Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2012-0952
A heap buffer overflow was discovered in the device control ioctl in the Linux driver for Nvidia graphics cards, which may allow an attacker to overflow 49 bytes. This issue was fixed in version 295.53.
Affected Products: graphics drivers
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/nvidia-graphics-drivers/+bug/979373'}]
CVE State: PUBLISHED
Explain CVE-2012-0953
A race condition was discovered in the Linux drivers for Nvidia graphics which allowed an attacker to exfiltrate kernel memory to userspace. This issue was fixed in version 295.53.
Affected Products: graphics drivers
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/nvidia-graphics-drivers/+bug/979373'}]
CVE State: PUBLISHED
Explain CVE-2012-0954
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587.
Affected Products: n/a
References: [{'name': '20120614 Using second gpg keyring may be misleading?', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2012/Jun/271'}, {'name': '54046', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/54046'}, {'name': '20120612 Strange gpg key shadowing', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2012/Jun/267'}, {'name': 'USN-1477-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1477-1'}, {'name': 'USN-1475-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1475-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013639'}, {'name': '20120615 ubuntu apt-key (part 3)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2012/Jun/289'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013681'}]
CVE State: PUBLISHED
Explain CVE-2012-0955
software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.
Affected Products: software-properties
References: [{'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://launchpad.net/bugs/1036839'}, {'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://code.launchpad.net/~cyphermox/software-properties/lp1036839/+merge/119753'}]
CVE State: PUBLISHED
Explain CVE-2012-0956
ubiquity-slideshow-ubuntu before 58.2, during installation, allows remote man-in-the-middle attackers to execute arbitrary web script or HTML and read arbitrary files via a crafted attribute in the <a> tag of a Twitter feed.
Affected Products: n/a
References: [{'name': 'USN-1561-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1561-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/%2Bsource/ubiquity-slideshow-ubuntu/%2Bbug/991982'}]
CVE State: PUBLISHED
Explain CVE-2012-0957
The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.
Affected Products: n/a
References: [{'name': 'USN-1644-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1644-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.16'}, {'name': 'USN-1645-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1645-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2702b1526c7278c4d65d78de209a465d4de2885e'}, {'name': 'USN-1647-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1647-1'}, {'name': 'USN-1652-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1652-1'}, {'name': 'USN-1646-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1646-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=862877'}, {'name': 'FEDORA-2012-17479', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091110.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/2702b1526c7278c4d65d78de209a465d4de2885e'}, {'name': 'USN-1648-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1648-1'}, {'name': 'USN-1649-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1649-1'}, {'name': '51409', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51409'}, {'name': '[oss-security] 20121009 Linux kernel stack memory content leak via UNAME26', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/10/09/4'}]
CVE State: PUBLISHED
Explain CVE-2012-0958
content/unity-api.js in the unity-firefox-extension extension 2.4.1 for Firefox exposes the toDataURL function in an API call, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted webpage.
Affected Products: n/a
References: [{'name': 'USN-1665-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1665-1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/%2Bsource/unity-firefox-extension/%2Bbug/1069817'}, {'name': '56930', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/56930'}, {'name': '88438', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/88438'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bazaar.launchpad.net/~webapps/unity-firefox-extension/trunk/revision/331'}]
CVE State: PUBLISHED
Explain CVE-2012-0959
Remote Login Service (RLS) 1.0.0 does not properly clear account information when switching users, which might allow physically proximate users to obtain login credentials.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/remote-login-service/%2Bbug/1070896'}, {'name': 'USN-1624-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1624-1'}, {'name': 'remote-login-info-disc(80278)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/80278'}]
CVE State: PUBLISHED
Explain CVE-2012-0960
Unity integration extension (unity-firefox-extension) before 2.4.1 for Firefox does not properly handle callbacks, which allows remote attackers to cause a denial of service (Firefox crash) and possibly execute arbitrary code via a crafted request.
