Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2012-1513
The Web Configuration tool in VMware vCenter Orchestrator (vCO) 4.0 before Update 4, 4.1 before Update 2, and 4.2 before Update 1 places the vCenter Server password in an HTML document, which allows remote authenticated administrators to obtain sensitive information by reading this document.
Affected Products: n/a
References: [{'name': '52525', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52525'}, {'name': '48408', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48408'}, {'name': '80120', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80120'}, {'name': '1026816', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026816'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0005.html'}, {'name': 'vcenter-config-tool-info-disc(74091)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74091'}]
CVE State: PUBLISHED
Explain CVE-2012-1514
Cross-site request forgery (CSRF) vulnerability in VMware vShield Manager (vSM) 1.0.1 before Update 2 and 4.1.0 before Update 2 allows remote attackers to hijack the authentication of arbitrary users.
Affected Products: n/a
References: [{'name': '52525', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52525'}, {'name': 'vshield-manager-csrf(74092)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74092'}, {'name': '1026815', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026815'}, {'name': '80121', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80121'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0005.html'}, {'name': '48409', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48409'}]
CVE State: PUBLISHED
Explain CVE-2012-1515
VMware ESXi 3.5, 4.0, and 4.1 and ESX 3.5, 4.0, and 4.1 do not properly implement port-based I/O operations, which allows guest OS users to gain guest OS privileges by overwriting memory locations in a read-only memory block associated with the Virtual DOS Machine.
Affected Products: n/a
References: [{'name': 'TA12-164A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-164A.html'}, {'name': 'MS12-042', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-042'}, {'name': '52820', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52820'}, {'name': 'oval:org.mitre.oval:def:17110', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17110'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0006.html'}, {'name': 'oval:org.mitre.oval:def:15209', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15209'}, {'name': '1026875', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026875'}, {'name': 'vmware-esxserver-io-privilege-escalation(74480)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74480'}]
CVE State: PUBLISHED
Explain CVE-2012-1516
The VMX process in VMware ESXi 3.5 through 4.1 and ESX 3.5 through 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving data pointers.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:16810', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16810'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0009.html'}, {'name': '1027018', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027018'}, {'name': 'vmware-esxserver-rpc-priv-esc(75373)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75373'}, {'name': '53369', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53369'}]
CVE State: PUBLISHED
Explain CVE-2012-1517
The VMX process in VMware ESXi 4.1 and ESX 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving function pointers.
Affected Products: n/a
References: [{'name': '81692', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81692'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0009.html'}, {'name': '1027018', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027018'}, {'name': 'oval:org.mitre.oval:def:17231', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17231'}, {'name': '53369', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53369'}, {'name': 'vmware-rpc-commands-priv-esc(75374)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75374'}]
CVE State: PUBLISHED
Explain CVE-2012-1518
VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 use an incorrect ACL for the VMware Tools folder, which allows guest OS users to gain guest OS privileges via unspecified vectors.
Affected Products: n/a
References: [{'name': '48782', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48782'}, {'name': '81163', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81163'}, {'name': '1026922', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026922'}, {'name': '53006', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53006'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0007.html'}, {'name': 'oval:org.mitre.oval:def:16745', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16745'}, {'name': '1026923', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026923'}]
CVE State: PUBLISHED
Explain CVE-2012-1520
WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5485'}, {'name': 'APPLE-SA-2012-09-19-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5503'}, {'name': 'APPLE-SA-2012-09-12-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2012/Sep/msg00001.html'}, {'name': 'APPLE-SA-2012-07-25-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5400'}]
CVE State: PUBLISHED
Explain CVE-2012-1521
Use-after-free vulnerability in the XML parser in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2012/04/stable-channel-update_30.html'}, {'name': '48992', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48992'}, {'name': '1027001', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027001'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5485'}, {'name': 'APPLE-SA-2012-09-19-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5503'}, {'name': 'chrome-xml-parser-code-exec(75270)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75270'}, {'name': '81644', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81644'}, {'name': 'GLSA-201205-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201205-01.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/chromium/issues/detail?id=117110'}, {'name': 'APPLE-SA-2012-09-12-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2012/Sep/msg00001.html'}, {'name': 'APPLE-SA-2012-07-25-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html'}, {'name': 'oval:org.mitre.oval:def:15397', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15397'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5400'}, {'name': '53309', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53309'}]
CVE State: PUBLISHED
Explain CVE-2012-1522
Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Cached Object Remote Code Execution Vulnerability."
