deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-0057
Published: 2010-03-30
Description: AFP Server in Apple Mac OS X before 10.6.3 does not prevent guest use of AFP shares when guest access is disabled, which allows remote attackers to bypass intended access restrictions via a mount request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0058
Published: 2010-03-30
Description: freshclam in ClamAV in Apple Mac OS X 10.5.8 with Security Update 2009-005 has an incorrect launchd.plist ProgramArguments key and consequently does not run, which might allow remote attackers to introduce viruses into the system.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-16
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0059
Published: 2010-03-30
Description: CoreAudio in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted audio content with QDM2 encoding, which triggers a buffer overflow due to inconsistent length fields, related to QDCA.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; http://support.apple.com/kb/HT4077
CVE: CVE-2010-0533
Published: 2010-03-30
Description: Directory traversal vulnerability in AFP Server in Apple Mac OS X before 10.6.3 allows remote attackers to list a share root's parent directory, and read and modify files in that directory, via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0055
Published: 2010-03-30
Description: xar in Apple Mac OS X 10.5.8 does not properly validate package signatures, which allows attackers to have an unspecified impact via a modified package.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXQ3NRRTC4A3F3GW2RQNATJHYDIRSCBS/
CVE: CVE-2010-0060
Published: 2010-03-30
Description: CoreAudio in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted audio content with QDMC encoding.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; http://support.apple.com/kb/HT4077
CVE: CVE-2010-0062
Published: 2010-03-30
Description: Heap-based buffer overflow in quicktime.qts in CoreMedia and QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed .3g2 movie file with H.263 encoding that triggers an incorrect buffer length calculation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; http://support.apple.com/kb/HT4077
CVE: CVE-2010-0063
Published: 2010-03-30
Description: Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.6.3 makes it easier for user-assisted remote attackers to execute arbitrary JavaScript via a web page that offers a download with a Content-Type value that is not on the list of possibly unsafe content types for Safari, as demonstrated by the values for the (1) .ibplugin and (2) .url extensions.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0064
Published: 2010-03-30
Description: DesktopServices in Apple Mac OS X 10.6 before 10.6.3 preserves file ownership during an authenticated Finder copy, which might allow local users to bypass intended disk-quota restrictions and have unspecified other impact by copying files owned by other users.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0065
Published: 2010-03-30
Description: Disk Images in Apple Mac OS X before 10.6.3 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted disk image with bzip2 compression.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0497
Published: 2010-03-30
Description: Disk Images in Apple Mac OS X before 10.6.3 does not provide the expected warning for an unsafe file type in an internet enabled disk image, which makes it easier for user-assisted remote attackers to execute arbitrary code via a package file type.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0498
Published: 2010-03-30
Description: Directory Services in Apple Mac OS X before 10.6.3 does not properly perform authorization during processing of record names, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0500
Published: 2010-03-30
Description: Event Monitor in Apple Mac OS X before 10.6.3 does not properly validate hostnames of SSH clients, which allows remote attackers to cause a denial of service (arbitrary client blacklisting) via a crafted DNS PTR record, related to a "plist injection issue."
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0501
Published: 2010-03-30
Description: Directory traversal vulnerability in FTP Server in Apple Mac OS X Server before 10.6.3 allows remote authenticated users to read arbitrary files via crafted filenames.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0502
Published: 2010-03-30
Description: iChat Server in Apple Mac OS X Server before 10.6.3, when group chat is used, does not perform logging for all types of messages, which might allow remote attackers to avoid message auditing via an unspecified selection of message type.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0503
Published: 2010-03-30
Description: Use-after-free vulnerability in iChat Server in Apple Mac OS X Server 10.5.8 allows remote authenticated users to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0504
Published: 2010-03-30
Description: Multiple stack-based buffer overflows in iChat Server in Apple Mac OS X Server before 10.6.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0505
Published: 2010-03-30
Description: Heap-based buffer overflow in ImageIO in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JP2 (JPEG2000) image, related to incorrect calculation and the CGImageReadGetBytesAtOffset function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://www.securityfocus.com/archive/1/510539/100/0/threaded
CVE: CVE-2010-0506
Published: 2010-03-30
Description: Buffer overflow in Image RAW in Apple Mac OS X 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted NEF image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0507
Published: 2010-03-30
Description: Buffer overflow in Image RAW in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PEF image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0508
Published: 2010-03-30
Description: Mail in Apple Mac OS X before 10.6.3 does not disable the filter rules associated with a deleted mail account, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0509
Published: 2010-03-30
Description: SFLServer in OS Services in Apple Mac OS X before 10.6.3 allows local users to gain privileges via vectors related to use of wheel group membership during access to the home directories of user accounts.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0510
Published: 2010-03-30
Description: Password Server in Apple Mac OS X Server before 10.6.3 does not properly perform password replication, which might allow remote authenticated users to obtain login access via an expired password.