Affected Products: n/a
References: [{'name': '56650', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/56650'}, {'name': 'unityfirefoxextension-callback-dos(80319)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/80319'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/unity-firefox-extension/%2Bbug/1076350'}, {'name': 'USN-1639-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1639-1'}]
CVE State: PUBLISHED
Explain CVE-2012-0961
Apt 0.8.16~exp5ubuntu13.x before 0.8.16~exp5ubuntu13.6, 0.8.16~exp12ubuntu10.x before 0.8.16~exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0.9.7.5ubuntu5.2, as used in Ubuntu, uses world-readable permissions for /var/log/apt/term.log, which allows local users to obtain sensitive shell information by reading the log file.
Affected Products: n/a
References: [{'name': '56917', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/56917'}, {'name': '51568', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51568'}, {'name': 'USN-1662-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1662-1'}, {'name': '88380', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/88380'}]
CVE State: PUBLISHED
Explain CVE-2012-0962
Aptdaemon 0.43 in Ubuntu 11.10 and 12.04 LTS uses short IDs when importing PPA GPG keys from a keyserver, which allows remote attackers to install arbitrary package repository GPG keys via a man-in-the-middle (MITM) attack.
Affected Products: n/a
References: [{'name': '51627', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51627'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/software-center-agent/%2Bbug/1052789'}, {'name': 'USN-1666-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1666-1'}, {'name': '1027891', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027891'}, {'name': '56959', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/56959'}]
CVE State: PUBLISHED
Explain CVE-2012-0973
Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the (1) osc_search_category_id function in oc-includes/osclass/helpers/hSearch.php and (2) findBySlug function oc-includes/osclass/model/Category.php.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f#diff-73'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://osclass.org/2012/01/16/osclass-2-3-5/'}, {'name': '51662', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51662'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_osclass.html'}, {'name': '47697', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47697'}, {'name': '20120125 Multiple vulnerabilities in OSclass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0157.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0974
Multiple cross-site scripting (XSS) vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) sCity, (2) sPattern, (3) sPriceMax, and (4) sPriceMin parameters in a search action to index.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f#diff-73'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://osclass.org/2012/01/16/osclass-2-3-5/'}, {'name': '51662', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51662'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_osclass.html'}, {'name': '47697', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47697'}, {'name': '20120125 Multiple vulnerabilities in OSclass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0157.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0975
Cross-site scripting (XSS) vulnerability in misc.php in Image Hosting Script DPI 1.0, 1.3, and earlier allows remote attackers to inject arbitrary web script or HTML via the showseries parameter.
Affected Products: n/a
References: [{'name': 'dpi-misc-xss(72823)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72823'}, {'name': '51734', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51734'}, {'name': '47786', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47786'}, {'name': '78660', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78660'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/view/109240/dpi10-xss.txt'}]
CVE State: PUBLISHED
Explain CVE-2012-0976
Cross-site scripting (XSS) vulnerability in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/silverstripe/sapphire/commit/475e077'}, {'name': '78677', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78677'}, {'name': '51761', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51761'}, {'name': '47812', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47812'}, {'name': '[oss-security] 20120430 Re: CVE-request: SilverStripe before 2.4.4', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/30/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/silverstripe/sapphire/commit/5fe7091'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13'}, {'name': 'silverstripe-editform-xss(72820)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72820'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/view/109210/silverstripecmspage-xss.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/silverstripe/sapphire/commit/252e187'}]
CVE State: PUBLISHED
Explain CVE-2012-0977
Stack-based buffer overflow in jp2_x.dll in LuraWave JP2 ActiveX Control 2.1.5.5 and other versions before 2.1.5.11 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.
Affected Products: n/a
References: [{'name': '51744', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51744'}, {'name': 'lurawave-jp2-qcd-bo(72807)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72807'}, {'name': '78661', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78661'}, {'name': '47350', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47350'}]
CVE State: PUBLISHED
Explain CVE-2012-0978
Stack-based buffer overflow in npjp2.dll in LuraWave JP2 Browser Plug-In 1.1.1.11 and other versions before 2.1.1.11 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.