Affected Products: n/a
References: [{'name': 'MS12-044', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-044'}, {'name': 'TA12-192A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-192A.html'}, {'name': 'oval:org.mitre.oval:def:15464', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15464'}]
CVE State: PUBLISHED
Explain CVE-2012-1523
Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Center Element Remote Code Execution Vulnerability."
Affected Products: n/a
References: [{'name': 'TA12-164A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-164A.html'}, {'name': 'MS12-037', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037'}, {'name': 'oval:org.mitre.oval:def:15579', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15579'}]
CVE State: PUBLISHED
Explain CVE-2012-1524
Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Attribute Remove Remote Code Execution Vulnerability."
Affected Products: n/a
References: [{'name': 'MS12-044', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-044'}, {'name': 'TA12-192A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-192A.html'}, {'name': 'oval:org.mitre.oval:def:15595', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15595'}]
CVE State: PUBLISHED
Explain CVE-2012-1525
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:16422', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16422'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb12-16.html'}, {'name': 'GLSA-201308-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201308-03.xml'}]
CVE State: PUBLISHED
Explain CVE-2012-1526
Microsoft Internet Explorer 6 and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not initialized or (2) is deleted, aka "Layout Memory Corruption Vulnerability."
Affected Products: n/a
References: [{'name': 'MS12-052', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-052'}, {'name': 'oval:org.mitre.oval:def:15240', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15240'}, {'name': 'TA12-227A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-227A.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1527
Integer underflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 allows local users to gain privileges via a crafted briefcase, aka "Windows Briefcase Integer Underflow Vulnerability."
Affected Products: n/a
References: [{'name': 'MS12-072', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-072'}, {'name': '51221', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51221'}, {'name': 'TA12-318A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-318A.html'}, {'name': '1027748', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027748'}, {'name': 'oval:org.mitre.oval:def:15975', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15975'}]
CVE State: PUBLISHED
Explain CVE-2012-1528
Integer overflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 allows local users to gain privileges via a crafted briefcase, aka "Windows Briefcase Integer Overflow Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:15528', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15528'}, {'name': 'MS12-072', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-072'}, {'name': '51221', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51221'}, {'name': 'TA12-318A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-318A.html'}, {'name': '1027748', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027748'}]
CVE State: PUBLISHED
Explain CVE-2012-1529
Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly initialized or (2) is deleted, aka "OnMove Use After Free Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:15852', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15852'}, {'name': '1027555', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027555'}, {'name': '55641', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/55641'}, {'name': 'ms-ie-onmove-code-exec(78756)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/78756'}, {'name': 'TA12-255A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-255A.html'}, {'name': 'MS12-063', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-063'}]
CVE State: PUBLISHED
Explain CVE-2012-1530
Heap-based buffer overflow in the XSLT engine in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a PDF file containing an XSL file that triggers memory corruption when the lang function processes XML data with a crafted node-set.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2013:0044', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00004.html'}, {'name': '20130108 Adobe Reader and Acrobat XSLT node() and lang() Memory Corruption Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=1019'}, {'name': 'oval:org.mitre.oval:def:16094', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16094'}, {'name': 'SUSE-SU-2013:0047', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00005.html'}, {'name': 'openSUSE-SU-2013:0193', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-01/msg00081.html'}, {'name': 'openSUSE-SU-2013:0138', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-01/msg00028.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb13-02.html'}, {'name': 'RHSA-2013:0150', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0150.html'}, {'name': 'GLSA-201308-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201308-03.xml'}]
CVE State: PUBLISHED
Explain CVE-2012-1535
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb12-18.html'}, {'name': 'RHSA-2012:1203', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1203.html'}, {'name': 'GLSA-201209-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201209-01.xml'}, {'name': 'HPSBMU02948', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=139455789818399&w=2'}, {'name': 'SUSE-SU-2012:1001', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00012.html'}, {'name': 'openSUSE-SU-2012:0996', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00010.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1537
Heap-based buffer overflow in DirectPlay in DirectX 9.0 through 11.1 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a crafted Office document, aka "DirectPlay Heap Overflow Vulnerability."
