Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2011-1319
The Security component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15 allows remote authenticated users to cause a denial of service (memory consumption) by using a Lightweight Third-Party Authentication (LTPA) token for authentication.
Affected Products: n/a
References: [{'name': 'PM18644', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PM18644'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27014463'}]
CVE State: PUBLISHED
Explain CVE-2011-1320
The Security component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15, when the Tivoli Integrated Portal / embedded WebSphere Application Server (TIP/eWAS) framework is used, does not properly delete AuthCache entries upon a logout, which might allow remote attackers to access the server by leveraging an unattended workstation.
Affected Products: n/a
References: [{'name': 'PM21536', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PM21536'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27014463'}]
CVE State: PUBLISHED
Explain CVE-2011-1321
The AuthCache purge implementation in the Security component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.37 and 7.x before 7.0.0.15 does not purge a user from the PlatformCredential cache, which might allow remote authenticated users to gain privileges by leveraging a group membership specified in an old RACF Object (aka RACO).
Affected Products: n/a
References: [{'name': 'PM24668', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PM24668'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27014463'}]
CVE State: PUBLISHED
Explain CVE-2011-1322
The SOAP with Attachments API for Java (SAAJ) implementation in the Web Services component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.37 and 7.x before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) via encrypted SOAP messages.
Affected Products: n/a
References: [{'name': 'PM19534', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PM19534'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27014463'}]
CVE State: PUBLISHED
Explain CVE-2011-1323
Yamaha RTX, RT, SRT, RTV, RTW, and RTA series routers with firmware 6.x through 10.x, and NEC IP38X series routers with firmware 6.x through 10.x, do not properly handle IP header options, which allows remote attackers to cause a denial of service (device reboot) via a crafted option that triggers access to an invalid memory location.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN55714408.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.nec.co.jp/security-info/secinfo/nv11-004.html'}, {'name': 'JVN#55714408', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN55714408/index.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1324
Multiple cross-site request forgery (CSRF) vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHR-4RV and FS-G54 routers with firmware 2.x; and AS-100 routers allow remote attackers to hijack the authentication of administrators for requests that modify settings, as demonstrated by changing the login password.
Affected Products: n/a
References: [{'name': 'JVN#50505257', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN50505257/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://buffalo.jp/support_s/20080808/csrf.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1325
Cross-site request forgery (CSRF) vulnerability in EC-CUBE before 2.11.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2011-000029', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000029'}, {'name': '44487', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44487'}, {'name': 'JVN#37878530', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN37878530/index.html'}, {'name': '72239', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/72239'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ec-cube.net/press/detail.php?press_id=114'}]
CVE State: PUBLISHED
Explain CVE-2011-1326
Unspecified vulnerability on the La Fonera+ router with firmware before 1.7.0.1 allows remote attackers to cause a denial of service via unknown vectors.
Affected Products: n/a
References: [{'name': 'lafoneraplus-unspecified-dos(67405)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/67405'}, {'name': 'JVNDB-2011-000027', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000027'}, {'name': '44508', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44508'}, {'name': '47801', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47801'}, {'name': 'JVN#96839637', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN96839637/index.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1327
The Keystroke Encryption feature in Trend Micro Internet Security 2009 (aka Virus Buster 2009 and PC-cillin 2009) does not completely encrypt passwords, which allows local users to obtain sensitive information by leveraging a keylogger.
Affected Products: n/a
References: [{'name': 'JVN#99175647', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN99175647/index.html'}, {'name': 'JVNDB-2011-000028', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000028'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://esupport.trendmicro.co.jp/Pages/JP-2079186.aspx'}]
CVE State: PUBLISHED
Explain CVE-2011-1328
SQL injection vulnerability in RADVISION iVIEW Suite before 7.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2011-000030', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000030'}, {'name': 'JVN#77697803', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN77697803/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN77697803/995139/index.html'}, {'name': 'iview-scopia-unspecified-sql-injection(67556)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/67556'}, {'name': '72410', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/72410'}, {'name': '44634', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44634'}]
CVE State: PUBLISHED
Explain CVE-2011-1329
WalRack 1.x before 1.1.9 and 2.x before 2.0.7 does not properly restrict file uploads, which allows remote attackers to execute arbitrary PHP code via vectors involving a double extension, as demonstrated by a .php.zzz file.
