Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2012-1779
Cross-site scripting (XSS) vulnerability in IDevSpot idev-BusinessDirectory 3.0 allows remote attackers to inject arbitrary web script or HTML via the SEARCH parameter to index.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/110212/idev-BusinessDirectory-3.0-Cross-Site-Scripting.html'}, {'name': 'idevbusinessdirectory-index-xss(73505)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73505'}, {'name': '79636', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79636'}, {'name': '48173', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48173'}, {'name': '52171', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52171'}]
CVE State: PUBLISHED
Explain CVE-2012-1780
SQL injection vulnerability in search.php in SocialCMS 1.0.5 allows remote attackers to execute arbitrary SQL commands via the category parameter.
Affected Products: n/a
References: [{'name': '44313', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44313'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/110043/SocialCMS-Cross-Site-Scripting-SQL-Injection.html'}, {'name': 'socialcms-commentajax-sql-injection(73440)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73440'}, {'name': '79458', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79458'}, {'name': '52109', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52109'}, {'name': '48082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48082'}]
CVE State: PUBLISHED
Explain CVE-2012-1781
Multiple cross-site scripting (XSS) vulnerabilities in ajax/commentajax.php in SocialCMS 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) TREF_email_address or (2) TR_name parameters.
Affected Products: n/a
References: [{'name': '79457', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79457'}, {'name': 'socialcms-search-xss(73442)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73442'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/110043/SocialCMS-Cross-Site-Scripting-SQL-Injection.html'}, {'name': '52109', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52109'}, {'name': '48082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48082'}]
CVE State: PUBLISHED
Explain CVE-2012-1782
Multiple cross-site scripting (XSS) vulnerabilities in questions/ask in OSQA 3b allow remote attackers to inject arbitrary web script or HTML via the (1) url bar or (2) picture bar.
Affected Products: n/a
References: [{'name': '52184', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52184'}, {'name': '20120227 OSQA CMS v3b - Multiple Persistent Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0164.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.vulnerability-lab.com/get_content.php?id=461'}]
CVE State: PUBLISHED
Explain CVE-2012-1783
Tiny Server 1.1.9 and earlier allows remote attackers to cause a denial of service (crash) via a long string in a GET request without an HTTP version number.
Affected Products: n/a
References: [{'name': '18524', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18524'}, {'name': 'tiny-http-dos(73482)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73482'}]
CVE State: PUBLISHED
Explain CVE-2012-1784
SQL injection vulnerability in MyJobList 0.1.3 allows remote attackers to execute arbitrary SQL commands via the eid parameter in a profile action to index.php.
Affected Products: n/a
References: [{'name': '52168', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52168'}, {'name': '79637', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79637'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/110225/MyJobList-0.1.3-SQL-Injection.html'}, {'name': '48169', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48169'}, {'name': 'myjoblist-index-sql-injection(73503)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73503'}]
CVE State: PUBLISHED
Explain CVE-2012-1785
kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors.
Affected Products: n/a
References: [{'name': 'videoembed-kgcallffmpeg-code-execution(73508)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73508'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://plugins.trac.wordpress.org/changeset?old_path=%2Fvideo-embed-thumbnail-generator&old=507924&new_path=%2Fvideo-embed-thumbnail-generator&new=507924'}, {'name': '52180', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52180'}, {'name': '48087', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48087'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/extend/plugins/video-embed-thumbnail-generator/changelog/'}]
CVE State: PUBLISHED
Explain CVE-2012-1786
The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.
Affected Products: n/a
References: [{'name': '52652', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52652'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://plugins.trac.wordpress.org/changeset?old_path=%2Fvideo-embed-thumbnail-generator&old=507924&new_path=%2Fvideo-embed-thumbnail-generator&new=507924'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/extend/plugins/video-embed-thumbnail-generator/changelog/'}]
CVE State: PUBLISHED
Explain CVE-2012-1787
Multiple cross-site scripting (XSS) vulnerabilities in wgarcmin.cgi in Webglimpse 2.20.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) FILE, or (3) DOMAIN parameters.