Affected Products: n/a
References: [{'name': 'TA12-346A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-346A.html'}, {'name': 'MS12-082', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-082'}, {'name': 'oval:org.mitre.oval:def:16086', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16086'}]
CVE State: PUBLISHED
Explain CVE-2012-1538
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka "CFormElement Use After Free Vulnerability."
Affected Products: n/a
References: [{'name': '1027749', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027749'}, {'name': 'oval:org.mitre.oval:def:15677', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15677'}, {'name': 'MS12-071', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-071'}, {'name': '51202', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51202'}, {'name': 'TA12-318A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-318A.html'}, {'name': '56420', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/56420'}]
CVE State: PUBLISHED
Explain CVE-2012-1539
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka "CTreePos Use After Free Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:15886', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15886'}, {'name': '1027749', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027749'}, {'name': 'MS12-071', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-071'}, {'name': '56421', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/56421'}, {'name': '51202', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51202'}, {'name': 'TA12-318A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-318A.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1543
Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from a third party that the issue is due to an invalid type cast in the JSObject class.
Affected Products: n/a
References: [{'name': 'TA13-032A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA13-032A.html'}, {'name': 'VU#858729', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/858729'}, {'name': 'HPSBMU02874', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=136733161405818&w=2'}, {'name': '20130201 Oracle Java SE JavaFx JSObject Invalid Type Cast Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=1026'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html'}, {'name': 'oval:org.mitre.oval:def:16673', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16673'}, {'name': 'SSRT101184', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=136733161405818&w=2'}]
CVE State: PUBLISHED
Explain CVE-2012-1545
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service (memory corruption) by leveraging access to a Low integrity process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://pwn2own.zerodayinitiative.com/status.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://arstechnica.com/business/news/2012/03/ie-9-on-latest-windows-gets-stomped-at-hacker-contest.ars'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zdnet.com/blog/security/pwn2own-2012-ie-9-hacked-with-two-0day-vulnerabilities/10621'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/vupen/statuses/177895844828291073'}]
CVE State: PUBLISHED
Explain CVE-2012-1556
Cross-site scripting (XSS) vulnerability in Synology Photo Station 5 for DiskStation Manager (DSM) 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photo_one.php.
Affected Products: n/a
References: [{'name': 'photostation-photoone-xss(73976)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73976'}, {'name': '80034', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80034'}, {'name': '20120310 Synology Photo Station 5 - Reflected Cross-Site Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0045.html'}, {'name': '52416', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52416'}, {'name': '48334', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48334'}]
CVE State: PUBLISHED
Explain CVE-2012-1557
SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x before MU#13, 10.1.x before MU#22, 10.2.x before MU#16, and 10.3.x before MU#5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in March 2012.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.h-online.com/security/news/item/Bug-in-Plesk-administration-software-is-being-actively-exploited-1446587.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb.parallels.com/en/113321'}, {'name': '79769', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79769'}, {'name': '[oss-security] 20120308 CVE-request: Parallels Plesk Panel admin/plib/api-rpc/Agent.php Unspecified SQL Injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/08/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-windows-updates-release-notes.html#10216'}, {'name': 'plesk-unspec-unauth-access(73628)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73628'}, {'name': '48262', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48262'}, {'name': '52267', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52267'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-linux-updates-release-notes.html#10216'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cert.fi/haavoittuvuudet/2012/haavoittuvuus-2012-035.html'}, {'name': '1026760', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026760'}]
CVE State: PUBLISHED
Explain CVE-2012-1558
yaSSL CyaSSL before 2.0.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted X.509 certificate.
