Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2012-0775
The JavaScript implementation in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Affected Products: n/a
References: [{'name': 'RHSA-2012:0469', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0469.html'}, {'name': '48756', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48756'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb12-08.html'}, {'name': 'SUSE-SU-2012:0524', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00017.html'}, {'name': '52949', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52949'}, {'name': '48846', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48846'}, {'name': 'TA12-101B', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-101B.html'}, {'name': 'SUSE-SU-2012:0522', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00016.html'}, {'name': 'openSUSE-SU-2012:0512', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00013.html'}, {'name': '1026908', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026908'}, {'name': 'oval:org.mitre.oval:def:15477', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15477'}, {'name': 'adobe-reader-javascript-code-exec(74733)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74733'}]
CVE State: PUBLISHED
Explain CVE-2012-0776
The installer in Adobe Reader 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb12-08.html'}, {'name': 'TA12-101B', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-101B.html'}, {'name': 'oval:org.mitre.oval:def:15270', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15270'}, {'name': '1026908', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026908'}]
CVE State: PUBLISHED
Explain CVE-2012-0777
The JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 on Mac OS X and Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Affected Products: n/a
References: [{'name': 'RHSA-2012:0469', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0469.html'}, {'name': '48756', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48756'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb12-08.html'}, {'name': 'SUSE-SU-2012:0524', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00017.html'}, {'name': '52950', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52950'}, {'name': '48846', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48846'}, {'name': 'TA12-101B', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA12-101B.html'}, {'name': 'SUSE-SU-2012:0522', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00016.html'}, {'name': 'openSUSE-SU-2012:0512', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00013.html'}, {'name': '1026908', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026908'}, {'name': 'adobe-reader-javascriptapi-code-exec(74735)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74735'}]
CVE State: PUBLISHED
Explain CVE-2012-0778
Buffer overflow in Adobe Flash Professional before CS6 allows attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'name': '1027045', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027045'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb12-12.html'}, {'name': '53419', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53419'}]
CVE State: PUBLISHED
Explain CVE-2012-0779
Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x allows remote attackers to execute arbitrary code via a crafted file, related to an "object confusion vulnerability," as exploited in the wild in May 2012.
Affected Products: n/a
References: [{'name': '1027023', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027023'}, {'name': 'openSUSE-SU-2012:0594', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00005.html'}, {'name': '53395', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53395'}, {'name': '49096', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49096'}, {'name': 'RHSA-2012:0688', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0688.html'}, {'name': '81656', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81656'}, {'name': '49038', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49038'}, {'name': 'SUSE-SU-2012:0592', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb12-09.html'}, {'name': 'adobe-flash-objecttype-code-exec(75383)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75383'}]
CVE State: PUBLISHED
Explain CVE-2012-0780
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2023, CVE-2012-2024, CVE-2012-2025, and CVE-2012-2026.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb12-10.html'}, {'name': '53422', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53422'}, {'name': 'illustrator-unspec-code-exec(75445)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75445'}, {'name': '1027047', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027047'}]
CVE State: PUBLISHED
Explain CVE-2012-0781
The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that attempts to perform Tidy::diagnose operations on invalid objects, a different vulnerability than CVE-2011-4153.
Affected Products: n/a
References: [{'name': '18370', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18370/'}, {'name': '20120114 PHP 5.3.8 Multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0092.html'}, {'name': 'SUSE-SU-2012:0411', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html'}, {'name': 'openSUSE-SU-2012:0426', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html'}, {'name': '48668', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48668'}, {'tags': ['x_refsource_MISC'], 'url': 'http://cxsecurity.com/research/103'}]
CVE State: PUBLISHED
Explain CVE-2012-0782
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance
Affected Products: n/a
References: [{'name': '18417', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18417'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt'}, {'name': '20120124 TWSL2012-002: Multiple Vulnerabilities in WordPress', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0150.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0785
Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."