Affected Products: n/a
References: [{'name': '51732', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51732'}, {'name': 'lurawave-qcd-bo(72806)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72806'}, {'name': '78662', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78662'}, {'name': '47831', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47831'}]
CVE State: PUBLISHED
Explain CVE-2012-0979
Cross-site scripting (XSS) vulnerability in TWiki allows remote attackers to inject arbitrary web script or HTML via the organization field in a profile, involving (1) registration or (2) editing of the user.
Affected Products: n/a
References: [{'name': '47784', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47784'}, {'tags': ['x_refsource_MISC'], 'url': 'http://st2tea.blogspot.com/2012/01/cross-site-scripting-twiki.html'}, {'name': '1026604', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026604'}, {'name': '51731', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51731'}, {'name': 'twiki-organization-xss(72821)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72821'}, {'name': '78664', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78664'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109246/twiki-xss.txt'}]
CVE State: PUBLISHED
Explain CVE-2012-0980
SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL commands via the file parameter.
Affected Products: n/a
References: [{'name': '51725', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51725'}, {'name': '18432', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18432'}, {'name': 'phux-download-sql-injection(72826)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72826'}]
CVE State: PUBLISHED
Explain CVE-2012-0981
Directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image files via a .. (dot dot) in the r parameter to index.php.  NOTE: Some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '47802', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47802'}, {'name': '18435', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18435'}, {'name': 'phpshowtime-index-directory-traversal(72824)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72824'}]
CVE State: PUBLISHED
Explain CVE-2012-0982
SQL injection vulnerability in search.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the price_from parameter.
Affected Products: n/a
References: [{'name': '18441', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18441'}, {'name': '51773', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51773'}, {'name': 'agentzone-search-sql-injection(72879)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72879'}]
CVE State: PUBLISHED
Explain CVE-2012-0983
SQL injection vulnerability in Scriptsez.net Ez Album allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
Affected Products: n/a
References: [{'name': 'ezalbum-index-sql-injection(72809)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72809'}, {'name': '18438', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18438'}, {'name': '51781', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51781'}]
CVE State: PUBLISHED
Explain CVE-2012-0984
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) to_userid parameter to modules/pm/pmlite.php or the (2) current_file, (3) imgcat_id, or (4) target parameter to class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php.
Affected Products: n/a
References: [{'name': '81212', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81212'}, {'name': '18753', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18753'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/multiple_vulnerabilities_in_xoops.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/111958/XOOPS-2.5.4-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xoops.org/modules/news/article.php?storyid=6284'}, {'name': '20120418 Multiple XSS vulnerabilities in XOOPS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-04/0128.html'}, {'name': '48887', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48887'}, {'name': 'xoops-pmlite-xoopsimagebrowser-xss(75024)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75024'}, {'name': '81213', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81213'}, {'name': '53143', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53143'}]
CVE State: PUBLISHED
Explain CVE-2012-0985
Multiple buffer overflows in the Wireless Manager ActiveX control 4.0.0.0 in WifiMan.dll in Sony VAIO PC Wireless LAN Wizard 1.0; VAIO Wireless Wizard 1.00, 1.00_64, 1.0.1, 2.0, and 3.0; SmartWi Connection Utility 4.7, 4.7.4, 4.8, 4.9, 4.10, and 4.11; and VAIO Easy Connect software 1.0.0 and 1.1.0 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the second argument of the (1) SetTmpProfileOption or (2) ConnectToNetwork method.
Affected Products: n/a
References: [{'name': '20120530 2 Buffer Overflows in Wireless Manager Sony VAIO', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-05/0147.html'}, {'name': '18958', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18958'}, {'name': '49340', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49340'}, {'name': '82401', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/82401'}, {'name': '53735', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53735'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://esupport.sony.com/US/perl/support-info.pl?template_id=1&info_id=946'}, {'name': 'vaio-activex-bo(75978)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75978'}]
CVE State: PUBLISHED
Explain CVE-2012-0986
Multiple cross-site scripting (XSS) vulnerabilities in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) notifications.php, (2) modules/system/admin/images/browser.php, and (3) modules/content/admin/content.php.