Affected Products: n/a
References: [{'name': '48634', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48634'}, {'name': 'cyassl-x509-dos(74095)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74095'}, {'name': '52828', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52828'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.yassl.com/yaSSL/Docs-cyassl-changelog.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1561
Cross-site scripting (XSS) vulnerability in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "checkbox and radio button functionalities."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1432320'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1432318'}, {'name': '[oss-security] 20120319 Re: CVE-request: Drupal Finder SA-CONTRIB-2012-017', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/19/9'}, {'name': '79015', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79015'}, {'name': '[oss-security] 20120316 CVE-request: Drupal Finder SA-CONTRIB-2012-017', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/16/9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.madirish.net/content/drupal-finder-6x-19-xss-and-remote-code-execution-vulnerabilities'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'name': '47941', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47941'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/finder.git/commit/58443aa'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/finder.git/commit/13e2d0c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1432970'}, {'name': 'drupal-finder-unspecified-xss(73110)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73110'}, {'name': '47943', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47943'}]
CVE State: PUBLISHED
Explain CVE-2012-1562
Joomla! core before 2.5.3 allows unauthorized password change.
Affected Products: Joomla! core
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/19/11'}, {'tags': ['x_refsource_MISC'], 'url': 'https://developer.joomla.org/security/news/394-20120304-core-password-change.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1563
Joomla! before 2.5.3 allows Admin Account Creation.
Affected Products: Joomla!
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/19/11'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.exploit-db.com/exploits/41156/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://developer.joomla.org/security/news/395-20120303-core-privilege-escalation.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1564
Cross-site scripting (XSS) vulnerability in administration/create_album.php in YVS Image Gallery allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '[oss-security] 20120319 Re: Case YVS Image Gallery', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/19/12'}, {'name': 'yvsimagegallery-createalbum-xsss(79529)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/79529'}, {'name': '[oss-security] 20120227 Case YVS Image Gallery', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/27/7'}, {'name': '[oss-security] 20120227 Re: Case YVS Image Gallery', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/27/27'}]
CVE State: PUBLISHED
Explain CVE-2012-1565
Unspecified vulnerability in ez Publish 4.1.4, 4.2, 4.3, 4.4, 4.5, and 4.6 has unknown impact and attack vectors related to an insecure direct object reference.
Affected Products: n/a
References: [{'name': 'ezpublish-unspec-vuln(74060)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74060'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.ez.no/19238'}, {'name': '48338', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48338'}, {'name': '80098', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80098'}, {'name': '[oss-security] 20120319 Re: CVE request: eZ Publish: insecure direct object reference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/19/13'}, {'name': '[oss-security] 20120319 CVE request: eZ Publish: insecure direct object reference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/19/6'}, {'name': '52516', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52516'}]
CVE State: PUBLISHED
Explain CVE-2012-1567
LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintUpdate.
Affected Products: Mint
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/19/14'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/linuxmint/mintupdate/blob/master/usr/lib/linuxmint/mintUpdate/mintUpdate.py#L1444'}]
CVE State: PUBLISHED
Explain CVE-2012-1568
The ExecShield feature in a certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 5 and 6 and Fedora 15 and 16 does not properly handle use of many shared libraries by a 32-bit executable file, which makes it easier for context-dependent attackers to bypass the ASLR protection mechanism by leveraging a predictable base address for one of these libraries.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://scarybeastsecurity.blogspot.com/2012/03/some-random-observations-on-linux-aslr.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://oss.oracle.com/git/?p=redpatch.git%3Ba=commit%3Bh=302a4fc15aebf202b6dffd6c804377c6058ee6e4'}, {'name': '[oss-security] 20120320 Re: CVE request -- kernel: execshield: predictable ascii armour base address', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/20/4'}, {'name': '[oss-security] 20120321 Re: CVE request -- kernel: execshield: predictable ascii armour base address', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/03/21/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=804947'}]
CVE State: PUBLISHED
Explain CVE-2012-1570
The resolver in MaraDNS before 1.3.0.7.15 and 1.4.x before 1.4.12 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
Affected Products: n/a
References: [{'name': '[oss-security] 20120320 Re: CVE request: maradns deleted domain record cache persistance flaw', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/20/10'}, {'name': 'maradns-domain-spoofing(74119)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74119'}, {'name': '[oss-security] 20120319 CVE request: maradns deleted domain record cache persistance flaw', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/20/1'}, {'name': '48492', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48492'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=804770'}, {'name': '80192', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80192'}, {'name': '1026821', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026821'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.maradns.org/changelog.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1571
file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer dereference.