Affected Products: Jenkins
References: [{'name': '[oss-security] 20120119 Re: CVE request: Jenkins', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/20/8'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-0785'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-0785'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://jenkins.io/security/advisory/2012-01-12/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.cloudbees.com/jenkins-security-advisory-2012-01-12'}]
CVE State: PUBLISHED
Explain CVE-2012-0786
The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/hercules-team/augeas/commit/16387744'}, {'name': '55811', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55811'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://augeas.net/news.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=772257'}, {'name': 'RHSA-2013:1537', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1537.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0787
The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.
Affected Products: n/a
References: [{'name': '55811', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55811'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://augeas.net/news.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=772261'}, {'name': 'RHSA-2013:1537', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1537.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/hercules-team/augeas/commit/b8de6a8c'}]
CVE State: PUBLISHED
Explain CVE-2012-0788
The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start function, as demonstrated by a crash of the Apache HTTP Server.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2012:0411', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.php.net/bug.php?id=55776'}, {'name': 'openSUSE-SU-2012:0426', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html'}, {'name': '48668', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48668'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/ChangeLog-5.php#5.3.9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783605'}]
CVE State: PUBLISHED
Explain CVE-2012-0789
Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2012:0411', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html'}, {'name': 'openSUSE-SU-2012:0426', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html'}, {'name': '48668', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48668'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783609'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/ChangeLog-5.php#5.3.9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.php.net/bug.php?id=53502'}]
CVE State: PUBLISHED
Explain CVE-2012-0790
Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2.4.2, 2.6.6, and other versions before 2.6.7 allows remote attackers to inject arbitrary web script or HTML via the displaymode parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783584'}, {'name': '47678', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47678'}, {'name': '51584', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51584'}, {'tags': ['x_refsource_MISC'], 'url': 'http://holisticinfosec.org/content/view/188/45/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://oss.oetiker.ch/smokeping/pub/CHANGES'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.gentoo.org/show_bug.cgi?id=399553'}, {'name': '[oss-security] 20120120 Re: CVE request: smokeping XSS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/21/1'}]
CVE State: PUBLISHED
Explain CVE-2012-0791
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.horde.org/apps/webmail/docs/CHANGES'}, {'name': 'DSA-2485', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2485'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.horde.org/apps/webmail/docs/RELEASE_NOTES'}, {'name': '1026553', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026553'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.horde.org/apps/imp/docs/RELEASE_NOTES'}, {'name': '51586', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51586'}, {'name': '47580', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47580'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.horde.org/apps/imp/docs/CHANGES'}, {'name': '1026554', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026554'}, {'name': '[oss-security] 20120121 Re: Re: CVE Request -- Horde IMP -- Multiple XSS flaws', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/22/2'}, {'name': '47592', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47592'}]
CVE State: PUBLISHED
Explain CVE-2012-0792
mod/forum/user.php in Moodle 1.9.x before 1.9.16 allows remote authenticated users to obtain the names and other details of arbitrary user accounts by searching for posts.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=36b0ddeed45d0751508dcd9fa50f17fda43bae54'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://moodle.org/mod/forum/discuss.php?d=194009'}, {'name': 'DSA-2421', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2421'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783532'}]
CVE State: PUBLISHED
Explain CVE-2012-0793
Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote attackers to view the profile images of arbitrary user accounts via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://moodle.org/mod/forum/discuss.php?d=194012'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=90911c4ff98dc2078a3acef5ddf5a1a8f7e20ba5'}, {'name': 'DSA-2421', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2421'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783532'}]
CVE State: PUBLISHED
Explain CVE-2012-0794
The rc4encrypt function in lib/moodlelib.php in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 uses a hardcoded password of nfgjeingjk, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by reading this script's source code within the open-source software distribution.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://moodle.org/mod/forum/discuss.php?d=194013'}, {'name': 'DSA-2421', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2421'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=98456628a24bba25d336860d38a45b5a4e3895da'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783532'}]
CVE State: PUBLISHED
Explain CVE-2012-0795
Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 does not validate e-mail address settings, which allows remote authenticated users to have an unspecified impact via a crafted address.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-13572'}, {'name': 'DSA-2421', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2421'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783532'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://moodle.org/mod/forum/discuss.php?d=194014'}]
CVE State: PUBLISHED
Explain CVE-2012-0796
class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://moodle.org/mod/forum/discuss.php?d=194015'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=62988bf0bbc73df655f51884aaf1f523928abff9'}, {'name': 'DSA-2421', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2421'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783532'}]
