Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2012-1454
The ELF file parser in Dr.Web 5.0.2.03300, eSafe 7.0.17.0, McAfee Gateway (formerly Webwasher) 2010.1C, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified ei_version field.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.
Affected Products: n/a
References: [{'name': '80432', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80432'}, {'name': '20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/522005'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ieee-security.org/TC/SP2012/program.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1455
The CAB file parser in NOD32 Antivirus 5795 and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a CAB file with a modified vMinor version field.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CAB parser implementations.
Affected Products: n/a
References: [{'name': '20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/522005'}, {'name': '52607', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52607'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ieee-security.org/TC/SP2012/program.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1456
The TAR file parser in AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, Panda Antivirus 10.0.2.7, Rising Antivirus 22.83.00.03, Sophos Anti-Virus 4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, and Trend Micro HouseCall 9.120.0.1004 allows remote attackers to bypass malware detection via a TAR file with an appended ZIP file.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
Affected Products: n/a
References: [{'name': '80406', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80406'}, {'name': '20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/522005'}, {'name': '80403', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80403'}, {'name': '80389', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80389'}, {'name': '80391', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80391'}, {'name': 'multiple-av-zip-archive-evasion(74289)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74289'}, {'name': '80409', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80409'}, {'name': '80396', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80396'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ieee-security.org/TC/SP2012/program.html'}, {'name': '80390', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80390'}, {'name': '52608', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52608'}, {'name': '80395', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80395'}]
CVE State: PUBLISHED
Explain CVE-2012-1457
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field that exceeds the total TAR file size.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2012:0833', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00002.html'}, {'name': '80406', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80406'}, {'name': '80393', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80393'}, {'name': '20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/522005'}, {'name': '80403', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80403'}, {'name': '80389', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80389'}, {'name': '80391', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80391'}, {'name': '80409', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80409'}, {'name': '80396', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80396'}, {'name': '80392', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80392'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ieee-security.org/TC/SP2012/program.html'}, {'name': 'MDVSA-2012:094', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:094'}, {'name': '52610', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52610'}, {'name': '80407', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80407'}, {'name': '80395', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80395'}, {'name': 'multiple-av-tar-length-evasion(74293)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74293'}]
CVE State: PUBLISHED
Explain CVE-2012-1458
The Microsoft CHM file parser in ClamAV 0.96.4 and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a crafted reset interval in the LZXC header of a CHM file.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CHM parser implementations.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2012:0833', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00002.html'}, {'name': '20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/522005'}, {'name': '52611', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52611'}, {'name': '80473', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80473'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ieee-security.org/TC/SP2012/program.html'}, {'name': 'multiple-av-chm-header-evasion(74301)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74301'}, {'name': '80474', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80474'}, {'name': 'MDVSA-2012:094', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:094'}]
CVE State: PUBLISHED
Explain CVE-2012-1460
The Gzip file parser in Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, and VBA32 3.12.14.2 allows remote attackers to bypass malware detection via a .tar.gz file with stray bytes at the end. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different Gzip parser implementations.
Affected Products: n/a
References: [{'name': '20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/522005'}, {'name': '52629', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52629'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ieee-security.org/TC/SP2012/program.html'}, {'name': 'multiple-av-tar-gzip-evasion(74308)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74308'}]
CVE State: PUBLISHED
Explain CVE-2012-1461
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, Rising Antivirus 22.83.00.03, Sophos Anti-Virus 4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, and VBA32 3.12.14.2 allows remote attackers to bypass malware detection via a .tar.gz file with multiple compressed streams.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different Gzip parser implementations.
Affected Products: n/a
References: [{'name': '80502', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80502'}, {'name': '52626', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52626'}, {'name': '20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/522005'}, {'name': '80504', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80504'}, {'name': '80506', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80506'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ieee-security.org/TC/SP2012/program.html'}, {'name': '80500', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80500'}, {'name': '80505', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80505'}, {'name': '80501', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80501'}, {'name': '80503', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80503'}, {'name': '80510', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80510'}]
CVE State: PUBLISHED
Explain CVE-2012-1462
The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, Norman Antivirus 6.06.12, Sophos Anti-Virus 4.61.0, and AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11 allows remote attackers to bypass malware detection via a ZIP file containing an invalid block of data at the beginning.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ZIP parser implementations.