Affected Products: n/a
References: [{'name': '78140', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78140'}, {'name': '51268', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51268'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23064'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://community.impresscms.org/modules/smartsection/item.php?itemid=579'}, {'name': '78142', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78142'}, {'name': '47448', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47448'}, {'name': 'impresscms-multiple-xss(72145)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72145'}, {'name': '20120104 Multiple vulnerabilities in ImpressCMS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0022.html'}, {'name': '78141', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78141'}]
CVE State: PUBLISHED
Explain CVE-2012-0987
Directory traversal vulnerability in edituser.php in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the icmsConfigPlugins[sanitizer_plugins][] parameter.
Affected Products: n/a
References: [{'name': 'impresscms-edituser-file-include(72146)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72146'}, {'name': '51268', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51268'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23064'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://community.impresscms.org/modules/smartsection/item.php?itemid=579'}, {'name': '78143', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78143'}, {'name': '47448', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47448'}, {'name': '20120104 Multiple vulnerabilities in ImpressCMS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0022.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0988
Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) login.php, (2) admin.php, or (3) preferences.php.
Affected Products: n/a
References: [{'name': '51373', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51373'}, {'name': '20120111 Multiple XSS in KnowledgeTree Community Edition', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0070.html'}, {'name': 'knowledgetree-multiple-xss(72308)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72308'}, {'name': '47531', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47531'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.knowledgetree.org/Security_advisory:_URL_Manipulation'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_knowledgetree_community_edition.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0989
Cross-site scripting (XSS) vulnerability in OneOrZero AIMS 2.8.0 Trial Edition build231211 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/xss_in_oneorzero_aims.html'}, {'name': 'oneorzeroaims-index-xss(72456)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72456'}, {'name': '51549', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51549'}, {'name': '20120118 XSS in OneOrZero AIMS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0117.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0990
Cross-site request forgery (CSRF) vulnerability in admin/settings/update in DClassifieds 0.1 final allows remote attackers to hijack the authentication of administrators for requests that modify account settings such as the administrator password or email via certain Settings[] parameters.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/projects/dclassifieds/files/csrf_fix_120105.rar/download'}, {'name': '47691', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47691'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/HTB23067'}, {'name': '78557', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78557'}, {'name': '51671', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51671'}, {'name': 'dclassifieds-settings-csrf(72733)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72733'}, {'name': '20120125 CSRF (Cross-Site Request Forgery) in DClassifieds', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0158.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0991
Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in interface/patient_file/encounter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/HTB23069'}, {'name': '78727', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78727'}, {'name': '51788', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51788'}, {'name': '20120201 Multiple vulnerabilities in OpenEMR', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0004.html'}, {'name': '47781', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47781'}, {'name': '78729', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78729'}, {'name': '78728', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78728'}, {'name': 'openemr-formname-file-include(72914)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72914'}, {'name': '78730', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78730'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.open-emr.org/wiki/index.php/OpenEMR_Patches'}]
CVE State: PUBLISHED
Explain CVE-2012-0992
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/HTB23069'}, {'name': '78731', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78731'}, {'name': '51788', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51788'}, {'name': '20120201 Multiple vulnerabilities in OpenEMR', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0004.html'}, {'name': '47781', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47781'}, {'name': 'openemr-faxdispatch-command-execution(72915)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72915'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.open-emr.org/wiki/index.php/OpenEMR_Patches'}]
CVE State: PUBLISHED
Explain CVE-2012-0993
