rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-2207 
Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-1295, CVE-2010-2202, CVE-2010-2209, CVE-2010-2210, CVE-2010-2211, and CVE-2010-2212.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-30T18:00:00.000Z
CVE-2010-2208 
Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, dereference a heap object after this object's deletion, which allows attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-30T18:00:00.000Z
CVE-2010-2209 
Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-1295, CVE-2010-2202, CVE-2010-2207, CVE-2010-2210, CVE-2010-2211, and CVE-2010-2212.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-30T18:00:00.000Z
CVE-2010-2210 
Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-1295, CVE-2010-2202, CVE-2010-2207, CVE-2010-2209, CVE-2010-2211, and CVE-2010-2212.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-30T18:00:00.000Z
CVE-2010-2211 
Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-1295, CVE-2010-2202, CVE-2010-2207, CVE-2010-2209, CVE-2010-2210, and CVE-2010-2212.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-30T18:00:00.000Z
CVE-2010-2212 
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a PDF file containing Flash content with a crafted #1023 (3FFh) tag, a different vulnerability than CVE-2010-1295, CVE-2010-2202, CVE-2010-2207, CVE-2010-2209, CVE-2010-2210, and CVE-2010-2211.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-30T18:00:00.000Z
CVE-2010-2213 
Adobe Flash Player before 9.0.280 and 10.x before 10.1.82.76, and Adobe AIR before 2.0.3, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-0209, CVE-2010-2214, and CVE-2010-2216.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-11T18:00:00.000Z
CVE-2010-2214 
Adobe Flash Player before 9.0.280 and 10.x before 10.1.82.76, and Adobe AIR before 2.0.3, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-0209, CVE-2010-2213, and CVE-2010-2216.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-11T18:00:00.000Z
CVE-2010-2215 
Adobe Flash Player before 9.0.280 and 10.x before 10.1.82.76, and Adobe AIR before 2.0.3, allows attackers to trick a user into (1) selecting a link or (2) completing a dialog, related to a "click-jacking" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-11T18:00:00.000Z
CVE-2010-2216 
Adobe Flash Player before 9.0.280 and 10.x before 10.1.82.76, and Adobe AIR before 2.0.3, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-0209, CVE-2010-2213, and CVE-2010-2214.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-11T18:00:00.000Z
CVE-2010-2217 
Adobe Flash Media Server (FMS) before 3.0.6, and 3.5.x before 3.5.4, allows attackers to execute arbitrary code via unspecified vectors, related to a "JS method vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-11T18:00:00.000Z
CVE-2010-2218 
Adobe Flash Media Server (FMS) before 3.0.6, and 3.5.x before 3.5.4, allows attackers to cause a denial of service via unspecified vectors, related to a "JS method issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-11T18:00:00.000Z
CVE-2010-2219 
Unspecified vulnerability in Adobe Flash Media Server (FMS) before 3.0.6, and 3.5.x before 3.5.4, allows attackers to cause a denial of service (memory consumption) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-11T18:00:00.000Z
CVE-2010-2220 
Adobe Flash Media Server (FMS) before 3.0.6, and 3.5.x before 3.5.4, allows attackers to cause a denial of service via unspecified vectors, related to an "input validation issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-11T18:00:00.000Z
CVE-2010-2221 
Multiple buffer overflows in the iSNS implementation in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) before 1.0.6, (2) iSCSI Enterprise Target (aka iscsitarget or IET) 1.4.20.1 and earlier, and (3) Generic SCSI Target Subsystem for Linux (aka SCST or iscsi-scst) 1.0.1.1 and earlier allow remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via (a) a long iSCSI Name string in an SCN message or (b) an invalid PDU.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-08T18:00:00.000Z
CVE-2010-2222 
The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows attackers to cause a denial of service (NULL pointer dereference) via a crafted search query.
