deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-0638
Published: 2011-01-25
Description: Microsoft Windows does not properly warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-16
References: http://news.cnet.com/8301-27080_3-20028919-245.html; http://www.blackhat.com/html/bh-dc-11/bh-dc-11-briefings.html#Stavrou; http://www.cs.gmu.edu/~astavrou/publications.html
CVE: CVE-2011-0639
Published: 2011-01-25
Description: Apple Mac OS X does not properly warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-16
References: http://news.cnet.com/8301-27080_3-20028919-245.html; http://www.blackhat.com/html/bh-dc-11/bh-dc-11-briefings.html#Stavrou; http://www.cs.gmu.edu/~astavrou/publications.html
CVE: CVE-2011-0640
Published: 2011-01-25
Description: The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.
CVSS Score: 6.9 (MEDIUM)
References: http://news.cnet.com/8301-27080_3-20028919-245.html; http://www.blackhat.com/html/bh-dc-11/bh-dc-11-briefings.html#Stavrou; http://www.cs.gmu.edu/~astavrou/publications.html
CVE: CVE-2010-4256
Published: 2011-01-25
Description: The pipe_fcntl function in fs/pipe.c in the Linux kernel before 2.6.37 does not properly determine whether a file is a named pipe, which allows local users to cause a denial of service via an F_SETPIPE_SZ fcntl call.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c66fb347946ebdd5b10908866ecc9fa05ee2cf3d; http://openwall.com/lists/oss-security/2010/11/30/6; http://openwall.com/lists/oss-security/2010/11/30/9
CVE: CVE-2011-0009
Published: 2011-01-25
Description: Best Practical Solutions RT 3.x before 3.8.9rc2 and 4.x before 4.0.0rc4 uses the MD5 algorithm for password hashes, which makes it easier for context-dependent attackers to determine cleartext passwords via a brute-force attack on the database.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610850; http://lists.bestpractical.com/pipermail/rt-announce/2011-January/000185.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054740.html
CVE: CVE-2011-0021
Published: 2011-01-25
Description: Multiple heap-based buffer overflows in cdg.c in the CDG decoder in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted CDG video.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://download.videolan.org/pub/videolan/vlc/1.1.6/vlc-1.1.6.tar.bz2; http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=f9b664eac0e1a7bceed9d7b5854fd9fc351b4aab; http://openwall.com/lists/oss-security/2011/01/19/6
CVE: CVE-2011-0641
Published: 2011-01-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) what1, (2) what2, (3) what3, (4) what4, and (5) what5 parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/70595; http://secunia.com/advisories/43016; http://www.securityfocus.com/bid/45950
CVE: CVE-2011-0642
Published: 2011-01-25
Description: Cross-site request forgery (CSRF) vulnerability in news/admin.php in N-13 News 3.4, 3.7, and 4.0 allows remote attackers to hijack the authentication of administrators for requests that create new users via the options action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/70593; http://secunia.com/advisories/42959; http://www.exploit-db.com/exploits/16013
CVE: CVE-2011-0643
Published: 2011-01-25
Description: Cross-site request forgery (CSRF) vulnerability in admin/conf_users_edit.php in PHP Link Directory (phpLD) 4.1.0 allows remote attackers to hijack the authentication of administrators for requests that add an administrator via the N action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/70627; http://secunia.com/advisories/43032; http://www.exploit-db.com/exploits/16037
CVE: CVE-2011-0644
Published: 2011-01-25
Description: SQL injection vulnerability in include/admin/model_field.class.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the modelid parameter to flash_upload.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/70598; http://secunia.com/advisories/43007; http://www.exploit-db.com/exploits/16019
CVE: CVE-2011-0645
Published: 2011-01-25
Description: SQL injection vulnerability in data.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the where_time parameter in a get action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/70655; http://securityreason.com/wlb_show/WLB[PII_REDACTED]; http://www.securityfocus.com/bid/45913
CVE: CVE-2011-0646
Published: 2011-01-25
Description: SQL injection vulnerability in viewfaqs.php in PHP LOW BIDS allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/70594; http://secunia.com/advisories/43008; http://www.exploit-db.com/exploits/16020
CVE: CVE-2010-4567
Published: 2011-01-28
Description: Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly handle whitespace preceding a (1) javascript: or (2) data: URI, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the URL (aka bug_file_loc) field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html; http://osvdb.org/70699