Affected Products: n/a
References: [{'name': '20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/522005'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ieee-security.org/TC/SP2012/program.html'}, {'name': 'multiple-av-zip-file-evasion(74310)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74310'}, {'name': '52613', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52613'}]
CVE State: PUBLISHED
Explain CVE-2012-1463
The ELF file parser in AhnLab V3 Internet Security 2011.01.18.00, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158, Norman Antivirus 6.06.12, nProtect Anti-Virus 2011-01-17.01, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified endianness field.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.
Affected Products: n/a
References: [{'name': '20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/522005'}, {'name': '80433', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80433'}, {'name': '52614', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52614'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ieee-security.org/TC/SP2012/program.html'}, {'name': '80426', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80426'}, {'name': 'multiple-av-elf-file-evasion(74311)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74311'}]
CVE State: PUBLISHED
Explain CVE-2012-1464
Dashboard Server for NetMechanica NetDecision before 4.6.1 allows remote attackers to obtain the installation path via a request with a trailing "?" character, which causes Dashboard to attempt to access a non-existent resource.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '18543', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18543'}, {'name': 'netdecision-info-disclosure(73549)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73549'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/blog/?p=478'}, {'name': '79653', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79653'}, {'name': '52645', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52645'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.netmechanica.com/news/?news_id=26'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_Dashboard_Server_Info_Disc_Vuln.txt'}, {'name': '48168', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48168'}]
CVE State: PUBLISHED
Explain CVE-2012-1465
Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of service (application crash) via a long URL in an HTTP request.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '52194', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52194'}, {'name': '79651', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79651'}, {'name': 'netdecision-http-dos(73528)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73528'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_HTTP_Server_DoS_Vuln.txt'}, {'name': '52208', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52208'}, {'name': '18541', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18541'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.netmechanica.com/news/?news_id=26'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/blog/?p=484'}, {'name': '48168', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48168'}]
CVE State: PUBLISHED
Explain CVE-2012-1466
The Traffic Grapher Server for NetMechanica NetDecision before 4.6.1 allows remote attackers to obtain the source code of NtDecision script files with a .nd extension via an invalid version number in an HTTP request, as demonstrated using default.nd.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/blog/?p=481'}, {'name': '79652', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79652'}, {'name': 'netdecision-traffic-nd-source-disclosure(73531)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73531'}, {'name': '52196', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52196'}, {'name': '18542', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18542'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.netmechanica.com/news/?news_id=26'}, {'name': '48168', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48168'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_Traffic_Grapher_Server_SourceCode_Disc_Vuln.txt'}]
CVE State: PUBLISHED
Explain CVE-2012-1467
Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files via a .. (dot dot) in the param parameter to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23079'}]
CVE State: PUBLISHED
Explain CVE-2012-1468
Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is not ".php", then accessing it via a direct request to the file in submission/original/ in the associated article directory, as demonstrated using .pHp, .asp, and other extensions.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://pkp.sfu.ca/ojs/RELEASE-2.3.7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23079'}]
CVE State: PUBLISHED
Explain CVE-2012-1469
Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the (1) editor or (2) callback parameters to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/ibrowser.php in the iBrowser plugin, (3) authors[][url] parameter to index.php, or (4) Bio Statement or (5) Abstract of Submission fields to the stripUnsafeHtml function in lib/pkp/classes/core/String.inc.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431'}, {'name': 'open-journal-articleid-xss(74228)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74228'}, {'name': 'open-journal-index-xss(74225)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74225'}, {'name': '48449', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48449'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://pkp.sfu.ca/ojs/RELEASE-2.3.7'}, {'name': 'open-journal-editor-xss(74227)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74227'}, {'name': '80257', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/80257'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23079'}, {'name': '80255', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/80255'}, {'name': '20120321 Multiple vulnerabilities in Open Journal Systems (OJS)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0102.html'}, {'name': '48464', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48464'}, {'name': '80256', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/80256'}, {'name': 'open-journal-string-xss(74226)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74226'}]