Affected Products: n/a
References: [{'name': 'JVN#46984044', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN46984044/index.html'}, {'name': '48001', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/48001'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://digit.que.ne.jp/work/index.cgi?WalRack2'}, {'name': 'walrack-uploaded-files-code-exec(67641)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/67641'}, {'name': 'JVNDB-2011-000032', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000032'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN46984044/54827/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://digit.que.ne.jp/work/index.cgi?WalRack'}]
CVE State: PUBLISHED
Explain CVE-2011-1330
Cross-site scripting (XSS) vulnerability in WeblyGo 5.0 Pro/LE, 5.02 Pro/LE, 5.03 Pro/LE, 5.04 Pro/LE, and 5.10 Pro/LE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '48338', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/48338'}, {'name': 'JVN#43386477', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN43386477/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kbs.co.jp/jp/tabid/254/Default.aspx'}, {'name': 'JVNDB-2011-000042', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000042'}, {'name': '44994', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44994'}]
CVE State: PUBLISHED
Explain CVE-2011-1331
JustSystems Ichitaro 2005 through 2011, Ichitaro Government 6, Ichitaro Government 2006 through 2010, Ichitaro Portable, Ichitaro Pro, and Ichitaro Viewer allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted document, as exploited in the wild in early 2011.
Affected Products: n/a
References: [{'name': '44956', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44956'}, {'name': '48283', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/48283'}, {'name': 'JVNDB-2011-000043', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000043'}, {'name': 'ichitaro-unspec-bo(68072)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/68072'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.justsystems.com/jp/info/js11001.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.symantec.com/connect/blogs/targeted-attacks-2011-using-ichitaro-zero-day-vulnerability'}, {'name': 'JVN#87239473', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN87239473/index.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1332
Cross-site scripting (XSS) vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2008-6570.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cybozu.co.jp/products/dl/notice/detail/0023.html'}, {'name': 'JVNDB-2011-000044', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000044'}, {'name': 'JVN#59779256', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN59779256/index.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1333
Cross-site scripting (XSS) vulnerability in Cybozu Office 6 and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to "downloading graphic files from the bulletin board system."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cybozu.co.jp/products/dl/notice/detail/0019.html'}, {'name': '45063', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/45063'}, {'name': 'JVNDB-2011-000045', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000045'}, {'name': '48446', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/48446'}, {'name': 'JVN#80877328', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN80877328/index.html'}, {'name': '73327', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/73327'}]
CVE State: PUBLISHED
Explain CVE-2011-1334
Cross-site scripting (XSS) vulnerability in Cybozu Office 6, Cybozu Garoon 2.0.0 through 2.1.3, Cybozu Dezie before 6.1, Cybozu MailWise before 3.1, and Cybozu Collaborex before 1.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "downloading graphic files from the mail system."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cybozu.co.jp/products/dl/notice/detail/0019.html'}, {'name': '73317', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/73317'}, {'name': '48446', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/48446'}, {'name': 'JVN#54074460', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN54074460/index.html'}, {'name': '45043', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/45043'}, {'name': 'JVNDB-2011-000046', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000046'}]
CVE State: PUBLISHED
Explain CVE-2011-1335
Cross-site scripting (XSS) vulnerability in Cybozu Office 6, 7, and 8 before 8.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to the "address book and user list functions."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cs.cybozu.co.jp/information/20100816notice05.php'}, {'name': '44992', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44992'}, {'name': '45050', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/45050'}, {'name': '73320', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/73320'}, {'name': '48446', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/48446'}, {'name': 'JVNDB-2011-000047', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000047'}, {'name': 'JVN#55508059', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN55508059/index.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1336
Buffer overflow in ALZip 8.21 and earlier allows remote attackers to execute arbitrary code via a crafted mim file.
Affected Products: n/a
References: [{'name': 'JVNDB-2011-000048', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000048'}, {'name': '48493', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/48493'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.altools.jp/ETC/NEWS.aspx?mid=231&vidx=118'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.altools.jp/download.aspx'}, {'name': '45108', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/45108'}, {'name': 'JVN#01547302', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN01547302/index.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1337
Opera before 11.50 allows remote attackers to cause a denial of service (disk consumption) via invalid URLs that trigger creation of error pages.
