Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2012-0200
The server in IBM solidDB 6.5 before Interim Fix 6 does not properly initialize data structures, which allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a redundant WHERE condition.
Affected Products: n/a
References: [{'name': 'soliddb-redundant-where-dos(73126)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73126'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg27021052'}, {'name': 'IC81244', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IC81244'}]
CVE State: PUBLISHED
Explain CVE-2012-0201
Stack-based buffer overflow in pcspref.dll in pcsws.exe in IBM Personal Communications 5.9.x before 5.9.8 and 6.0.x before 6.0.4 might allow remote attackers to execute arbitrary code via a long profile string in a WorkStation (aka .ws) file.
Affected Products: n/a
References: [{'name': '18539', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18539/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21586166'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.stratsec.net/Research/Advisories/IBM-Personal-Communications-I-Series-Access-WorkSt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.metasploit.com/modules/exploit/windows/fileformat/ibm_pcm_ws'}, {'name': 'pcom-pcspref-bo(73127)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73127'}, {'name': 'IC81539', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IC81539'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/fileformat/ibm_pcm_ws.rb'}]
CVE State: PUBLISHED
Explain CVE-2012-0202
Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted data.
Affected Products: n/a
References: [{'name': 'cognos-tm1admsd-bo(73182)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73182'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21590314'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg24032164'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg24032165'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg24032166'}]
CVE State: PUBLISHED
Explain CVE-2012-0203
Cross-site scripting (XSS) vulnerability in InfoSphere Metadata Workbench (MWB) 8.1 through 8.7 in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'infosphere-mw-xss(73254)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73254'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21623501'}]
CVE State: PUBLISHED
Explain CVE-2012-0204
Untrusted search path vulnerability in InfoSphere Import Export Manager 8.1 through 9.1 in InfoSphere Information Server MetaBrokers & Bridges (MBB) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, 8.7, and 9.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Affected Products: n/a
References: [{'name': 'infosphere-is-dll-code-execution(73255)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73255'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21623501'}]
CVE State: PUBLISHED
Explain CVE-2012-0205
InfoSphere Metadata Workbench (MWB) 8.1 through 8.7 in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 does not properly restrict use of the troubleshooting feature, which allows remote authenticated users to bypass intended access restrictions or cause a denial of service (workbench outage) via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21623501'}, {'name': 'infosphere-mw-ts-security-bypass(73265)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73265'}]
CVE State: PUBLISHED
Explain CVE-2012-0206
common_startup.cc in PowerDNS (aka pdns) Authoritative Server before 2.9.22.5 and 3.x before 3.0.1 allows remote attackers to cause a denial of service (packet loop) via a crafted UDP DNS response.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://doc.powerdns.com/powerdns-advisory-2012-01.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://doc.powerdns.com/changelog.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=772570'}]
CVE State: PUBLISHED
Explain CVE-2012-0207
The igmp_heard_query function in net/ipv4/igmp.c in the Linux kernel before 3.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and panic) via IGMP packets.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=654876'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/25c413ad0029ea86008234be28aee33456e53e5b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/a8c1f65c79cbbb2f7da782d4c9d15639a9b94b27'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=772867'}, {'name': '[oss-security] 20120110 CVE-2012-0207 kernel: igmp: Avoid zero delay when receiving odd mixture of IGMP queries', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/10/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a8c1f65c79cbbb2f7da782d4c9d15639a9b94b27'}]
CVE State: PUBLISHED
Explain CVE-2012-0208
Unspecified vulnerability in the Oracle Grid Engine component in Oracle Sun Products Suite 6.1 and 6.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to qrsh.
Affected Products: n/a
References: [{'name': '1026950', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026950'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html'}, {'name': 'DSA-2472', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2472'}, {'name': 'MDVSA-2013:150', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:150'}]
CVE State: PUBLISHED
Explain CVE-2012-0209
Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in templates/javascript/open_calendar.js, which allows remote attackers to execute arbitrary PHP code.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://dev.horde.org/h/jonah/stories/view.php?channel_id=1&id=155'}, {'tags': ['x_refsource_MISC'], 'url': 'http://eromang.zataz.com/2012/02/15/cve-2012-0209-horde-backdoor-analysis/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=790877'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109874/Horde-3.3.12-Backdoor-Arbitrary-PHP-Code-Execution.html'}, {'name': '[horde-announce] 20120213 [SECURITY] Remote execution backdoor after server hack (CVE-2012-0209)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.horde.org/archives/announce/2012/000751.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0210
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to obtain system information and execute arbitrary code via the file name in a (1) .dsc or (2) .changes file.