CVE State: PUBLISHED
Explain CVE-2012-1470
Multiple cross-site scripting (XSS) vulnerabilities in code_editor.php in ocPortal before 7.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2) line parameters.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://ocportal.com/site/news/view/ocportal-security-update.htm'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ocportal.com/site/news/view/new-releases/ocportal-7-1-6-released.htm'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23078'}]
CVE State: PUBLISHED
Explain CVE-2012-1471
Directory traversal vulnerability in catalogue_file.php in ocPortal before 7.1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://ocportal.com/site/news/view/ocportal-security-update.htm'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ocportal.com/site/news/view/new-releases/ocportal-7-1-6-released.htm'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23078'}]
CVE State: PUBLISHED
Explain CVE-2012-1472
VMware vCenter Chargeback Manager (aka CBM) before 2.0.1 does not properly handle XML API requests, which allows remote attackers to read arbitrary files or cause a denial of service via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0002.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1474
Unspecified vulnerability in the Youni SMS (com.snda.youni) application 2.1.0c and 2.1.0d for Android has unknown impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1474-vulnerability-in-YouniSMS.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1475
Unspecified vulnerability in the YagattaTalk Messenger (com.iskoot.yagatta.yagattatalk) application 1.00.01.08 for Android has unknown impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1475-vulnerability-in-YagattaTalkMessenger.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1476
Unspecified vulnerability in the KKtalk (com.kkliaotian.android) application 4.0.0 and 4.1.5 for Android has unknown impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1476-vulnerability-in-KKtalk.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1477
Unspecified vulnerability in the Cnectd (mci.cnectd) application 3.1.0 for Android has unknown impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1477-vulnerability-in-Cnectd.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1478
Unspecified vulnerability in the UCMobile BloveStorm (com.blovestorm) application 2.2.0 and 3.2.1 for Android has unknown impact and attack vectors.
Affected Products: n/a
References: [{'name': 'blovestorm-android-unspecified(74024)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74024'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1478-vulnerability-in-UCMobileBloveStorm.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1479
Unspecified vulnerability in the AContact (com.movester.quickcontact) application 1.8.2 for Android has unknown impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1479-vulnerability-in-AContact.html'}, {'name': 'acontact-android-unspecified(74025)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74025'}]
CVE State: PUBLISHED
Explain CVE-2012-1480
Unspecified vulnerability in the Pansi SMS (com.pansi.msg) application 1.97, 2.01, and 2.07 for Android has unknown impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1480-vulnerability-in-PansiSMS.html'}, {'name': 'pansisms-android-unspecified(73963)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73963'}]
CVE State: PUBLISHED
Explain CVE-2012-1481
Unspecified vulnerability in the Textdroid (com.app.android.textdroid) application 2.5.2 for Android has unknown impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1481-vulnerability-in-Textdroid.html'}, {'name': 'textdroid-android-unspecified(74052)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74052'}, {'name': '52490', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52490'}, {'name': '80168', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80168'}]
CVE State: PUBLISHED
Explain CVE-2012-1482
Unspecified vulnerability in the TouchPal Contacts (com.cootek.smartdialer) application 3.3.1 and 4.0.1 for Android has unknown impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1482-vulnerability-in-TouchPalContacts.html'}, {'name': '52491', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52491'}, {'name': 'touchpal-android-unspecified(74051)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74051'}, {'name': '80169', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80169'}]
CVE State: PUBLISHED
Explain CVE-2012-1483
Unspecified vulnerability in the Message Forwarder (com.gmail.zbnetium) application 1.12.20110409.1 for Android has unknown impact and attack vectors.
Affected Products: n/a
References: [{'name': '52492', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52492'}, {'name': 'message-forward-android-unspecified(74050)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74050'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1483-vulnerability-in-MessageForwarder.html'}, {'name': '80170', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80170'}]
CVE State: PUBLISHED
Explain CVE-2012-1484
Unspecified vulnerability in the WaliSMS CN (cn.com.wali.walisms) application 2.9.2 and 3.7.0 for Android has unknown impact and attack vectors.