Problem types: description: Other
Affected products: vendor: Red Hat
product: Red Hat Directory Server
Published: 2019-11-05T19:27:47.000Z
CVE-2010-2223 
Virtual Desktop Server Manager (VDSM) in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H or rhev-hypervisor) before 5.5-2.2 does not properly perform VM post-zeroing after the removal of a virtual machine's data, which allows guest OS users to obtain sensitive information by examining the disk blocks associated with a deleted virtual machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-24T17:00:00.000Z
CVE-2010-2224 
The snapshot merging functionality in Red Hat Enterprise Virtualization Manager (aka RHEV-M) before 2.2 does not properly pass the postzero parameter during operations on deleted volumes, which allows guest OS users to obtain sensitive information by examining the disk blocks associated with a deleted virtual machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-24T17:00:00.000Z
CVE-2010-2225 
Use-after-free vulnerability in the SplObjectStorage unserializer in PHP 5.2.x and 5.3.x through 5.3.2 allows remote attackers to execute arbitrary code or obtain sensitive information via serialized data, related to the PHP unserialize function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-23T18:00:00.000Z
CVE-2010-2226 
The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-03T19:00:00.000Z
CVE-2010-2227 
Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-13T17:00:00.000Z
CVE-2010-2228 
Cross-site scripting (XSS) vulnerability in the MNET access-control interface in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to inject arbitrary web script or HTML via vectors involving extended characters in a username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T17:00:00.000Z
CVE-2010-2229 
Multiple cross-site scripting (XSS) vulnerabilities in blog/index.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T17:00:00.000Z
CVE-2010-2230 
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T17:00:00.000Z
CVE-2010-2231 
Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T17:00:00.000Z
CVE-2010-2232 
In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.
Problem types: description: n/a
Affected products: vendor: Apache Software Foundation
product: Apache Derby
Published: 2017-10-23T13:00:00.000Z
CVE-2010-2233 
tif_getimage.c in LibTIFF 3.9.0 and 3.9.2 on 64-bit platforms, as used in ImageMagick, does not properly perform vertical flips, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TIFF image, related to "downsampled OJPEG input."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-01T18:00:00.000Z
CVE-2010-2234 
Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators for direct requests to an installation URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-19T20:00:00.000Z
CVE-2010-2235 
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-09T19:00:00.000Z
CVE-2010-2236 
The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through 5.3.0, and Proxy 5.3.0, allows remote authenticated users with permissions to administer monitoring probes to execute arbitrary code via unspecified vectors, related to backticks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T18:00:00.000Z
CVE-2010-2237 
Red Hat libvirt, possibly 0.6.1 through 0.8.2, looks up disk backing stores without referring to the user-defined main disk format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-19T17:43:00.000Z
CVE-2010-2238 
Red Hat libvirt, possibly 0.7.2 through 0.8.2, recurses into disk-image backing stores without extracting the defined disk backing-store format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-19T17:43:00.000Z
CVE-2010-2239 
Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the host OS via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-19T17:43:00.000Z
CVE-2010-2240 
The do_anonymous_page function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before 2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the heap, which allows context-dependent attackers to execute arbitrary code by writing to the bottom page of a shared memory segment, as demonstrated by a memory-exhaustion attack against the X.Org X server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-03T19:00:00.000Z
CVE-2010-2241 
The (1) setup-ds.pl and (2) setup-ds-admin.pl setup scripts for Red Hat Directory Server 8 before 8.2 use world-readable permissions when creating cache files, which allows local users to obtain sensitive information including passwords for Directory and Administration Server administrative accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-17T17:31:00.000Z
CVE-2010-2242 
Red Hat libvirt 0.2.0 through 0.8.2 creates iptables rules with improper mappings of privileged source ports, which allows guest OS users to bypass intended access restrictions by leveraging IP address and source-port values, as demonstrated by copying and deleting an NFS directory tree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-19T17:43:00.000Z
CVE-2010-2243 
A vulnerability exists in kernel/time/clocksource.c in the Linux kernel before 2.6.34 where on non-GENERIC_TIME systems (GENERIC_TIME=n), accessing /sys/devices/system/clocksource/clocksource0/current_clocksource results in an OOPS.