CVE: CVE-2010-4568
Published: 2011-01-28
Description: Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html; http://osvdb.org/70700
CVE: CVE-2010-4569
Published: 2011-01-28
Description: Cross-site scripting (XSS) vulnerability in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to inject arbitrary web script or HTML via the real name field of a user account, related to the AutoComplete widget in YUI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/70701; http://www.bugzilla.org/security/3.2.9/; http://www.securityfocus.com/bid/45982
CVE: CVE-2010-4570
Published: 2011-01-28
Description: Cross-site scripting (XSS) vulnerability in the duplicate-detection functionality in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to inject arbitrary web script or HTML via the summary field, related to the DataTable widget in YUI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/70702; http://www.bugzilla.org/security/3.2.9/; http://www.securityfocus.com/bid/45982
CVE: CVE-2010-4572
Published: 2011-01-28
Description: CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the query string, a different vulnerability than CVE-2010-2761 and CVE-2010-4411.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html; http://osvdb.org/70703
CVE: CVE-2010-4709
Published: 2011-01-28
Description: Heap-based buffer overflow in Automated Solutions Modbus/TCP Master OPC Server before 3.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a MODBUS response packet with a crafted length field.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://automatedsolutions.com/pub/asmbtcpopc/readme.htm; http://secunia.com/advisories/43029; http://www.exploit-db.com/exploits/16040
CVE: CVE-2011-0018
Published: 2011-01-28
Description: The email function in manage_sql.c in OpenVAS Manager 1.0.x through 1.0.3 and 2.0.x through 2.0rc2 allows remote authenticated users to execute arbitrary commands via the (1) To or (2) From e-mail address in an OMP request to the Greenbone Security Assistant (GSA).
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://osvdb.org/70639; http://secunia.com/advisories/43037; http://www.exploit-db.com/exploits/16086
CVE: CVE-2011-0046
Published: 2011-01-28
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hijack the authentication of arbitrary users for requests related to (1) adding a saved search in buglist.cgi, (2) voting in votes.cgi, (3) sanity checking in sanitycheck.cgi, (4) creating or editing a chart in chart.cgi, (5) column changing in colchange.cgi, and (6) adding, deleting, or approving a quip in quips.cgi.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html; http://osvdb.org/70705
CVE: CVE-2011-0048
Published: 2011-01-28
Description: Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the URL (aka bug_file_loc) field, which allows remote attackers to conduct cross-site scripting (XSS) attacks against logged-out users via a crafted URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html; http://osvdb.org/70704
CVE: CVE-2011-0343
Published: 2011-01-28
Description: Balabit syslog-ng 2.0, 3.0, 3.1, 3.2 OSE and PE, when running on FreeBSD or HP-UX, does not properly perform cast operations, which causes syslog-ng to use a default value of -1 to create log files with insecure permissions (07777), which allows local users to read and write to these log files.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608491; http://www.securityfocus.com/archive/1/515955/100/0/threaded; http://www.securityfocus.com/bid/45988
CVE: CVE-2011-0520
Published: 2011-01-28
Description: The compress_add_dlabel_points function in dns/Compress.c in MaraDNS 1.4.03, 1.4.05, and probably other versions allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long DNS hostname with a large number of labels, which triggers a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610834; http://osvdb.org/70630; http://secunia.com/advisories/43027
CVE: CVE-2011-0650
Published: 2011-01-28
Description: Cross-site request forgery (CSRF) vulnerability in Greenbone Security Assistant (GSA) before 2.0+rc3 allows remote attackers to hijack the authentication of users for requests that send email via an OMP request to OpenVAS Manager.  NOTE: this issue can be leveraged to bypass authentication requirements for exploiting CVE-2011-0018.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/43092; http://www.openvas.org/OVSA20110118.html; http://www.securityfocus.com/archive/1/515971/100/0/threaded
CVE: CVE-2011-0651
Published: 2011-01-28
Description: Buffer overflow in the key exchange functionality in Icon Labs Iconfidant SSL Server before 1.3.0 allows remote attackers to execute arbitrary code via a client master key packet in which the sum of unspecified length fields is greater than a certain value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/70599; http://secunia.com/advisories/42971; http://www.securityfocus.com/bid/45938