Affected Products: n/a
References: [{'name': '48501', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/48501'}, {'name': 'opera-error-pages-dos(68323)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/68323'}, {'name': '45060', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/45060'}, {'name': '73486', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/73486'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.opera.com/docs/changelogs/windows/1150/'}, {'name': 'JVN#47757122', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN47757122/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.opera.com/docs/changelogs/unix/1150/'}, {'name': 'JVNDB-2011-000049', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000049.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.opera.com/docs/changelogs/mac/1150/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.opera.com/support/kb/view/996/'}]
CVE State: PUBLISHED
Explain CVE-2011-1338
Untrusted search path vulnerability in XnView before 1.98.1 allows local users to gain privileges via a Trojan horse .exe file in a folder selected by the "Open containing folder" menu item.
Affected Products: n/a
References: [{'name': 'JVNDB-2011-000050', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000050'}, {'name': '48562', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/48562'}, {'name': '73619', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/73619'}, {'name': 'xnview-library-code-execution(68369)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/68369'}, {'name': 'JVN#17844633', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN17844633/index.html'}, {'name': '45127', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/45127'}]
CVE State: PUBLISHED
Explain CVE-2011-1339
Cross-site scripting (XSS) vulnerability in Google Search Appliance before 5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#86220950', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN86220950/index.html'}, {'name': 'JVNDB-2011-000054', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000054'}]
CVE State: PUBLISHED
Explain CVE-2011-1340
Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the type_name parameter to Members/ipa/createObject.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://dev.plone.org/plone/ticket/6110'}, {'name': 'JVNDB-2011-000056', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000056'}, {'name': 'JVN#41222793', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN41222793/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://dev.plone.org/plone/changeset/12262'}]
CVE State: PUBLISHED
Explain CVE-2011-1341
Cross-site request forgery (CSRF) vulnerability in Aimluck Aipo before 4.0.4.0, and Aipo for ASP before 4.0.4.0, allows remote attackers to hijack the authentication of administrators for requests that modify data.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN72854072/91216/index.html'}, {'name': 'JVNDB-2011-000062', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000062'}, {'name': 'JVN#72854072', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN72854072/index.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1342
SQL injection vulnerability in Aimluck Aipo before 5.1.1, and Aipo for ASP before 5.1.1, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2011-000063', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2011-000063'}, {'name': 'JVN#31506102', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN31506102/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN31506102/91216/index.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1343
SQL injection vulnerability in the Web GUI in IBM Tivoli Netcool/OMNIbus before 7.3.0.4 allows remote attackers to execute arbitrary SQL commands via "dynamic SQL parameters."
Affected Products: n/a
References: [{'name': 'tivoli-netcool-webgui-sql-injection(65767)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65767'}, {'name': 'ADV-2011-0550', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0550'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg24029093'}, {'name': 'IZ83269', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1IZ83269'}, {'name': '43577', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43577'}]
CVE State: PUBLISHED
Explain CVE-2011-1344
Use-after-free vulnerability in WebKit, as used in Apple Safari before 5.0.5; iOS before 4.3.2 for iPhone, iPod, and iPad; iOS before 4.2.7 for iPhone 4 (CDMA); and possibly other products allows remote attackers to execute arbitrary code by adding children to a WBR tag and then removing the tag, related to text nodes, as demonstrated by Chaouki Bekrar during a Pwn2Own competition at CanSecWest 2011.
Affected Products: n/a
References: [{'name': '44151', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44151'}, {'name': '20110415 VUPEN Security Research - Apple Safari Text Nodes Remote Use-after-free Vulnerability (CVE-2011-1344)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/517517/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/aaronportnoy/statuses/45632544967901187'}, {'name': '46822', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46822'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT4596'}, {'name': 'APPLE-SA-2011-04-14-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2011//Apr/msg00002.html'}, {'name': '1025363', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1025363'}, {'name': 'APPLE-SA-2011-04-14-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2011//Apr/msg00001.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-11-135'}, {'name': 'ADV-2011-0984', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0984'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011'}, {'name': '20110414 ZDI-11-135: (Pwn2Own) WebKit WBR Tag Removal Remote Code Execution Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/517505/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT4607'}, {'name': 'safari-webkit-unspec-code-exec(66061)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66061'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zdnet.com/blog/security/safarimacbook-first-to-fall-at-pwn2own-2011/8358'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own'}, {'name': 'APPLE-SA-2011-04-14-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2011//Apr/msg00000.html'}, {'name': '44154', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44154'}]
CVE State: PUBLISHED
Explain CVE-2011-1345
Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, as demonstrated by Stephen Fewer as the first of three chained vulnerabilities during a Pwn2Own competition at CanSecWest 2011, aka "Object Management Memory Corruption Vulnerability."