Problem types: description: oops
Affected products: vendor: linux-2.6
product: linux-2.6
Published: 2019-11-07T16:43:17.000Z
CVE-2010-2244 
The AvahiDnsPacket function in avahi-core/socket.c in avahi-daemon in Avahi 0.6.16 and 0.6.25 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNS packet with an invalid checksum followed by a DNS packet with a valid checksum, a different vulnerability than CVE-2008-5081.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-07T18:00:00.000Z
CVE-2010-2245 
XML External Entity (XXE) vulnerability in Apache Wink 1.1.1 and earlier allows remote attackers to read arbitrary files or cause a denial of service via a crafted XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-08T21:00:00.000Z
CVE-2010-2246 
feh before 1.8, when the --wget-timestamp option is enabled, might allow remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-26T18:00:00.000Z
CVE-2010-2247 
makepasswd 1.10 default settings generate insecure passwords
Problem types: description: insecure passwords generated with default settings
Affected products: vendor: makepasswd
product: makepasswd
Published: 2019-11-06T16:55:41.000Z
CVE-2010-2248 
fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel before 2.6.34-rc4 allows remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value, as demonstrated by a response from an OS/2 server, related to the CIFSSMBWrite and CIFSSMBWrite2 functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T16:30:00.000Z
CVE-2010-2249 
Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-30T18:00:00.000Z
CVE-2010-2250 
Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack.
Problem types: description: cross site scripting
Affected products: vendor: drupal6
product: drupal6
Published: 2019-11-07T17:49:32.000Z
CVE-2010-2251 
The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-06T14:00:00.000Z
CVE-2010-2252 
GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-06T14:00:00.000Z
CVE-2010-2253 
lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-06T14:00:00.000Z
CVE-2010-2254 
SQL injection vulnerability in the Shape5 Bridge of Hope template for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an article action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-09T20:00:00.000Z
CVE-2010-2255 
SQL injection vulnerability in the BF Survey Pro (com_bfsurvey_pro) component before 1.3.1, BF Survey Pro Free (com_bfsurvey_profree) component 1.2.6, and BF Survey Basic component before 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-09T20:00:00.000Z
CVE-2010-2256 
Multiple cross-site scripting (XSS) vulnerabilities in Pay Per Minute Video Chat Script 2.0 and 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/memberviewdetails.php and the (2) model parameter to videos.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-09T20:00:00.000Z
CVE-2010-2257 
SQL injection vulnerability in index_ie.php in Pay Per Minute Video Chat Script 2.0 and 2.1 allows remote attackers to execute arbitrary SQL commands via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-09T20:00:00.000Z
CVE-2010-2258 
Cross-site scripting (XSS) vulnerability in signupconfirm.php in phpBannerExchange 1.2 Arabic allows remote attackers to inject arbitrary web script or HTML via the bannerurl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-09T20:00:00.000Z
CVE-2010-2259 
Directory traversal vulnerability in the BF Survey (com_bfsurvey) component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-09T20:00:00.000Z
CVE-2010-2260 
Multiple cross-site scripting (XSS) vulnerabilities in Gambit Design Bandwidth Meter, 0.72 and possibly 1.2, allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) view_by_name.php or (2) view_by_ip.php in admin/.  NOTE: some sources report that the affected product is ShaPlus Bandwidth Meter, but this is incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-09T20:00:00.000Z
CVE-2010-2261 
Linksys WAP54Gv3 firmware 3.04.03 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) data2 and (2) data3 parameters to (a) Debug_command_page.asp and (b) debug.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-10T00:00:00.000Z
CVE-2010-2262 
Galileo Students Team Weborf before 0.12.1 allows remote attackers to cause a denial of service (crash) via a crafted Range header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-10T00:00:00.000Z
CVE-2010-2263 
nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-14T18:00:00.000Z
CVE-2010-2264 
The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-11T19:00:00.000Z
CVE-2010-2265 
Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windows XP and Windows Server 2003 allows remote attackers to inject arbitrary web script or HTML via the svr parameter to sysinfo/sysinfomain.htm.  NOTE: this can be leveraged with CVE-2010-1885 to execute arbitrary commands without user interaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-14T18:00:00.000Z
CVE-2010-2266 
nginx 0.8.36 allows remote attackers to cause a denial of service (crash) via certain encoded directory traversal sequences that trigger memory corruption, as demonstrated using the "%c0.%c0." sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-14T18:00:00.000Z
CVE-2010-2267 
Multiple cross-site scripting (XSS) vulnerabilities in Accoria Web Server (aka Rock Web Server) 1.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the getenv sample program, (2) the desc parameter to loadstatic.cgi, (3) the name parameter to httpdcfg.cgi, or (4) the dns parameter to servercfg.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-14T19:00:00.000Z