Eval injection vulnerability in zp-core/zp-extensions/viewer_size_image.php in ZENphoto 1.4.2, when the viewer_size_image plugin is enabled, allows remote attackers to execute arbitrary PHP code via the viewer_size_image_saved cookie.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zenphoto.org/trac/changeset/8995'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zenphoto.org/trac/changeset/8994'}, {'name': '51916', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51916'}, {'name': '47875', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47875'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/HTB23070'}, {'name': 'zenphoto-viewersizeimage-code-execution(73081)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73081'}, {'name': '20120208 Multiple vulnerabilities in ZENphoto', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0037.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zenphoto.org/news/zenphoto-1.4.2.1'}]
CVE State: PUBLISHED
Explain CVE-2012-0994
SQL injection vulnerability in the Manage Albums feature in zp-core/admin-albumsort.php in ZENphoto 1.4.2 allows remote authenticated users to execute arbitrary SQL commands via the sortableList parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zenphoto.org/trac/changeset/8995'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zenphoto.org/trac/changeset/8994'}, {'name': '51916', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51916'}, {'name': '47875', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47875'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/HTB23070'}, {'name': 'zenphoto-albumsort-sql-injection(73082)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73082'}, {'name': '20120208 Multiple vulnerabilities in ZENphoto', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0037.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zenphoto.org/news/zenphoto-1.4.2.1'}]
CVE State: PUBLISHED
Explain CVE-2012-0995
Multiple cross-site scripting (XSS) vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in an external action to zp-core/admin.php, (2) PATH_INTO to an unspecified URL, as demonstrated using /1/, (3) PATH_INFO to zp-core/admin.php, or (4) album parameter to zp-core/admin-edit.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zenphoto.org/trac/changeset/8995'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zenphoto.org/trac/changeset/8994'}, {'name': 'zenphoto-multiple-xss(73083)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73083'}, {'name': '51916', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51916'}, {'name': '47875', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47875'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/HTB23070'}, {'name': '20120208 Multiple vulnerabilities in ZENphoto', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0037.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zenphoto.org/news/zenphoto-1.4.2.1'}]
CVE State: PUBLISHED
Explain CVE-2012-0996
Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. (dot dot) in the class parameter to (1) index.php or (2) admin/index.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/HTB23071'}]
CVE State: PUBLISHED
Explain CVE-2012-0997
Cross-site request forgery (CSRF) vulnerability in admin/index.php in 11in1 1.2.1 stable 12-31-2011 allows remote attackers to hijack the authentication of administrators for requests that add new topics via an addTopic action.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/HTB23071'}]
CVE State: PUBLISHED
Explain CVE-2012-0998
Directory traversal vulnerability in account/preferences.php in LEPTON before 1.1.4 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the language parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.lepton-cms.org/media/changelog/changelog_1.1.4.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/HTB23072'}]
CVE State: PUBLISHED
Explain CVE-2012-0999
SQL injection vulnerability in modules/news/rss.php in LEPTON before 1.1.4 allows remote attackers to execute arbitrary SQL commands via the group_id parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.lepton-cms.org/media/changelog/changelog_1.1.4.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/HTB23072'}]
CVE State: PUBLISHED
Explain CVE-2012-1000
Multiple cross-site scripting (XSS) vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) message parameter to admins/login/forgot/index.php, or the (2) display_name or (3) email parameter to account/preferences.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.lepton-cms.org/media/changelog/changelog_1.1.4.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/HTB23072'}]
CVE State: PUBLISHED
Explain CVE-2012-1001
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/HTB23073'}, {'tags': ['x_refsource_MISC'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/52115'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/52117'}]
CVE State: PUBLISHED
Explain CVE-2012-1002
SQL injection vulnerability in author/edit.php in OpenConf 4.x before 4.12 allows remote attackers to execute arbitrary SQL commands via the pid parameter.
Affected Products: n/a
References: [{'name': 'openconf-edit-sql-injection(75399)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75399'}, {'name': '51927', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51927'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openconf.com/news/#20120202'}, {'name': '18820', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18820'}]
CVE State: PUBLISHED
Explain CVE-2012-1003
Multiple integer overflows in Opera 11.60 and earlier allow remote attackers to cause a denial of service (application crash) via a large integer argument to the (1) Int32Array, (2) Float32Array, (3) Float64Array, (4) Uint32Array, (5) Int16Array, or (6) ArrayBuffer function.  NOTE: the vendor reportedly characterizes this as "a stability issue, not a security issue."