Affected Products: n/a
References: [{'name': '80171', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80171'}, {'name': 'walisms-android-unspecified(74049)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74049'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1484-vulnerability-in-WaliSMSCN.html'}, {'name': '52495', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52495'}]
CVE State: PUBLISHED
Explain CVE-2012-1485
Unspecified vulnerability in the NetFront Life Browser (com.access_company.android.nflifebrowser.lite) application 2.2.0 and 2.3.0 for Android has unknown impact and attack vectors.
Affected Products: n/a
References: [{'name': '80172', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80172'}, {'name': '48557', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48557'}, {'name': 'netfront-android-unspecified(74048)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74048'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1485-vulnerability-in-NetFrontLifeBrowser.html'}, {'name': '52480', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52480'}]
CVE State: PUBLISHED
Explain CVE-2012-1493
F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/f5_bigip_known_privkey.rb'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.trustmatta.com/advisories/MATTA-2012-002.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.theregister.co.uk/2012/06/13/f5_kit_metasploit_exploit/'}]
CVE State: PUBLISHED
Explain CVE-2012-1495
install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://sourceforge.net/projects/webcalendar/files/webcalendar%201.2/1.2.5/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.exploit-db.com/exploits/18775'}, {'tags': ['x_refsource_MISC'], 'url': 'https://packetstormsecurity.com/files/112332/WebCalendar-1.2.4-Remote-Code-Execution.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://packetstormsecurity.com/files/112323/WebCalendar-1.2.4-Pre-Auth-Remote-Code-Injection.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1497
The default configuration of Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 supports the "mt:Include file=" attribute, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files by leveraging the template-designer role.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html'}, {'name': 'DSA-2423', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2423'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.movabletype.org/documentation/appendices/release-notes/513.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1498
Multiple cross-site request forgery (CSRF) vulnerabilities in Webfolio CMS 1.1.4 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via an add action to admin/users/add or (2) modify a web page via a save action to admin/pages/edit/web_page_name.
Affected Products: n/a
References: [{'name': '79658', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79658'}, {'name': '18536', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18536'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/110294/WebfolioCMS-1.1.4-Cross-Site-Request-Forgery.html'}, {'name': '52218', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52218'}, {'tags': ['x_refsource_MISC'], 'url': 'http://ivanobinetti.blogspot.com/2012/02/webfoliocms-114-csrf-add-adminmodify.html'}, {'name': '48190', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48190'}, {'name': 'webfoliocms-addadmin-modifywebpage-csrf(73575)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73575'}]
CVE State: PUBLISHED
Explain CVE-2012-1499
The JPEG 2000 codec (jp2.c) in OpenJPEG before 1.5 allows remote attackers to execute arbitrary code via a crafted palette index in a CMAP record of a JPEG image, which triggers memory corruption, aka "out-of heap-based buffer write."
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://technet.microsoft.com/en-us/security/msvr/msvr12-004'}, {'name': 'FEDORA-2012-9602', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=805912'}, {'name': '52654', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52654'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/openjpeg/source/detail?r=1330'}, {'name': 'GLSA-201206-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201206-06.xml'}, {'name': 'FEDORA-2012-9628', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://openjpeg.googlecode.com/svn/branches/openjpeg-1.5/NEWS'}]
CVE State: PUBLISHED
Explain CVE-2012-1500
Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://web.archive.org/web/20121014055829/http://www.cloudscan.me/2012/09/cve-2012-1500-ghs-5375-ghs-5642.html'}, {'name': '21052', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/21052'}]
CVE State: PUBLISHED
Explain CVE-2012-1502
Double free vulnerability in the PyPAM_conv in PAMmodule.c in PyPam 0.5.0 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a NULL byte in a password string.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2012:0487', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2012-04/msg00027.html'}, {'name': '48312', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48312'}, {'name': '48746', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48746'}, {'name': 'USN-1395-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1395-1'}, {'name': '79892', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79892'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.lsexperts.de/advisories/lse-2012-03-01.txt'}, {'name': 'GLSA-201507-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201507-09'}, {'name': 'pypam-password-dos(73857)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73857'}, {'name': 'DSA-2430', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2430'}, {'name': '48332', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48332'}]
CVE State: PUBLISHED
Explain CVE-2012-1503
Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section.