Affected Products: n/a
References: [{'name': 'webglimpse-wgarcmin-xss(73485)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73485'}, {'name': '79648', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79648'}, {'name': '48049', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48049'}, {'tags': ['x_refsource_MISC'], 'url': 'http://websecurity.com.ua/3089/'}, {'name': '52170', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52170'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/110219/Webglimpse-Brute-Force-Cross-Site-Scripting.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1788
Multiple cross-site scripting (XSS) vulnerabilities in wonderdesk.cgi in WonderDesk SQL 4.14 allow remote attackers to inject arbitrary web script or HTML via the (1) cus_email parameter in a cust_lostpw action; or (2) help_name, (3) help_email, (4) help_website, or (5) help_example_url parameters in an hd_modify_record action.
Affected Products: n/a
References: [{'name': '52193', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52193'}, {'name': 'wonderdesk-wonderdesk-xss(73502)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73502'}, {'tags': ['x_refsource_MISC'], 'url': 'http://st2tea.blogspot.com/2012/02/wonderdesk-cross-site-scripting.html'}, {'name': '79647', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79647'}, {'name': '48167', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48167'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/110224/WonderDesk-Cross-Site-Scripting.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1789
Multiple cross-site scripting (XSS) vulnerabilities in Kongreg8 1.7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) surname or (2) firstname parameters to modules/members/addmember.php; or (3) groupdescription or (4) groupname parameters to modules/groups/addgroupform.php.
Affected Products: n/a
References: [{'name': 'kongreg8-multiple-xss(73510)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73510'}, {'name': '20120224 Kongreg8 1.7.3 Mutiple XSS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0154.html'}, {'name': '52178', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52178'}]
CVE State: PUBLISHED
Explain CVE-2012-1790
Absolute path traversal vulnerability in Webgrind 1.0 and 1.0.2 allows remote attackers to read arbitrary files via a full pathname in the file parameter to index.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://code.google.com/p/webgrind/issues/detail?id=66'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5075.php'}, {'name': 'webgrind-index-file-include(73509)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73509'}, {'name': '18523', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18523'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/110216'}]
CVE State: PUBLISHED
Explain CVE-2012-1792
Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, which is not properly handled in an error message.  NOTE: this might not be a vulnerability, since the ability to access oscommerce/index.php during installation may already imply administrator privileges.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.trustwave.com/spiderlabs/advisories/TWSL2012-005.txt'}]
CVE State: PUBLISHED
Explain CVE-2012-1795
webglimpse.cgi in Webglimpse before 2.20.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter, as exploited in the wild in March 2012.
Affected Products: n/a
References: [{'name': 'VU#364363', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/364363'}, {'name': '1026825', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026825'}, {'name': '80344', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80344'}, {'name': '48452', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48452'}]
CVE State: PUBLISHED
Explain CVE-2012-1796
Unspecified vulnerability in IBM Tivoli Monitoring Agent (ITMA), as used in IBM DB2 9.5 before FP9 on UNIX, allows local users to gain privileges via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21586193'}, {'name': 'oval:org.mitre.oval:def:14526', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14526'}, {'name': 'IC79970', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IC79970'}, {'name': 'db2-itma-priv-esc(74325)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74325'}]
CVE State: PUBLISHED
Explain CVE-2012-1797
IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC79518'}, {'name': 'db2-nodes-unspecified(74326)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74326'}, {'name': 'oval:org.mitre.oval:def:14922', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14922'}, {'name': 'IC79518', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IC79518'}]
CVE State: PUBLISHED
Explain CVE-2012-1798
The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image.