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://blog.vulnhunt.com/index.php/2012/02/02/cal-2012-0004-opera-array-integer-overflow/'}, {'name': 'opera-integer-dos(73027)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73027'}]
CVE State: PUBLISHED
Explain CVE-2012-1004
Multiple cross-site scripting (XSS) vulnerabilities in UI/Register.pm in Foswiki before 1.1.5 allow remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via the (1) text, (2) FirstName, (3) LastName, (4) OrganisationName, (5) OrganisationUrl, (6) Profession, (7) Country, (8) State, (9) Address, (10) Location, (11) Telephone, (12) VoIP, (13) InstantMessagingIM, (14) Email, (15) HomePage, or (16) Comment parameter.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://st2tea.blogspot.com/2012/02/foswiki-cross-site-scripting.html'}, {'name': '47849', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47849'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://foswiki.org/Support/SecurityAlert-CVE-2012-1004'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://foswiki.org/Tasks/Item11501'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://foswiki.org/Tasks/Item11498'}]
CVE State: PUBLISHED
Explain CVE-2012-1005
Multiple cross-site scripting (XSS) vulnerabilities in Sphinx Software Mobile Web Server 3.1.2.47 allow remote attackers to inject arbitrary web script or HTML via the comment parameter to a blog, as demonstrated using (1) Blog/MyFirstBlog.txt or (2) Blog/AboutSomething.txt.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/blog/?p=453'}, {'name': 'sphinixsoftware-comment-xss(72913)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72913'}, {'name': '51820', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51820'}, {'name': '47876', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47876'}]
CVE State: PUBLISHED
Explain CVE-2012-1006
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/blog/?p=450'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt'}, {'name': 'apache-struts-multiple-xss(72888)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72888'}, {'name': '51902', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51902'}]
CVE State: PUBLISHED
Explain CVE-2012-1007
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/blog/?p=450'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html'}, {'name': 'apache-struts-name-xss(73052)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73052'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html'}, {'name': '51900', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51900'}]
CVE State: PUBLISHED
Explain CVE-2012-1008
OfficeSIP Server 3.1 allows remote attackers to cause a denial of service (daemon crash) via a crafted To header in a SIP INVITE message.
Affected Products: n/a
References: [{'name': '18453', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18453'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/exploits/SecPod_Exploit_OfficeSIP_Server_DOS.py'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/blog/?p=461'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/advisories/SecPod_Exploit_OfficeSIP_Server_DOS_Vuln.txt'}]
CVE State: PUBLISHED
Explain CVE-2012-1009
NetSarang Xlpd 4 Build 0100 and NetSarang Xmanager Enterprise 4 Build 0186 allow remote attackers to cause a denial of service (daemon crash) via a malformed LPD request.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/advisories/SecPod_Exploit_NetSarang_Xlpd_Printer_Daemon_DoS_Vuln.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secpod.org/blog/?p=457'}, {'name': '51821', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51821'}, {'name': '18454', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18454'}, {'name': 'netsarang-xlpd-dos(72933)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72933'}]
CVE State: PUBLISHED
Explain CVE-2012-1010
Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.
Affected Products: n/a
References: [{'name': '18407', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18407'}, {'name': '51615', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51615'}, {'name': 'allwebmenus-actions-file-upload(72640)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72640'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog/'}, {'name': '20120122 AllWebMenus < 1.1.9 WordPress Menu Plugin Arbitrary file upload', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html'}, {'name': '47659', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47659'}]
CVE State: PUBLISHED
Explain CVE-2012-1011
actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.
Affected Products: n/a
References: [{'name': '18407', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18407'}, {'name': '51615', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51615'}, {'name': 'allwebmenus-actions-file-upload(72640)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72640'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog/'}, {'name': '20120122 AllWebMenus < 1.1.9 WordPress Menu Plugin Arbitrary file upload', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html'}, {'name': '47659', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47659'}]
CVE State: PUBLISHED