CVE: CVE-2011-0652
Published: 2011-01-28
Description: lnsfw1.sys 6.0.2900.5512 in Look 'n' Stop Firewall 2.06p4 and 2.07 allows local users to cause a denial of service (crash) via a crafted 0x80000064 IOCTL request that triggers an assertion failure.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://osvdb.org/70638; http://secunia.com/advisories/43044; http://www.exploit-db.com/exploits/16021
CVE: CVE-2010-4325
Published: 2011-01-28
Description: Buffer overflow in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP2 allows remote attackers to execute arbitrary code via a crafted TZID variable in a VCALENDAR message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/70676; http://secunia.com/advisories/43089; http://www.novell.com/support/viewContent.do?externalId=7007638&sliceId=1
CVE: CVE-2010-4326
Published: 2011-01-28
Description: Multiple buffer overflows in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via variables in a VCALENDAR message, as demonstrated by a long (1) REQUEST-STATUS, (2) TZNAME, (3) COMMENT, or (4) RRULE variable in this message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.facebook.com/note.php?note_id=[PII_REDACTED]28; http://www.novell.com/support/viewContent.do?externalId=7007155&sliceId=1; http://www.securityfocus.com/bid/45994
CVE: CVE-2010-4710
Published: 2011-01-28
Description: Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2.9.0 allows remote attackers to inject arbitrary web script or HTML via a field that is added to a menu, related to documentation that specifies this field as a text field rather than an HTML field, a similar issue to CVE-2010-4569 and CVE-2010-4570.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://yuilibrary.com/forum/viewtopic.php?p=12923; http://yuilibrary.com/projects/yui2/ticket/2529228; http://yuilibrary.com/projects/yui2/ticket/2529231
CVE: CVE-2011-0275
Published: 2011-01-28
Description: Unspecified vulnerability in HP OpenView Storage Data Protector 6.0, 6.10, and 6.11 allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 7.1 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02699143; http://osvdb.org/70657; http://secunia.com/advisories/43088
CVE: CVE-2011-0678
Published: 2011-01-28
Description: Unrestricted file upload vulnerability in the EasyEdit module in Lomtec ActiveWeb Professional 3.0 allows remote attackers to execute arbitrary code by uploading an executable file via the UploadDirectory and Accepted Extensions fields in the getImagefile component of EasyEdit.cfm.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/70669; http://secunia.com/advisories/43031; http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-002.html
CVE: CVE-2011-0679
Published: 2011-01-28
Description: IBM WebSphere Portal 6.0.1.1 through 7.0.0.0, as used in IBM Lotus Web Content Management (WCM) and IBM Lotus Quickr for WebSphere Portal, allows remote attackers to obtain sensitive information via a "modified message."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/70688; http://secunia.com/advisories/43081; http://www-01.ibm.com/support/docview.wss?uid=swg1PM22159
CVE: CVE-2010-2777
Published: 2011-01-28
Description: Stack-based buffer overflow in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise 7.x before 7.0 post-SP4 FTF and 8.x before 8.0 SP2 allows remote attackers to execute arbitrary code via a long mailbox name in a CREATE command.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://www.novell.com/support/viewContent.do?externalId=7006374&sliceId=1; http://zerodayinitiative.com/advisories/ZDI-10-129/; https://bugzilla.novell.com/show_bug.cgi?id=597331
CVE: CVE-2010-2778
Published: 2011-01-28
Description: Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise 7.x before 7.0 post-SP4 FTF and 8.x before 8.0 SP2 allows remote attackers to inject arbitrary web script or HTML via a crafted message, related to a "Javascript XSS exploit."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.novell.com/support/viewContent.do?externalId=7006375&sliceId=1; http://zerodayinitiative.com/advisories/ZDI-10-135/; https://bugzilla.novell.com/show_bug.cgi?id=599865
CVE: CVE-2010-2779
Published: 2011-01-28
Description: Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise 8.x before 8.0 SP2 allows remote attackers to inject arbitrary web script or HTML via a crafted message, related to "replies."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.novell.com/support/viewContent.do?externalId=7006376&sliceId=1; http://zerodayinitiative.com/advisories/ZDI-10-135/; https://bugzilla.novell.com/show_bug.cgi?id=599867
CVE: CVE-2010-3450
Published: 2011-01-28