CVE State: PUBLISHED
Explain CVE-2012-0797
The webservices functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote authenticated users to bypass the deleted status and continue using a server via a token.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-28126'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783532'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://moodle.org/mod/forum/discuss.php?d=194016'}]
CVE State: PUBLISHED
Explain CVE-2012-0798
The self-enrolment functionality in Moodle 2.1.x before 2.1.4 and 2.2.x before 2.2.1 allows remote authenticated users to obtain the manager role by leveraging the teacher role.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29469'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783532'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://moodle.org/mod/forum/discuss.php?d=194017'}]
CVE State: PUBLISHED
Explain CVE-2012-0799
Moodle 2.0.x before 2.0.7 and 2.1.x before 2.1.4, when an anonymous front-page forum is enabled, allows remote attackers to obtain session keys for their sessions by visiting the front page.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-27334'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://moodle.org/mod/forum/discuss.php?d=194018'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783532'}]
CVE State: PUBLISHED
Explain CVE-2012-0800
The form-autocompletion functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 makes it easier for physically proximate attackers to discover passwords by reading the contents of a non-password field, as demonstrated by accessing a create-groups page with Safari on an iPad device.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://moodle.org/mod/forum/discuss.php?d=194019'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=6e9989dbd3f261b2e1586ff77b0bf22fc7091485'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783532'}]
CVE State: PUBLISHED
Explain CVE-2012-0801
lib/formslib.php in Moodle 2.1.x before 2.1.4 and 2.2.x before 2.2.1 does not properly handle multiple instances of a form element, which has unspecified impact and remote attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=51070abc78b9e1db1db9a44855e8623b22bebd48'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://moodle.org/mod/forum/discuss.php?d=194020'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783532'}]
CVE State: PUBLISHED
Explain CVE-2012-0802
Multiple buffer overflows in Spamdyke before 4.3.0 might allow remote attackers to execute arbitrary code via vectors related to "serious errors in the usage of snprintf()/vsnprintf()" in which the return values may be larger than the size of the buffer.
Affected Products: n/a
References: [{'name': '47548', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47548'}, {'name': '[oss-security] 20120123 Re: CVE request: spamdyke buffer overflow vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/23/5'}, {'name': '51440', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51440'}, {'name': '78351', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78351'}, {'name': '[spamdyke-release] 20120115 New version: spamdyke 4.3.0', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.mail-archive.com/spamdyke-release%40spamdyke.org/msg00014.html'}, {'name': '48257', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48257'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.spamdyke.org/documentation/Changelog.txt'}, {'name': 'GLSA-201203-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201203-01.xml'}]
CVE State: PUBLISHED
Explain CVE-2012-0803
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request.
Affected Products: n/a
References: [{'name': '[Full-disclosure] 20120207 Apache CXF does not validate UsernameToken policies correctly', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=full-disclosure&m=132861746008002'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.apache.org/viewvc?view=revision&revision=1233457'}, {'name': '[cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E'}, {'name': '[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E'}, {'name': '[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E'}, {'name': '[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E'}, {'name': '[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E'}, {'name': '[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E'}]
CVE State: PUBLISHED
Explain CVE-2012-0804
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2012:0310', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2012-02/msg00064.html'}, {'name': '1026719', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026719'}, {'name': '48150', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48150'}, {'name': 'cvs-proxyconnect-bo(73097)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73097'}, {'name': 'RHSA-2012:0321', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0321.html'}, {'name': 'MDVSA-2012:044', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:044'}, {'name': '78987', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78987'}, {'name': '48142', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48142'}, {'name': 'USN-1371-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1371-1'}, {'name': '47869', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47869'}, {'name': 'GLSA-201701-44', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-44'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=784141'}, {'name': 'DSA-2407', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2407'}, {'name': '51943', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51943'}, {'name': '48063', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48063'}]
CVE State: PUBLISHED
Explain CVE-2012-0805
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
Affected Products: n/a
References: [{'name': 'sqlalchemy-select-sql-injection(73756)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73756'}, {'name': 'MDVSA-2012:059', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:059'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/keystone/+bug/918608'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sqlalchemy.org/trac/changeset/852b6a1a87e7/'}, {'name': 'DSA-2449', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2449'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sqlalchemy.org/changelog/CHANGES_0_7_0'}, {'name': '48771', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48771'}, {'name': '48328', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48328'}, {'name': '48327', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48327'}, {'name': 'RHSA-2012:0369', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0369.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0806
Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of TCP connections that triggers use of many open file descriptors.