Affected Products: n/a
References: [{'name': '47955', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47955'}, {'name': '48039', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48039'}, {'name': '52029', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52029'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git%3Ba=commitdiff%3Bh=797ddc961532eb0aeb46153e3f28c8e9ea0500d2'}, {'name': 'USN-1366-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1366-1'}, {'name': '79319', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79319'}, {'name': 'devscripts-dsc-code-execution(73215)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73215'}, {'name': 'DSA-2409', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2409'}]
CVE State: PUBLISHED
Explain CVE-2012-0211
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via a crafted tarball file name in the top-level directory of an original (.orig) source tarball of a source package.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git%3Ba=commitdiff%3Bh=9cbe605d3eab4f9e67525f69b676c55b273b7a03'}, {'name': '47955', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47955'}, {'name': '48039', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48039'}, {'name': '52029', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52029'}, {'name': 'USN-1366-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1366-1'}, {'name': 'devscripts-commands-code-execution(73216)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73216'}, {'name': '79320', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79320'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git%3Ba=commitdiff%3Bh=87f88232eb643f0c118c6ba38db8e966915b450f'}, {'name': 'DSA-2409', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2409'}]
CVE State: PUBLISHED
Explain CVE-2012-0212
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via shell metacharacters in the file name argument.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git%3Ba=commitdiff%3Bh=9cbe605d3eab4f9e67525f69b676c55b273b7a03'}, {'name': '47955', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47955'}, {'name': '48039', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48039'}, {'name': '52029', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52029'}, {'name': '79322', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79322'}, {'name': 'USN-1366-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1366-1'}, {'name': 'USN-1593-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1593-1'}, {'name': 'devscripts-debdiff-code-execution(73217)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73217'}, {'name': 'DSA-2409', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2409'}]
CVE State: PUBLISHED
Explain CVE-2012-0213
The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21996759'}, {'name': '49040', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49040'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0044'}, {'name': 'DSA-2468', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2468'}, {'name': '50549', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/50549'}, {'name': 'FEDORA-2012-10835', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-August/084609.html'}, {'name': '53487', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53487'}, {'name': 'RHSA-2012:1232', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1232.html'}, {'name': 'MDVSA-2013:094', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:094'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=799078'}]
CVE State: PUBLISHED
Explain CVE-2012-0214
The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16~exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by preventing a user from downloading the new InRelease file, which leaves the original InRelease file active and makes it more difficult to detect that the Packages file is modified and unsigned.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=b7a6594d1e5ed199a7a472b78b33e070375d6f92'}, {'name': 'USN-1385-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1385-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=de498a528cd6fc36c4bb22bf8dec6558e21cc9b6'}]
CVE State: PUBLISHED
Explain CVE-2012-0215
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.
Affected Products: n/a
References: [{'name': 'DSA-2444', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2444'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.tryton.org/issue2476'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.tryton.org/trytond/rev/8e64d52ecea4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://news.tryton.org/2012/03/security-releases-for-all-supported.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0216
The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct cross-site scripting (XSS) attacks, gain privileges, or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server.
Affected Products: n/a
References: [{'name': 'gnulinux-apache2-xss(75211)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75211'}, {'name': 'DSA-2452', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2452'}]
CVE State: PUBLISHED
Explain CVE-2012-0218
Xen 3.4, 4.0, and 4.1, when the guest OS has not registered a handler for a syscall or sysenter instruction, does not properly clear a flag for exception injection when injecting a General Protection Fault, which allows local PV guest OS users to cause a denial of service (guest crash) by later triggering an exception that would normally be handled within Xen.
Affected Products: n/a
References: [{'name': '55082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55082'}, {'name': 'GLSA-201309-24', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201309-24.xml'}, {'name': 'DSA-2501', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2501'}, {'name': '[Xen-announce] 20120612 Xen Security Advisory 8 (CVE-2012-0218) - syscall/enter guest DoS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.xen.org/archives/html/xen-announce/2012-06/msg00003.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0219
Heap-based buffer overflow in the xioscan_readline function in xio-readline.c in socat 1.4.0.0 through 1.7.2.0 and 2.0.0-b1 through 2.0.0-b4 allows local users to execute arbitrary code via the READLINE address.