Affected Products: n/a
References: [{'name': '55035', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55035'}, {'name': 'imagemagick-tiffexififd-dos(74659)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74659'}, {'name': '49068', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49068'}, {'name': 'openSUSE-SU-2012:0692', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2012-06/msg00001.html'}, {'name': '81023', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/81023'}, {'name': 'DSA-2462', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2462'}, {'name': '49063', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49063'}, {'name': '52898', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52898'}, {'name': 'RHSA-2012:0544', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0544.html'}, {'name': '48974', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48974'}, {'name': '49317', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49317'}, {'name': '1027032', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027032'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629'}]
CVE State: PUBLISHED
Explain CVE-2012-1799
The web server on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 does not limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.automation.siemens.com/WW/view/en/59869684'}, {'name': '81033', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81033'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-268149.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-05.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1800
Stack-based buffer overflow in the Profinet DCP protocol implementation on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 allows remote attackers to cause a denial of service (device outage) or possibly execute arbitrary code via a crafted DCP frame.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.automation.siemens.com/WW/view/en/59869684'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-268149.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-05.pdf'}, {'name': '81034', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81034'}]
CVE State: PUBLISHED
Explain CVE-2012-1801
Multiple stack-based buffer overflows in (1) COM and (2) ActiveX controls in ABB WebWare Server, WebWare SDK, Interlink Module, S4 OPC Server, QuickTeach, RobotStudio S4, and RobotStudio Lite allow remote attackers to execute arbitrary code via crafted input data.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-095-01A.pdf'}, {'name': '48693', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48693'}, {'name': '52888', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52888'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www05.abb.com/global/scot/scot348.nsf/veritydisplay/35df9dc4a94ae83ac12579ca0043acc1/%24file/SI10231A2%20rev%200.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1802
Buffer overflow in the embedded web server on the Siemens Scalance X Industrial Ethernet switch X414-3E before 3.7.1, X308-2M before 3.7.2, X-300EEC before 3.7.2, XR-300 before 3.7.2, and X-300 before 3.7.2 allows remote attackers to cause a denial of service (device reboot) or possibly execute arbitrary code via a malformed URL.
Affected Products: n/a
References: [{'name': '81032', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81032'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-04.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-130874.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1803
RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing a (1) TELNET, (2) remote shell (aka rsh), or (3) serial-console session.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.wired.com/threatlevel/2012/04/ruggedcom-backdoor/'}, {'name': '18779', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18779'}, {'name': 'ruggedcom-operating-system-backdoor(75120)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75120'}, {'name': 'VU#889195', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/889195'}, {'name': "20120423 RuggedCom - Backdoor Accounts in my SCADA network? You don't say...", 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-04/0186.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ruggedcom.com/productbulletin/ros-security-page/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-116-01A.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kb.cert.org/vuls/id/MAPG-8RCPEN'}, {'name': "20120423 RuggedCom - Backdoor Accounts in my SCADA network? You don't say...", 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2012/Apr/277'}, {'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-12-146-01A'}, {'tags': ['x_refsource_MISC'], 'url': 'http://arstechnica.com/business/news/2012/04/backdoor-in-mission-critical-hardware-threatens-power-traffic-control-systems.ars'}, {'name': '53215', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53215'}]
CVE State: PUBLISHED
Explain CVE-2012-1804
The OPC server in Progea Movicon before 11.3 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a crafted HTTP request.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-131-01.pdf'}, {'name': '49092', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49092'}, {'name': '81814', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81814'}, {'name': '53484', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53484'}]
CVE State: PUBLISHED
Explain CVE-2012-1805
Buffer overflow in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to execute arbitrary code via long strings in unspecified parameters.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf'}, {'name': 'koyo-ecom-bo(74875)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74875'}]
CVE State: PUBLISHED
Explain CVE-2012-1806
The ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 supports a maximum password length of 8 bytes, which makes it easier for remote attackers to obtain access via a brute-force attack.
