcloud.com/vulnerabilities/56632
CVE: CVE-2003-1578
Published: 2010-02-05
Description: Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to hide HTTP requests from the log-preview functionality by accompanying the requests with crafted DNS responses specifying a domain name beginning with a "format=" substring, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
CVSS Score: 4.3 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-66-201453-1; http://www.securityfocus.com/archive/1/313867; http://www.securityfocus.com/bid/7012
CVE: CVE-2003-1579
Published: 2010-02-05
Description: Sun ONE (aka iPlanet) Web Server 6 on Windows, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/archive/1/313867; http://www.securityfocus.com/archive/1/313867
CVE: CVE-2003-1580
Published: 2010-02-05
Description: The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/archive/1/313867; http://www.securityfocus.com/archive/1/313867
CVE: CVE-2003-1581
Published: 2010-02-05
Description: The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/313867; http://www.securityfocus.com/archive/1/313867
CVE: CVE-2003-1582
Published: 2010-02-05
Description: Microsoft Internet Information Services (IIS) 6.0, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/313867; http://www.securityfocus.com/archive/1/313867
CVE: CVE-2003-1583
Published: 2010-02-05
Description: Cross-site scripting (XSS) vulnerability in WebTrends allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/313867; https://exchange.xforce.ibmcloud.com/vulnerabilities/56650; http://www.securityfocus.com/archive/1/313867
CVE: CVE-2003-1584
Published: 2010-02-05
Description: Cross-site scripting (XSS) vulnerability in SurfStats allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/313867; https://exchange.xforce.ibmcloud.com/vulnerabilities/56649; http://www.securityfocus.com/archive/1/313867