Affected Products: n/a
References: [{'name': '49746', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49746'}, {'name': '1027064', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027064'}, {'name': 'FEDORA-2012-8328', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081882.html'}, {'name': 'GLSA-201208-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201208-01.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.dest-unreach.org/socat/contrib/socat-secadv3.html'}, {'name': 'FEDORA-2012-8274', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081619.html'}, {'name': 'openSUSE-SU-2012:0809', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.lwn.net/Articles/504742/'}, {'name': '53510', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53510'}, {'name': 'MDVSA-2013:169', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:169'}, {'name': '81969', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/81969'}, {'name': '49105', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49105'}, {'name': '[oss-security] 20120514 socat security advisory', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/05/14/2'}]
CVE State: PUBLISHED
Explain CVE-2012-0220
Multiple cross-site scripting (XSS) vulnerabilities in the meta plugin (Plugin/meta.pm) in ikiwiki before 3.20120516 allow remote attackers to inject arbitrary web script or HTML via the (1) author or (2) authorurl meta tags.
Affected Products: n/a
References: [{'name': 'DSA-2474', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2474'}, {'name': '49199', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49199'}, {'name': '81995', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81995'}, {'name': 'ikiwiki-unspecified-xss(75702)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75702'}, {'name': '53599', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53599'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ikiwiki.info/news/version_3.20120516/'}, {'name': '49232', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49232'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://source.ikiwiki.branchable.com/?p=source.git%3Ba=commitdiff%3Bh=fbfcea89f8e06426c73ab8ea369ca4cdc566db6f'}]
CVE State: PUBLISHED
Explain CVE-2012-0221
The FactoryTalk (FT) RNADiagReceiver service in Rockwell Automation Allen-Bradley FactoryTalk CPR9 through SR5 and RSLogix 5000 17 through 20 does not properly handle the return value from an unspecified function, which allows remote attackers to cause a denial of service (service outage) via a crafted packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://rockwellautomation.custhelp.com/app/answers/detail/a_id/469937'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-088-01.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-0222
The FactoryTalk (FT) RNADiagReceiver service in Rockwell Automation Allen-Bradley FactoryTalk CPR9 through SR5 and RSLogix 5000 17 through 20 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://rockwellautomation.custhelp.com/app/answers/detail/a_id/469937'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-088-01.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-0223
Untrusted search path vulnerability in 7-Technologies (7T) TERMIS 2.10 and earlier allows local users to gain privileges via a Trojan horse DLL in the current working directory, a different vulnerability than CVE-2012-0224.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-025-02A.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-0224
Untrusted search path vulnerability in 7-Technologies (7T) AQUIS 1.5 and earlier allows local users to gain privileges via a Trojan horse DLL in the current working directory, a different vulnerability than CVE-2012-0223.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-025-01.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-0225
Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '1026886', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026886'}, {'name': '48603', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48603'}, {'name': '52851', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52851'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-062-01.pdf'}, {'name': '1026887', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026887'}, {'name': 'wis-unspecified-xss(74549)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74549'}, {'name': '80888', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80888'}]
CVE State: PUBLISHED
Explain CVE-2012-0226
SQL injection vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': '1026886', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026886'}, {'name': 'wis-unspecified-sql-injection(74550)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74550'}, {'name': '48603', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48603'}, {'name': '52851', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52851'}, {'name': '80889', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80889'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-062-01.pdf'}, {'name': '1026887', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026887'}]
CVE State: PUBLISHED
Explain CVE-2012-0227
Buffer overflow in the VSFlex7.VSFlexGrid ActiveX control in ComponentOne FlexGrid 7.1, as used in Open Automation Software OPC Systems.NET, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long archive file name argument to the Archive method.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-012-01A.pdf'}, {'name': '51601', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51601'}, {'name': 'flexgrid-activex-bo(72604)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72604'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dsecrg.com/pages/vul/show.php?id=406'}]
CVE State: PUBLISHED
Explain CVE-2012-0228
Invensys Wonderware Information Server 4.0 SP1 and 4.5 does not properly implement client controls, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
Affected Products: n/a
References: [{'name': '1026886', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026886'}, {'name': '48603', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48603'}, {'name': '80890', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80890'}, {'name': '52851', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52851'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-062-01.pdf'}, {'name': '1026887', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026887'}]
CVE State: PUBLISHED
Explain CVE-2012-0229
The Data Archiver service in GE Intelligent Platforms Proficy Historian 4.5 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted session on TCP port 14000 to (1) ihDataArchiver.exe or (2) ihDataArchiver_x64.exe.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-032-01.pdf'}, {'name': '52437', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52437'}, {'name': '48369', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48369'}, {'tags': ['x_refsource_MISC'], 'url': 'http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB14767'}]
CVE State: PUBLISHED
Explain CVE-2012-0230
PRRDS.exe in the Proficy Remote Data Service in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TCP session on port 12299.