Affected Products: n/a
References: [{'name': 'koyo-ecom-unauth-access(74876)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74876'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1807
Cross-site scripting (XSS) vulnerability in the web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1808
The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 does not require authentication, which allows remote attackers to perform unspecified functions via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf'}, {'name': 'koyo-ecom-unspecified(74878)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74878'}]
CVE State: PUBLISHED
Explain CVE-2012-1809
The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1810
EOSCoreScada.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to cause a denial of service (daemon restart) by sending data to TCP port (1) 5050 or (2) 24004.
Affected Products: n/a
References: [{'name': '51171', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51171'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-271-01.pdf'}, {'name': 'eoscada-eoscorescada-dos(79753)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/79753'}, {'name': '56364', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/56364'}]
CVE State: PUBLISHED
Explain CVE-2012-1811
EOSDataServer.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to cause a denial of service by sending a large amount of data to TCP port 24006.
Affected Products: n/a
References: [{'name': '51171', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51171'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-271-01.pdf'}, {'name': '56364', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/56364'}, {'name': 'eoscada-eosdataserver-dos(79754)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/79754'}]
CVE State: PUBLISHED
Explain CVE-2012-1812
eosfailoverservice.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to obtain sensitive cleartext information via a session on TCP port 12000.
Affected Products: n/a
References: [{'name': 'eoscada-eosfailoverservive-info-disc(79756)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/79756'}, {'name': '51171', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51171'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-271-01.pdf'}, {'name': '56364', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/56364'}]
CVE State: PUBLISHED
Explain CVE-2012-1813
eosfailoverservice.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to cause a denial of service by sending a large amount of data to TCP port 12000.
Affected Products: n/a
References: [{'name': 'eoscada-eosfailoverservice-dos(79755)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/79755'}, {'name': '51171', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51171'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-271-01.pdf'}, {'name': '56364', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/56364'}]
CVE State: PUBLISHED
Explain CVE-2012-1814
Cross-site scripting (XSS) vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '49210', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49210'}, {'name': '81996', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81996'}, {'name': '53591', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53591'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-138-01.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1815
SQL injection vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': '82011', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/82011'}, {'name': '49210', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49210'}, {'name': '53591', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53591'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-138-01.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1816
PORTSERV.exe in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to cause a denial of service (daemon crash) via a crafted (1) TCP or (2) UDP packet to port 111.
Affected Products: n/a
References: [{'name': '49210', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49210'}, {'name': '82012', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/82012'}, {'name': '53591', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53591'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-138-01.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1817
Buffer overflow in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via an invalid field in a project file.
Affected Products: n/a
References: [{'name': '49210', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49210'}, {'name': '53591', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53591'}, {'name': '82013', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/82013'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-138-01.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1818
An unspecified ActiveX control in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to overwrite arbitrary files via unknown vectors.
Affected Products: n/a
References: [{'name': '82014', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/82014'}, {'name': '49210', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49210'}, {'name': '53591', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53591'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-138-01.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1819
Untrusted search path vulnerability in WellinTech KingView 6.53 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://en.wellintech.com/news/detail.aspx?contentid=168'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-122-01.pdf'}, {'name': '53316', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53316'}, {'name': 'kingview-dll-code-execution(75309)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75309'}]
CVE State: PUBLISHED
Explain CVE-2012-1820
The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message.
Affected Products: n/a
References: [{'name': 'VU#962587', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/962587'}, {'name': 'RHSA-2012:1259', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1259.html'}, {'name': 'USN-1605-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1605-1'}, {'name': 'DSA-2497', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2497'}, {'name': '53775', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53775'}, {'name': '50941', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/50941'}]
CVE State: PUBLISHED
Explain CVE-2012-1821
The Network Threat Protection module in the Manager component in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.700x on Windows Server 2003 allows remote attackers to cause a denial of service (web-server outage, or daemon crash or hang) via a flood of packets that triggers automated blocking of network traffic.