Affected Products: n/a
References: [{'name': 'TA11-102A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA11-102A.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/msftsecresponse/statuses/45646985998516224'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/aaronportnoy/statuses/45642180118855680'}, {'name': '1025327', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1025327'}, {'name': 'MS11-018', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own'}, {'name': '46821', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46821'}, {'name': 'oval:org.mitre.oval:def:12228', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12228'}, {'tags': ['x_refsource_MISC'], 'url': 'https://threatpost.com/en_us/blogs/pwn2own-winner-stephen-fewer-031011'}, {'name': 'ms-ie-unspec-code-exec(66062)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66062'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zdnet.com/blog/security/pwn2own-2011-ie8-on-windows-7-hijacked-with-3-vulnerabilities/8367'}]
CVE State: PUBLISHED
Explain CVE-2011-1346
Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by Stephen Fewer as the second of three chained vulnerabilities during a Pwn2Own competition at CanSecWest 2011.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/msftsecresponse/statuses/45646985998516224'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/aaronportnoy/statuses/45642180118855680'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own'}, {'name': 'ie-unspec-code-exec(66063)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66063'}, {'name': '46821', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46821'}, {'tags': ['x_refsource_MISC'], 'url': 'https://threatpost.com/en_us/blogs/pwn2own-winner-stephen-fewer-031011'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zdnet.com/blog/security/pwn2own-2011-ie8-on-windows-7-hijacked-with-3-vulnerabilities/8367'}]
CVE State: PUBLISHED
Explain CVE-2011-1347
Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to bypass Protected Mode and create arbitrary files by leveraging access to a Low integrity process, as demonstrated by Stephen Fewer as the third of three chained vulnerabilities during a Pwn2Own competition at CanSecWest 2011.
Affected Products: n/a
References: [{'name': 'MS11-057', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-057'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/msftsecresponse/statuses/45646985998516224'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/aaronportnoy/statuses/45642180118855680'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011'}, {'name': 'ms-ie-unspec-ce(66064)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66064'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own'}, {'name': '46821', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46821'}, {'tags': ['x_refsource_MISC'], 'url': 'https://threatpost.com/en_us/blogs/pwn2own-winner-stephen-fewer-031011'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zdnet.com/blog/security/pwn2own-2011-ie8-on-windows-7-hijacked-with-3-vulnerabilities/8367'}]
CVE State: PUBLISHED
Explain CVE-2011-1350
The PowerVR SGX driver in Android before 2.3.6 allows attackers to obtain potentially sensitive information from kernel stack memory via an application that uses a crafted length parameter in a request to the pvrsrvkm device.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://jon.oberheide.org/files/levitator.c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/android/issues/detail?id=21522'}]
CVE State: PUBLISHED
Explain CVE-2011-1352
The PowerVR SGX driver in Android before 2.3.6 allows attackers to gain root privileges via an application that triggers kernel memory corruption using crafted user data to the pvrsrvkm device.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/android/issues/detail?id=21523'}, {'tags': ['x_refsource_MISC'], 'url': 'http://jon.oberheide.org/files/levitator.c'}]
CVE State: PUBLISHED
Explain CVE-2011-1353
Unspecified vulnerability in Adobe Reader 10.x before 10.1.1 on Windows allows local users to gain privileges via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb11-24.html'}, {'name': 'oval:org.mitre.oval:def:14177', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14177'}, {'name': 'SUSE-SU-2011:1239', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00013.html'}, {'name': 'SUSE-SA:2011:044', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00025.html'}, {'name': 'openSUSE-SU-2011:1238', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00012.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1355
Open redirect vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.19 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the logoutExitPage parameter.
Affected Products: n/a
References: [{'name': 'PM35701', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1PM35701'}, {'name': 'PM42436', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1PM42436'}, {'name': 'was-logoutexitpage-security-bypass(68570)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/68570'}]
CVE State: PUBLISHED
Explain CVE-2011-1356
IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.19 allows local users to obtain sensitive stack-trace information via a crafted Administration Console request.