CVSS Score: 9.0 (HIGH)
CWE: CWE-255
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0511
Published: 2010-03-30
Description: Podcast Producer in Apple Mac OS X 10.6 before 10.6.3 deletes the access restrictions of a Podcast Composer workflow when this workflow is overwritten, which allows attackers to access a workflow via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0512
Published: 2010-03-30
Description: The Accounts Preferences implementation in Apple Mac OS X 10.6 before 10.6.3, when a network account server is used, does not support Login Window access control that is based solely on group membership, which allows attackers to bypass intended access restrictions by entering login credentials.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://www.securityfocus.com/bid/39153
CVE: CVE-2010-0513
Published: 2010-03-30
Description: Stack-based buffer overflow in PS Normalizer in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PostScript document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://osvdb.org/63409; http://support.apple.com/kb/HT4077
CVE: CVE-2010-0514
Published: 2010-03-30
Description: Heap-based buffer overflow in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.261 encoding.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; http://support.apple.com/kb/HT4077
CVE: CVE-2010-0515
Published: 2010-03-30
Description: QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with H.264 encoding.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; http://support.apple.com/kb/HT4077
CVE: CVE-2010-0516
Published: 2010-03-30
Description: Heap-based buffer overflow in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with RLE encoding, which triggers memory corruption when the length of decompressed data exceeds that of the allocated heap chunk.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; http://support.apple.com/kb/HT4077
CVE: CVE-2010-0517
Published: 2010-03-30
Description: Heap-based buffer overflow in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with M-JPEG encoding, which causes QuickTime to calculate a buffer size using height and width fields, but to use a different field to control the length of a copy operation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; http://support.apple.com/kb/HT4077
CVE: CVE-2010-0518
Published: 2010-03-30
Description: QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with Sorenson encoding.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; http://support.apple.com/kb/HT4077
CVE: CVE-2010-0519
Published: 2010-03-30
Description: Integer overflow in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a FlashPix image with a malformed SubImage Header Stream containing a NumberOfTiles field with a large value.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; http://support.apple.com/kb/HT4077
CVE: CVE-2010-0520
Published: 2010-03-30
Description: Heap-based buffer overflow in QuickTimeAuthoring.qtx in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FLC file, related to crafted DELTA_FLI chunks and untrusted length values in a .fli file, which are not properly handled during decompression.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; http://support.apple.com/kb/HT4077
CVE: CVE-2010-0521
Published: 2010-03-30
Description: Server Admin in Apple Mac OS X Server before 10.6.3 does not properly enforce authentication for directory binding, which allows remote attackers to obtain potentially sensitive information from Open Directory via unspecified LDAP requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0522
Published: 2010-03-30
Description: Server Admin in Apple Mac OS X Server 10.5.8 does not properly determine the privileges of users who had former membership in the admin group, which allows remote authenticated users to leverage this former membership to obtain a server connection via screen sharing.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0523
Published: 2010-03-30
Description: Wiki Server in Apple Mac OS X 10.5.8 does not restrict the file types of uploaded files, which allows remote attackers to obtain sensitive information or possibly have unspecified other impact via a crafted file, as demonstrated by a Java applet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0524
Published: 2010-03-30
Description: The default configuration of the FreeRADIUS server in Apple Mac OS X Server before 10.6.3 permits EAP-TLS authenticated connections on the basis of an arbitrary client certificate, which allows remote attackers to obtain network connectivity via a crafted RADIUS Access Request message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://www.securityfocus.com/bid/39234
CVE: CVE-2010-0525
Published: 2010-03-30
Description: Mail in Apple Mac OS X before 10.6.3 does not properly enforce the key usage extension during processing of a keychain that specifies multiple certificates for an e-mail recipient, which might make it easier for remote attackers to obtain sensitive information via a brute-force attack on a weakly encrypted e-mail message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0526
Published: 2010-03-30
Description: Heap-based buffer overflow in QuickTimeMPEG.qtx in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted genl atom in a QuickTime movie file with MPEG encoding, which is not properly handled during decompression.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html; http://support.apple.com/kb/HT4077
CVE: CVE-2010-0534
Published: 2010-03-30
Description: Wiki Server in Apple Mac OS X 10.6 before 10.6.3 does not enforce the service access control list (SACL) for weblogs during weblog creation, which allows remote authenticated users to publish content via HTTP requests.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0535
Published: 2010-03-30
Description: Dovecot in Apple Mac OS X 10.6 before 10.6.3, when Kerberos is enabled, does not properly enforce the service access control list (SACL) for sending and receiving e-mail, which allows remote authenticated users to bypass intended access restrictions via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0537
Published: 2010-03-30
Description: DesktopServices in Apple Mac OS X 10.6 before 10.6.3 does not properly resolve pathnames in certain circumstances involving an application's save panel, which allows user-assisted remote attackers to trigger unintended remote file copying via a crafted share name.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://support.apple.com/kb/HT4077; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2009-4763
Published: 2010-03-30
Description: Unspecified vulnerability in the ClickHeat plugin, as used in phpMyVisites before 2.4, has unknown impact and attack vectors.  NOTE: due to lack of details from the vendor, it is not clear whether this is related to CVE-2008-5793.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/38862; http://www.phpmyvisites.us/phpmv2/CHANGELOG; http://www.securityfocus.com/bid/38824
CVE: CVE-2010-1216
Published: 2010-03-30
Description: PHP remote file inclusion vulnerability in templates/template.php in notsoPureEdit 1.4.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://inj3ct0r.com/exploits/11393; http://secunia.com/advisories/39070; http://www.exploit-db.com/exploits/11832
CVE: CVE-2010-1217
Published: 2010-03-30
Description: Directory traversal vulnerability in the JE Form Creator (com_jeformcr) component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter to index.php. NOTE: the original researcher states that the affected product is JE Tooltip, not Form Creator; however, the exploit URL suggests that Form Creator is affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/63120; http://secunia.com/advisories/39063; http://www.exploit-db.com/exploits/11814
CVE: CVE-2010-1218
Published: 2010-03-30
Description: Cross-site scripting (XSS) vulnerability in the mm_forum extension 1.8.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/extensions/repository/view/mm_forum/1.8.3/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-007/; http://www.securityfocus.com/bid/38825