Affected Products: n/a
References: [{'name': '52434', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52434'}, {'name': 'proficy-plant-prrds-code-exec(73956)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73956'}, {'name': '48415', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48415'}, {'tags': ['x_refsource_MISC'], 'url': 'http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB14766'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-032-02.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-0231
PRLicenseMgr.exe in the Proficy Server License Manager in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TCP session on port 12401.
Affected Products: n/a
References: [{'name': '52434', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52434'}, {'name': '48415', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48415'}, {'tags': ['x_refsource_MISC'], 'url': 'http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB14766'}, {'name': 'proficy-prlicensemgr-code-exec(73957)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'http://xforce.iss.net/xforce/xfdb/73957'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-032-02.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-0232
Directory traversal vulnerability in rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6, 3.0, 3.0 SP1, and 3.5 allows remote attackers to modify the configuration via crafted strings.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB14768'}, {'name': '52439', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52439'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-032-03.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-0233
Cross-site scripting (XSS) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via a malformed URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}, {'name': '52051', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52051'}]
CVE State: PUBLISHED
Explain CVE-2012-0234
SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}, {'name': '52051', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52051'}]
CVE State: PUBLISHED
Explain CVE-2012-0235
Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}, {'name': '52051', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52051'}]
CVE State: PUBLISHED
Explain CVE-2012-0236
Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL.  NOTE: the vendor reportedly "does not consider it to be a security risk."
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}, {'name': '52051', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52051'}]
CVE State: PUBLISHED
Explain CVE-2012-0237
Advantech/BroadWin WebAccess before 7.0 allows remote attackers to (1) enable date and time syncing or (2) disable date and time syncing via a crafted URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}, {'name': '52051', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52051'}]
CVE State: PUBLISHED
Explain CVE-2012-0238
Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}, {'name': '52051', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52051'}]
CVE State: PUBLISHED
Explain CVE-2012-0239
uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}, {'name': '52051', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52051'}]
CVE State: PUBLISHED
Explain CVE-2012-0240
GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}, {'name': '52051', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52051'}]
CVE State: PUBLISHED
Explain CVE-2012-0241
Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service (memory corruption) via a modified stream identifier to a function.
Affected Products: n/a
References: [{'name': 'webaccess-stream-code-execution(73281)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73281'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}, {'name': '52051', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52051'}]
CVE State: PUBLISHED
Explain CVE-2012-0242
Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}, {'name': '52051', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52051'}]
CVE State: PUBLISHED
Explain CVE-2012-0243
Buffer overflow in an ActiveX control in bwocxrun.ocx in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code by leveraging the ability to write arbitrary content to any pathname.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}, {'name': '52051', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52051'}]
CVE State: PUBLISHED
Explain CVE-2012-0244
Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string input.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}, {'name': '52051', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52051'}]
CVE State: PUBLISHED
Explain CVE-2012-0245
Multiple stack-based buffer overflows in RobNetScanHost.exe in ABB Robot Communications Runtime before 5.14.02, as used in ABB Interlink Module, IRC5 OPC Server, PC SDK, PickMaster 3 and 5, RobView 5, RobotStudio, WebWare SDK, and WebWare Server, allow remote attackers to execute arbitrary code via a crafted (1) 0xA or (2) 0xE Netscan packet.
Affected Products: n/a
References: [{'name': '48090', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48090'}, {'name': '52123', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52123'}, {'name': '20120222 ZDI-12-033 : ABB WebWare RobNetScanHost.exe Remote Code Execution Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0125.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-059-01.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www05.abb.com/global/scot/scot348.nsf/veritydisplay/f261be074480dc24c12579a00049ecd5/%24file/si10227a1%20vulnerability%20security%20advisory.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-12-033/'}]
CVE State: PUBLISHED
Explain CVE-2012-0246
Directory traversal vulnerability in an unspecified ActiveX control in Ecava IntegraXor before 3.71.4200 allows remote attackers to execute arbitrary code via vectors involving an HTML document on the server.
Affected Products: n/a
References: [{'name': '48558', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48558'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-083-01.pdf'}, {'name': 'integraxor-activex-directory-traversal(74388)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74388'}, {'name': '80650', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80650'}]
CVE State: PUBLISHED
Explain CVE-2012-0247
ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset and count values in the ResolutionUnit tag in the EXIF IFD0 of an image.