Affected Products: n/a
References: [{'name': 'PM42436', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1PM42436'}, {'name': '48709', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/48709'}, {'name': 'PM36620', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1PM36620'}, {'name': 'was-admcons-info-disclosure(68571)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/68571'}]
CVE State: PUBLISHED
Explain CVE-2011-1357
Cross-site scripting (XSS) vulnerability in agentDetect.jsp in the web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 before 6.3.0.5, 7.0 before 7.0.0.5, and 7.5 before 7.5.0.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
Affected Products: n/a
References: [{'name': 'IV01657', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1IV01657'}, {'name': 'websphere-wsrr-agentdetect-xss(69040)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/69040'}]
CVE State: PUBLISHED
Explain CVE-2011-1359
Directory traversal vulnerability in the administration console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41, 7.0 before 7.0.0.19, and 8.0 before 8.0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Affected Products: n/a
References: [{'name': 'websphere-admin-console-dir-traversal(69473)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/69473'}, {'name': '45749', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/45749'}, {'name': 'PM45322', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PM45322'}, {'name': '49362', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/49362'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg21509257'}, {'name': '74817', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/74817'}]
CVE State: PUBLISHED
Explain CVE-2011-1360
Multiple cross-site scripting (XSS) vulnerabilities in IBM HTTP Server 2.0.47 and earlier, as used in WebSphere Application Server and other products, allow remote attackers to inject arbitrary web script or HTML via vectors involving unspecified documentation files in (1) manual/ibm/ and (2) htdocs/*/manual/ibm/.
Affected Products: n/a
References: [{'name': '50447', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/50447'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21502580'}, {'name': 'PM41293', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1PM41293'}, {'name': 'was-http-doc-xss(69656)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/69656'}]
CVE State: PUBLISHED
Explain CVE-2011-1362
Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 and 7.0 before 7.0.0.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1308.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27007951'}, {'name': 'was-incomplete-ivt-xss(69731)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/69731'}, {'name': 'PM40733', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PM40733'}, {'name': 'PM65992', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PM65992'}]
CVE State: PUBLISHED
Explain CVE-2011-1364
Cross-site request forgery (CSRF) vulnerability in _ah/admin/interactive/execute (aka the Interactive Console) in the SDK Console (aka Admin Console) in the Google App Engine Python SDK before 1.5.4 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary Python code via the code parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://code.google.com/p/googleappengine/wiki/SdkReleaseNotes'}, {'name': 'google-app-engine-csrf(69958)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/69958'}, {'name': '50075', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/50075'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.watchfire.com/files/googleappenginesdk.pdf'}]
CVE State: PUBLISHED
Explain CVE-2011-1366
Unspecified vulnerability in the Import feature in IBM Rational AppScan Enterprise and AppScan Reporting Console 5.2 through 7.9.x and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary commands on an agent server via a crafted ZIP archive.
Affected Products: n/a
References: [{'name': 'rational-appscan-zip-code-execution(70043)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/70043'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21515110'}, {'name': '46329', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/46329'}, {'name': '46326', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/46326'}]
CVE State: PUBLISHED
Explain CVE-2011-1367
Unspecified vulnerability in the File Load feature in IBM Rational AppScan Standard and Express 7.8.x, 7.9.x, and 8.0.x before 8.0.0.3 allows remote attackers to execute arbitrary commands via a crafted .scan file.
Affected Products: n/a
References: [{'name': '49989', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/49989'}, {'name': 'rational-appscan-scan-code-execution(70044)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/70044'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21515110'}, {'name': '46329', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/46329'}, {'name': '46326', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/46326'}]
CVE State: PUBLISHED
Explain CVE-2011-1368
The JavaServer Faces (JSF) application functionality in IBM WebSphere Application Server 8.x before 8.0.0.1 does not properly handle requests, which allows remote attackers to read unspecified files via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg24030916'}, {'name': 'PM45992', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1PM45992'}, {'name': 'was-jfs-info-disclosure(70168)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/70168'}]
CVE State: PUBLISHED
Explain CVE-2011-1370
The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message.
Affected Products: n/a
References: [{'name': 'lotussametime-configserv-info-disclosure(70923)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/70923'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21569452'}]
CVE State: PUBLISHED
Explain CVE-2011-1371
Cross-site scripting (XSS) vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger an Unknown Error document, a different vulnerability than CVE-2011-4171.