Description: Multiple directory traversal vulnerabilities in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to overwrite arbitrary files via a .. (dot dot) in an entry in (1) an XSLT JAR filter description file, (2) an Extension (aka OXT) file, or unspecified other (3) JAR or (4) ZIP files.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://osvdb.org/70711; http://secunia.com/advisories/40775; http://secunia.com/advisories/42999
CVE: CVE-2010-3451
Published: 2011-01-28
Description: Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via malformed tables in an RTF document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://osvdb.org/70712; http://secunia.com/advisories/40775; http://secunia.com/advisories/42999
CVE: CVE-2010-3452
Published: 2011-01-28
Description: Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted tags in an RTF document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://osvdb.org/70713; http://secunia.com/advisories/40775; http://secunia.com/advisories/42999
CVE: CVE-2010-3453
Published: 2011-01-28
Description: The WW8ListManager::WW8ListManager function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle an unspecified number of list levels in user-defined list styles in WW8 data in a Microsoft Word document, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted .DOC file that triggers an out-of-bounds write.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://osvdb.org/70714; http://secunia.com/advisories/40775; http://secunia.com/advisories/42999
CVE: CVE-2010-3454
Published: 2011-01-28
Description: Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted typography information in a Microsoft Word .DOC file that triggers an out-of-bounds write.
CVSS Score: 9.3 (HIGH)
CWE: CWE-193
References: http://osvdb.org/70715; http://secunia.com/advisories/40775; http://secunia.com/advisories/42999
CVE: CVE-2010-3689
Published: 2011-01-28
Description: soffice in OpenOffice.org (OOo) 3.x before 3.3 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/70716; http://secunia.com/advisories/40775; http://secunia.com/advisories/42999
CVE: CVE-2010-4253
Published: 2011-01-28
Description: Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file in an ODF or Microsoft Office document, as demonstrated by a PowerPoint (aka PPT) document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://osvdb.org/70717; http://secunia.com/advisories/40775; http://secunia.com/advisories/42999
CVE: CVE-2010-4643
Published: 2011-01-28
Description: Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file in an ODF or Microsoft Office document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://osvdb.org/70718; http://secunia.com/advisories/40775; http://secunia.com/advisories/42999
CVE: CVE-2011-0348
Published: 2011-01-28
Description: Cisco IOS 12.4(11)MD, 12.4(15)MD, 12.4(22)MD, 12.4(24)MD before 12.4(24)MD3, 12.4(22)MDA before 12.4(22)MDA5, and 12.4(24)MDA before 12.4(24)MDA3 on the Cisco Content Services Gateway Second Generation (aka CSG2) allows remote attackers to bypass intended access restrictions and intended billing restrictions by sending HTTP traffic to a restricted destination after sending HTTP traffic to an unrestricted destination, aka Bug ID CSCtk35917.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/70720; http://secunia.com/advisories/43052; http://securitytracker.com/id?1024992
CVE: CVE-2011-0349
Published: 2011-01-28
Description: Unspecified vulnerability in Cisco IOS 12.4(24)MD before 12.4(24)MD2 on the Cisco Content Services Gateway Second Generation (aka CSG2) allows remote attackers to cause a denial of service (device hang or reload) via crafted TCP packets, aka Bug ID CSCth17178, a different vulnerability than CVE-2011-0350.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/70721; http://secunia.com/advisories/43052; http://securitytracker.com/id?1024992
CVE: CVE-2011-0350
Published: 2011-01-28
Description: Unspecified vulnerability in Cisco IOS 12.4(24)MD before 12.4(24)MD2 on the Cisco Content Services Gateway Second Generation (aka CSG2) allows remote attackers to cause a denial of service (device hang or reload) via crafted TCP packets, aka Bug ID CSCth41891, a different vulnerability than CVE-2011-0349.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/70722; http://secunia.com/advisories/43052; http://securitytracker.com/id?1024992
CVE: CVE-2010-4711
Published: 2011-01-31
Description: Double free vulnerability in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allows remote attackers to execute arbitrary code via a large parameter in a LIST command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://www.facebook.com/note.php?note_id=[PII_REDACTED]28; http://www.novell.com/support/viewContent.do?externalId=7007151&sliceId=1; http://zerodayinitiative.com/advisories/ZDI-10-242/