Affected Products: n/a
References: [{'name': '22151', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/22151'}, {'name': '86729', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/86729'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cloudscan.me/2012/10/cve-2012-1503-movable-type-pro-513en.html'}, {'name': '56160', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/56160'}, {'name': 'movabletype-mt513en-xss(79521)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/79521'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/117564/Movable-Type-Pro-5.13en-Cross-Site-Scripting.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1506
SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '53433', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53433'}, {'name': '81743', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81743'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23080'}, {'name': '49072', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49072'}, {'name': 'orangehrm-haltresumehsp-sql-injection(75472)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75472'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blog.orangehrm.com/2012/04/24/orangehrm-27-stable-release-with-complete-localization/'}]
CVE State: PUBLISHED
Explain CVE-2012-1507
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to index.php.
Affected Products: n/a
References: [{'name': '53433', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53433'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23080'}, {'name': 'orangehrm-multiplescripts-xss(75473)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75473'}, {'name': '81744', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81744'}, {'name': '49072', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49072'}, {'name': '81745', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81745'}, {'name': '81746', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81746'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blog.orangehrm.com/2012/04/24/orangehrm-27-stable-release-with-complete-localization/'}]
CVE State: PUBLISHED
Explain CVE-2012-1508
The XPDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to gain guest OS privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
Affected Products: n/a
References: [{'name': '80115', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80115'}, {'name': '1026814', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026814'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0004.html'}, {'name': '48378', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48378'}, {'name': '48379', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48379'}, {'name': '20120316 VMSA-2012-0004 VMware View privilege escalation and cross-site scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0071.html'}, {'name': '52524', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52524'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0005.html'}, {'name': '1026818', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026818'}, {'name': 'oval:org.mitre.oval:def:17183', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17183'}]
CVE State: PUBLISHED
Explain CVE-2012-1509
Buffer overflow in the XPDM display driver in VMware View before 4.6.1 allows guest OS users to gain guest OS privileges via unspecified vectors.
Affected Products: n/a
References: [{'name': 'vmware-view-xpdm-priv-esc(74096)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74096'}, {'name': '1026814', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026814'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0004.html'}, {'name': '80116', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80116'}, {'name': '48379', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48379'}, {'name': '20120316 VMSA-2012-0004 VMware View privilege escalation and cross-site scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0071.html'}, {'name': '52524', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52524'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0005.html'}, {'name': 'oval:org.mitre.oval:def:17151', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17151'}]
CVE State: PUBLISHED
Explain CVE-2012-1510
Buffer overflow in the WDDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to gain guest OS privileges via unspecified vectors.
Affected Products: n/a
References: [{'name': '1026814', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026814'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0004.html'}, {'name': 'oval:org.mitre.oval:def:17258', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17258'}, {'name': '48378', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48378'}, {'name': '48379', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48379'}, {'name': '20120316 VMSA-2012-0004 VMware View privilege escalation and cross-site scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0071.html'}, {'name': '52524', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52524'}, {'name': 'vmware-wddm-priv-esc(74097)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74097'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0005.html'}, {'name': '1026818', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026818'}, {'name': '80117', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80117'}]
CVE State: PUBLISHED
Explain CVE-2012-1511
Cross-site scripting (XSS) vulnerability in View Manager Portal in VMware View before 4.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Affected Products: n/a
References: [{'name': '1026814', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026814'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0004.html'}, {'name': '80118', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80118'}, {'name': 'oval:org.mitre.oval:def:16664', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16664'}, {'name': '48379', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48379'}, {'name': '20120316 VMSA-2012-0004 VMware View privilege escalation and cross-site scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0071.html'}, {'name': '52526', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52526'}]
CVE State: PUBLISHED
Explain CVE-2012-1512
Cross-site scripting (XSS) vulnerability in the internal browser in vSphere Client in VMware vSphere 4.1 before Update 2 and 5.0 before Update 1 allows remote attackers to inject arbitrary web script or HTML via a crafted log-file entry.
Affected Products: n/a
References: [{'name': '48387', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48387'}, {'name': '52525', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52525'}, {'name': 'vsphere-client-xss(74093)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74093'}, {'name': '1026817', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026817'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2012-0005.html'}, {'name': '80119', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80119'}]
CVE State: PUBLISHED