Affected Products: n/a
References: [{'name': '82147', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/82147'}, {'name': 'VU#149070', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/149070'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_00'}, {'name': '1027092', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027092'}, {'name': '49221', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49221'}, {'name': '50358', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/50358'}]
CVE State: PUBLISHED
Explain CVE-2012-1824
Untrusted search path vulnerability in Measuresoft ScadaPro Client before 4.0.0 and ScadaPro Server before 4.0.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.measuresoft.net/downloads/Measuresoft%20SCADA%204.4.6/issue_disks/Client/DOCUMENTATION/ReleaseNotes.doc'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-145-01.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.measuresoft.net/downloads/Measuresoft%20SCADA%204.4.6/issue_disks/Server/DOCUMENTATION/ReleaseNotes.doc'}]
CVE State: PUBLISHED
Explain CVE-2012-1825
Multiple cross-site scripting (XSS) vulnerabilities in the status program on the ForeScout CounterACT appliance with software 6.3.3.2 through 6.3.4.10 allow remote attackers to inject arbitrary web script or HTML via (1) the loginname parameter in a forgotpass action or (2) the username parameter.
Affected Products: n/a
References: [{'name': 'VU#815532', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/815532'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kb.cert.org/vuls/id/MAPG-8TWMEJ'}]
CVE State: PUBLISHED
Explain CVE-2012-1826
dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.
Affected Products: n/a
References: [{'name': '53688', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53688'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://dotcms.com/dotCMSVersions/'}, {'name': 'VU#898083', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/898083'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/dotCMS/dotCMS/issues/281'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/dotCMS/dotCMS/issues/261'}, {'name': '82240', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/82240'}, {'name': '49276', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49276'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gist.github.com/2627440'}]
CVE State: PUBLISHED
Explain CVE-2012-1827
The web service in AutoFORM PDM Archive before 7.1 does not have authorization requirements, which allows remote authenticated users to perform database operations via a SOAP request, as demonstrated by the initializeQueryDatabase2 request.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kb.cert.org/vuls/id/MAPG-8RQL83'}, {'name': 'VU#773035', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/773035'}, {'name': '53716', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53716'}, {'name': '49335', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49335'}]
CVE State: PUBLISHED
Explain CVE-2012-1828
The administrative functions in AutoFORM PDM Archive before 7.1 do not have authorization requirements, which allows remote authenticated users to perform administrative actions by leveraging knowledge of a hidden function, as demonstrated by the password-change function.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kb.cert.org/vuls/id/MAPG-8RQL83'}, {'name': 'VU#773035', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/773035'}, {'name': '53716', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53716'}, {'name': '49335', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49335'}]
CVE State: PUBLISHED
Explain CVE-2012-1829
Multiple cross-site scripting (XSS) vulnerabilities in AutoFORM PDM Archive before 6.920 allow remote authenticated users to inject arbitrary web script or HTML via unspecified fields.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kb.cert.org/vuls/id/MAPG-8RQL83'}, {'name': 'VU#773035', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/773035'}, {'name': '53716', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53716'}, {'name': '49335', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49335'}]
CVE State: PUBLISHED
Explain CVE-2012-1830
Stack-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wellintech.com/index.php/news/33-patch-for-kingview653'}]
CVE State: PUBLISHED
Explain CVE-2012-1831
Heap-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wellintech.com/index.php/news/33-patch-for-kingview653'}]
CVE State: PUBLISHED
Explain CVE-2012-1832
WellinTech KingView 6.53 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted packet to (1) TCP or (2) UDP port 2001.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wellintech.com/index.php/news/33-patch-for-kingview653'}]
CVE State: PUBLISHED
Explain CVE-2012-1833
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
Affected Products: n/a
References: [{'name': '51113', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51113'}, {'name': '55763', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/55763'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.springsource.com/security/cve-2012-1833'}]
CVE State: PUBLISHED
Explain CVE-2012-1834
Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cms_tpv_view parameter to wp-admin/options-general.php.
Affected Products: n/a
References: [{'name': '48510', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48510'}, {'name': '80573', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/80573'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/extend/plugins/cms-tree-page-view/changelog/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23083'}, {'name': 'wordpress-cmstree-edit-xss(74337)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74337'}, {'name': '52708', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52708'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://plugins.trac.wordpress.org/changeset/523576/cms-tree-page-view'}]
CVE State: PUBLISHED
Explain CVE-2012-1835
Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php.