Affected Products: n/a
References: [{'name': 'GLSA-201203-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-201203-09.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20286'}, {'name': '49068', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49068'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cert.fi/en/reports/2012/vulnerability595210.html'}, {'name': '48259', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48259'}, {'name': '49043', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49043'}, {'name': '49063', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49063'}, {'name': 'DSA-2427', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2427'}, {'name': 'RHSA-2012:0544', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0544.html'}, {'name': '47926', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47926'}, {'name': 'USN-1435-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1435-1'}, {'name': '48247', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48247'}, {'name': '79003', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79003'}, {'name': '1027032', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027032'}, {'name': 'RHSA-2012:0545', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0545.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0248
ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted image whose IFD contains IOP tags that all reference the beginning of the IDF.
Affected Products: n/a
References: [{'name': 'GLSA-201203-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-201203-09.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20286'}, {'name': '49068', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49068'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cert.fi/en/reports/2012/vulnerability595210.html'}, {'name': '48259', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48259'}, {'name': '49043', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49043'}, {'name': '51957', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51957'}, {'name': '49063', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49063'}, {'name': 'DSA-2427', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2427'}, {'name': 'RHSA-2012:0544', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0544.html'}, {'name': '47926', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47926'}, {'name': 'USN-1435-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1435-1'}, {'name': '48247', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48247'}, {'name': '79003', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79003'}, {'name': '1027032', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027032'}, {'name': 'RHSA-2012:0545', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0545.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0249
Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is smaller than the length specified in its header.
Affected Products: n/a
References: [{'name': 'RHSA-2012:1259', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1259.html'}, {'name': 'FEDORA-2012-5411', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078910.html'}, {'name': 'DSA-2459', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2459'}, {'name': 'VU#551715', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/551715'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.quagga.net/show_bug.cgi?id=705'}, {'name': '48949', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48949'}, {'name': 'RHSA-2012:1258', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1258.html'}, {'name': 'FEDORA-2012-5436', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078926.html'}, {'name': 'FEDORA-2012-5352', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078794.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0250
Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a network-LSA link-state advertisement for which the data-structure length is smaller than the value in the Length header field.
Affected Products: n/a
References: [{'name': 'RHSA-2012:1259', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1259.html'}, {'name': 'FEDORA-2012-5411', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078910.html'}, {'name': 'DSA-2459', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2459'}, {'name': 'VU#551715', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/551715'}, {'name': '48949', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48949'}, {'name': 'RHSA-2012:1258', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1258.html'}, {'name': 'FEDORA-2012-5436', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078926.html'}, {'name': 'FEDORA-2012-5352', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078794.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0253
Multiple cross-site scripting (XSS) vulnerabilities in Demand Media Pluck SiteLife before 5.0.13 allow remote attackers to inject arbitrary web script or HTML via (1) the jsonRequest parameter to Direct/Process, the (2) r or (3) cb parameter to Direct/jsonp.htm, or (4) the cb parameter to sys/jsonp.app/.htm.
Affected Products: n/a
References: [{'name': '48778', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48778'}, {'name': '52968', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52968'}, {'name': 'plucksitelife-multiple-xss(74805)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74805'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kb.cert.org/vuls/id/MAPG-8Q6JEG'}, {'name': 'VU#400619', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/400619'}]
CVE State: PUBLISHED
Explain CVE-2012-0254
Stack-based buffer overflow in the HMIWeb Browser HSCDSPRenderDLL ActiveX control in Honeywell Process Solutions (HPS) Experion R2xx, R30x, R31x, and R400.x; Honeywell Building Solutions (HBS) Enterprise Building Manager R400 and R410.1; and Honeywell Environmental Combustion and Controls (ECC) SymmetrE R410.1 allows remote attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.honeywellprocess.com/en-US/support/pages/all-notifications.aspx'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-150-01.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-0255
The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number Capability (aka AS4 capability).
Affected Products: n/a
References: [{'name': 'RHSA-2012:1259', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1259.html'}, {'name': 'FEDORA-2012-5411', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078910.html'}, {'name': 'DSA-2459', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2459'}, {'name': 'VU#551715', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/551715'}, {'name': '48949', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48949'}, {'name': 'FEDORA-2012-5436', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078926.html'}, {'name': 'FEDORA-2012-5352', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078794.html'}]
CVE State: PUBLISHED