Affected Products: n/a
References: [{'name': 'RS00810', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1RS00810'}, {'name': 'ilogrts-error-xss(71005)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/71005'}]
CVE State: PUBLISHED
Explain CVE-2011-1372
The Web User Interface on the IBM TS3100 and TS3200 tape libraries with firmware before A.60 allows remote attackers to bypass authentication and obtain administrative access via unspecified vectors.
Affected Products: n/a
References: [{'name': 'tapelibraryexpress-wmc-sec-bypass(71026)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/71026'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ssg1S1003938'}]
CVE State: PUBLISHED
Explain CVE-2011-1373
Unspecified vulnerability in IBM DB2 9.7 before FP5 on UNIX, when the Self Tuning Memory Manager (STMM) feature and the AUTOMATIC DATABASE_MEMORY setting are configured, allows local users to cause a denial of service (daemon crash) via unknown vectors.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:14720', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14720'}, {'name': 'db2-stmm-dos(71043)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/71043'}, {'name': 'IC70473', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IC70473'}]
CVE State: PUBLISHED
Explain CVE-2011-1374
Buffer overflow in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted REGION record in a PICT file.
Affected Products: n/a
References: [{'name': '51226', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51226'}, {'name': 'APPLE-SA-2012-11-07-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2012/Nov/msg00002.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5581'}, {'name': 'oval:org.mitre.oval:def:15782', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15782'}]
CVE State: PUBLISHED
Explain CVE-2011-1375
IBM AIX 6.1 and 7.1 does not restrict the wpar_limits_config and wpar_limits_modify system calls, which allows local users to cause a denial of service (system crash) via a crafted call.
Affected Products: n/a
References: [{'name': 'IV10227', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=isg1IV10227'}, {'name': 'aix-wparlimits-dos(71211)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/71211'}, {'name': 'IV10229', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=isg1IV10229'}]
CVE State: PUBLISHED
Explain CVE-2011-1376
iscdeploy in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 on the IBM i platform sets weak permissions under systemapps/isclite.ear/ and bin/client_ffdc/, which allows local users to read or modify files via standard filesystem operations.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21569205'}, {'name': 'was-iscdeploy-insecure-permissions(71230)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/71230'}, {'name': 'PM49712', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1PM49712'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg24031675'}]
CVE State: PUBLISHED
Explain CVE-2011-1377
The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server (WAS) 6.1 does not properly handle the enabling of WS-Security for a JAX-WS application, which has unspecified impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27011716'}, {'name': 'PM43792', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PM43792'}, {'name': 'was-wssecurity-unspecified(72299)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72299'}, {'name': 'PM50205', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PM50205'}, {'name': '46469', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/46469'}, {'name': '50310', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/50310'}]
CVE State: PUBLISHED
Explain CVE-2011-1378
IBM WebSphere MQ 6.0 on OpenVMS, when the default rights of the MQM group are established, does not properly verify User Authorization File (UAF) data, which allows local users to kill listener processes and the command server via a control command.
Affected Products: n/a
References: [{'name': '46837', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/46837'}, {'name': 'wmq-cc-security-bypass(71336)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/71336'}, {'name': 'IC78034', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IC78034'}]
CVE State: PUBLISHED
Explain CVE-2011-1381
Unspecified vulnerability in IBM OpenPages GRC Platform 6.1.0.1 before IF4 allows remote attackers to bypass intended access restrictions via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21676990'}]
CVE State: PUBLISHED
Explain CVE-2011-1384
The (1) bin/invscoutClient_VPD_Survey and (2) sbin/invscout_lsvpd programs in invscout.rte before 2.2.0.19 on IBM AIX 7.1, 6.1, 5.3, and earlier allow local users to delete arbitrary files, or trigger inventory scout operations on arbitrary files, via a symlink attack on an unspecified file.
Affected Products: n/a
References: [{'name': 'aix-scout-symlink(71615)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/71615'}, {'name': '47222', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47222'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://aix.software.ibm.com/aix/efixes/security/invscout_advisory2.asc'}, {'name': '51059', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51059'}, {'name': '51083', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51083'}, {'name': 'IV11643', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=isg1IV11643'}]
CVE State: PUBLISHED