Affected Products: n/a
References: [{'name': '52986', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52986'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23082'}, {'name': '20120411 Multiple XSS vulnerabilities in All-in-One Event Calendar Plugin for WordPress', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-04/0071.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1836
Heap-based buffer overflow in dns.cpp in InspIRCd 2.0.5 might allow remote attackers to execute arbitrary code via a crafted DNS query that uses compression.
Affected Products: n/a
References: [{'name': '52561', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52561'}, {'name': '80263', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80263'}, {'name': 'DSA-2448', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2448'}, {'name': 'inspircd-dns-bo(74157)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74157'}, {'name': '48474', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48474'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/inspircd/inspircd/commit/fe7dbd2c104c37f6f3af7d9f1646a3c332aea4a4'}, {'name': 'VU#212651', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/212651'}]
CVE State: PUBLISHED
Explain CVE-2012-1837
The (1) webreports, (2) post/create-role, and (3) post/update-role programs in IBM Tivoli Endpoint Manager (TEM) before 8.2 do not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Affected Products: n/a
References: [{'name': '48352', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48352'}, {'name': 'tem-httponly-weak-security(74038)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74038'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21587743'}]
CVE State: PUBLISHED
Explain CVE-2012-1838
The web management interface on the LG-Nortel ELO GS24M switch allows remote attackers to bypass authentication, and consequently obtain cleartext credential and configuration information, via a direct request to a configuration web page.
Affected Products: n/a
References: [{'name': 'VU#523027', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/523027'}, {'name': '80370', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80370'}, {'name': 'lgnortel-switch-info-disclosure(74237)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74237'}]
CVE State: PUBLISHED
Explain CVE-2012-1839
Multiple directory traversal vulnerabilities in the Get Template feature in plugins/gui.ajax/class.AJXP_ClientDriver.php in AjaXplorer 3.2.x before 3.2.5 and 4.0.x before 4.0.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) pluginName or (2) pluginPath parameter in a get_template action. NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '48226', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48226'}, {'name': 'ajaxplorer-ajxpclientdriver-file-include(73671)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73671'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ajaxplorer.info/ajaxplorer-4-0-4/'}, {'name': '52298', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52298'}, {'name': 'VU#504019', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/504019'}, {'name': '79810', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79810'}]
CVE State: PUBLISHED
Explain CVE-2012-1840
AjaXplorer 3.2.x before 3.2.5 and 4.0.x before 4.0.4 does not properly perform cookie authentication, which allows remote attackers to obtain login access by leveraging knowledge of a password hash.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://ajaxplorer.info/ajaxplorer-4-0-4/'}, {'name': 'ajaxplorer-cookie-info-disc(74305)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74305'}, {'name': 'VU#504019', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/504019'}]
CVE State: PUBLISHED
Explain CVE-2012-1841
Absolute path traversal vulnerability in logShow.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to read arbitrary files via a full pathname in the file parameter.
Affected Products: n/a
References: [{'name': '48453', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48453'}, {'name': 'VU#913483', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/913483'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.kb.cert.org/vuls/id/MAPG-8NNKN8'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.kb.cert.org/vuls/id/MAPG-8NVRPY'}, {'name': '80226', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80226'}, {'name': '48403', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48403'}]
CVE State: PUBLISHED
Explain CVE-2012-1842
Cross-site scripting (XSS) vulnerability in checkQKMProg.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '48453', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48453'}, {'name': 'VU#913483', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/913483'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.kb.cert.org/vuls/id/MAPG-8NNKN8'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.kb.cert.org/vuls/id/MAPG-8NVRPY'}, {'name': '80239', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80239'}, {'name': '48403', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48403'}, {'name': '80225', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80225'}]
CVE State: PUBLISHED