Affected Products: n/a
References: [{'name': 'DSA-2422', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2422'}, {'name': 'MDVSA-2012:035', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:035'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/glensc/file/commit/1aec04dbf8a24b8a6ba64c4f74efa0628e36db0b'}, {'name': '[file] 20120221 file-5.11 is now available', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mx.gw.com/pipermail/file/2012/000914.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/glensc/file/commit/1859fdb4e67c49c463c4e0078054335cd46ba295'}, {'name': 'USN-2123-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2123-1'}]
CVE State: PUBLISHED
Explain CVE-2012-1572
OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
Affected Products: Keystone
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-1572'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1572'}]
CVE State: PUBLISHED
Explain CVE-2012-1574
The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.
Affected Products: n/a
References: [{'name': '20120405 [CVE-2012-1574] Apache Hadoop user impersonation vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2012/Apr/70'}, {'name': '48775', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48775'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html'}, {'name': '20120405 [CVE-2012-1574] Apache Hadoop user impersonation vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-04/0051.html'}, {'name': '48776', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48776'}, {'name': '52939', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52939'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin'}]
CVE State: PUBLISHED
Explain CVE-2012-1575
Multiple cross-site scripting (XSS) vulnerabilities in Cumin before r5238 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) widgets or (2) pages.
Affected Products: n/a
References: [{'name': '48810', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48810'}, {'name': '53000', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53000'}, {'name': '[cumin-developers] 20120306 r5238 - in trunk: cumin/python/cumin cumin/python/cumin/grid cumin/python/cumin/inventory cumin/python/cumin/messaging rosemary/python/rosemary wooly/python/wooly', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://fedorahosted.org/pipermail/cumin-developers/2012-March/000796.html'}, {'name': 'RHSA-2012:0476', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0476.html'}, {'name': 'cumin-redhat-unspec-xss(74844)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74844'}, {'name': 'RHSA-2012:0477', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0477.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=805712'}, {'name': '1026921', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026921'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/attachment.cgi?id=571986'}, {'name': '48829', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48829'}]
CVE State: PUBLISHED
Explain CVE-2012-1576
The myuser_delete function in libathemecore/account.c in Atheme 5.x before 5.2.7, 6.x before 6.0.10, and 7.x before 7.0.0-beta2 does not properly clean up CertFP entries when a user is deleted, which allows remote attackers to access a different user account or cause a denial of service (daemon crash) via a login as a deleted user.
Affected Products: n/a
References: [{'name': 'GLSA-201209-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201209-09.xml'}, {'name': '[oss-security] 20120322 Re: atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries may result in undefined behaviour', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/23/2'}, {'name': '[oss-security] 20120321 atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries may result in undefined behaviour', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/22/3'}, {'name': '20120321 atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries may result in undefined behaviour', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2012-03/0248.html'}, {'name': '50704', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/50704'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jira.atheme.org/browse/SRV-166'}, {'name': '52675', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52675'}, {'name': '48481', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48481'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.atheme.org/atheme/commit/?id=3d9551761db2'}]
CVE State: PUBLISHED
Explain CVE-2012-1577
lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.
Affected Products: dietlibc
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-1577'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/23/14'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdlib/random.c#rev1.16'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/ensc/dietlibc/blob/master/CHANGES'}]
CVE State: PUBLISHED
Explain CVE-2012-1578
Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or (2) unblock a user via a request to the Unblock module.
Affected Products: n/a
References: [{'name': 'mediawiki-multiple-csrf(78911)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/78911'}, {'name': '[oss-security] 20120323 CVEs for MediaWiki security and maintenance release 1.18.2', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/24/1'}, {'name': '[MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.18.2', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.html'}, {'name': '48504', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48504'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.wikimedia.org/show_bug.cgi?id=34212'}, {'name': '[MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.17.3', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html'}, {'name': '[oss-security] 20120322 MediaWiki security and maintenance release 1.18.2', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/22/9'}, {'name': '80361', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80361'}, {'name': '52689', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52689'}]
CVE State: PUBLISHED