Affected Products: n/a
References: [{'name': '[oss-security] 20120124 Re: CVE request: bip buffer overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/24/10'}, {'name': 'MDVSA-2013:063', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:063'}, {'name': '47679', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47679'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://projects.duckcorp.org/projects/bip/repository/revisions/222a33cb84a2e52ad55a88900b7895bf9dd0262c'}, {'name': 'FEDORA-2012-0941', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-February/072752.html'}, {'name': 'FEDORA-2012-0916', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-February/072767.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://projects.duckcorp.org/issues/269'}, {'name': '[oss-security] 20120124 CVE request: bip buffer overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/24/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657217'}]
CVE State: PUBLISHED
Explain CVE-2012-0807
Stack-based buffer overflow in the suhosin_encrypt_single_cookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might allow remote attackers to execute arbitrary code via a long string that is used in a Set-Cookie HTTP header.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783350'}, {'name': '[oss-security] 20120124 Re: CVE requests: Suhosin extension / as31', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/24/11'}, {'name': 'SUSE-SU-2012:0411', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html'}, {'name': 'openSUSE-SU-2012:0426', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html'}, {'name': '[oss-security] 20120124 CVE requests: Suhosin extension / as31', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/24/7'}, {'name': 'SUSE-SU-2012:0472', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00001.html'}, {'name': '48668', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48668'}, {'name': '20120119 Advisory 01/2012: Suhosin PHP Extension Transparent Cookie Encryption Stack Buffer Overflow', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2012-01/0296.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/stefanesser/suhosin/commit/73b1968ee30f6d9d2dae497544b910e68e114bfa'}]
CVE State: PUBLISHED
Explain CVE-2012-0808
as31 2.3.1-4 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack.
Affected Products: n/a
References: [{'name': '[oss-security] 20120705 Three CVE requests: at-spi2-atk, as31, naxsi', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/07/05/1'}, {'name': '[oss-security] 20120124 Re: CVE requests: Suhosin extension / as31', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/24/11'}, {'name': '[oss-security] 20120124 CVE requests: Suhosin extension / as31', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/24/7'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=655496'}, {'name': '[oss-security] 20120831 Re: Three CVE requests: at-spi2-atk, as31, naxsi', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/08/31/9'}, {'name': '[oss-security] 20120706 Re: Three CVE requests: at-spi2-atk, as31, naxsi', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/07/06/3'}]
CVE State: PUBLISHED
Explain CVE-2012-0809
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.
Affected Products: n/a
References: [{'name': 'GLSA-201203-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201203-06.xml'}, {'tags': ['x_refsource_MISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2012-01/att-0591/advisory_sudo.txt'}, {'name': '20120130 Advisory: sudo 1.8 Format String Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2012-01/0591.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sudo.ws/sudo/alerts/sudo_debug.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0810
The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stack corruption and panic) via a crafted application that triggers certain lock contention.
Affected Products: Linux kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=794557'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/rt/linux-stable-rt.git/commit/?id=e5d4e1c3ccee18c68f23d62ba77bda26e893d4f0'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/rt/linux-stable-rt.git/commit/?id=bcf6b1d78c0bde228929c388978ed3af9a623463'}]
CVE State: PUBLISHED
Explain CVE-2012-0811
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php.
Affected Products: n/a
References: [{'name': '51680', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51680'}, {'name': '[oss-security] 20120126 CVE request: PostfixAdmin SQL injections and XSS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/26/5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.codseq.it/advisories/multiple_vulnerabilities_in_postfixadmin'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://svn.code.sf.net/p/postfixadmin/code/branches/postfixadmin-2.3/CHANGELOG.TXT'}, {'name': '[oss-security] 20120127 Re: CVE request: PostfixAdmin SQL injections and XSS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/27/5'}]
CVE State: PUBLISHED
Explain CVE-2012-0812
PostfixAdmin 2.3.4 has multiple XSS vulnerabilities
Affected Products: postfixadmin
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-0812'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-0812'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.gentoo.org/show_bug.cgi?id=CVE-2012-0812'}, {'tags': ['x_refsource_MISC'], 'url': 'http://security.gentoo.org/glsa/glsa-201209-18.xml'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/26/12'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/27/5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/51680'}]
CVE State: PUBLISHED
Explain CVE-2012-0813
Wicd before 1.7.1 saves sensitive information in log files in /var/log/wicd, which allows context-dependent attackers to obtain passwords and other sensitive information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/wicd/+announcement/9570'}, {'name': '[oss-security] 20120126 Re: CVE request: wicd writes sensitive information in log files (password,  passphrase...)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/26/14'}, {'name': '51703', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51703'}, {'name': '49657', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49657'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bazaar.launchpad.net/~wicd-devel/wicd/experimental/revision/682'}, {'name': '[oss-security] 20120126 CVE request: wicd writes sensitive information in log files (password,  passphrase...)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/26/13'}, {'name': 'GLSA-201206-08', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201206-08.xml'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652417'}]
CVE State: PUBLISHED
Explain CVE-2012-0814
The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by the shared user account required by Gitolite.  NOTE: this can cross privilege boundaries because a user account may intentionally have no shell or filesystem access, and therefore may have no supported way to read an authorized_keys file in its own home directory.
Affected Products: n/a
References: [{'name': '51702', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51702'}, {'name': '[oss-security] 20120127 Re: CVE Request: Debian (others?) openssh-server: Forced Command handling leaks private information to ssh clients', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/27/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673'}, {'name': '[oss-security] 20120126 CVE Request: Debian (others?) openssh-server: Forced Command handling leaks private information to ssh clients', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/26/15'}, {'name': '78706', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78706'}, {'name': 'opensshserver-commands-info-disc(72756)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72756'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657445'}, {'name': '[oss-security] 20120126 Re: CVE Request: Debian (others?) openssh-server: Forced Command handling leaks private information to ssh clients', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/26/16'}, {'name': '[oss-security] 20120126 Re: CVE Request: Debian (others?) openssh-server: Forced Command handling leaks private information to ssh clients', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/27/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c.diff?r1=1.53%3Br2=1.54'}]
CVE State: PUBLISHED
Explain CVE-2012-0815
The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html'}, {'name': 'RHSA-2012:0531', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0531.html'}, {'name': 'MDVSA-2012:056', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:056'}, {'name': '1026882', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026882'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=744104'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://rpm.org/wiki/Releases/4.9.1.3'}, {'name': '48716', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48716'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://rpm.org/gitweb?p=rpm.git%3Ba=commitdiff%3Bh=472e569562d4c90d7a298080e0052856aa7fa86b'}, {'name': '48651', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48651'}, {'name': 'RHSA-2012:0451', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0451.html'}, {'name': 'FEDORA-2012-5421', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078907.html'}, {'name': '52865', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52865'}, {'name': 'rpm-headerverifyinfo-code-execution(74581)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74581'}, {'name': 'USN-1695-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1695-1'}, {'name': 'openSUSE-SU-2012:0588', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'https://hermes.opensuse.org/messages/14440932'}, {'name': '49110', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49110'}, {'name': 'FEDORA-2012-5420', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078819.html'}, {'name': 'FEDORA-2012-5298', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077960.html'}, {'name': 'openSUSE-SU-2012:0589', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'https://hermes.opensuse.org/messages/14441362'}, {'name': '81009', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/81009'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://rpm.org/gitweb?p=rpm.git%3Ba=commitdiff%3Bh=858a328cd0f7d4bcd8500c78faaf00e4f8033df6'}]
CVE State: PUBLISHED