Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2012-1186
Integer overflow in the SyncImageProfiles function in profile.c in ImageMagick 6.7.5-8 and earlier allows remote attackers to cause a denial of service (infinite loop) via crafted IOP tag offsets in the IFD in an image.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0248.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2012:0692', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2012-06/msg00001.html'}, {'name': '49043', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49043'}, {'name': 'DSA-2462', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2462'}, {'name': '51957', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51957'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1186'}, {'name': 'imagemagick-syncimageprofiles-dos(76139)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/76139'}, {'name': '[oss-security] 20120319 Subject: CVE-2012-1185 / CVE-2012-1186 assignment notification - incomplete  ImageMagick fixes for CVE-2012-0247 / CVE-2012-0248', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/19/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/profile.c'}, {'name': '47926', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47926'}, {'name': 'USN-1435-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1435-1'}, {'name': '48974', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48974'}, {'name': '49317', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49317'}, {'name': '80555', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/80555'}]
CVE State: PUBLISHED
Explain CVE-2012-1187
Bitlbee does not drop extra group privileges correctly in unix.c
Affected Products: Bitlbee
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-1187'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1187'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-1187'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.bitlbee.org/ticket/852'}]
CVE State: PUBLISHED
Explain CVE-2012-1188
Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or (2) querystring parameters to private/en/error or (3) name parameter to private/en/locale/index.
Affected Products: n/a
References: [{'name': 'forkcms-index-xss(73605)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73605'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/forkcms/forkcms/commit/1269fe8b3813c7b7d5552a2b88bc2e7bd4d0c1f9'}, {'name': '48183', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48183'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fork-cms.com/blog/detail/fork-cms-3-2-7-released'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.ch/advisory/HTB23075'}, {'name': '20120307 Multiple XSS in Fork CMS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0022.html'}, {'name': '79692', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79692'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/forkcms/forkcms/commit/995220182068518e89019a265d113518f6566407'}, {'name': '52236', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52236'}]
CVE State: PUBLISHED
Explain CVE-2012-1189
Stack-based buffer overflow in modules/graphic/ssgraph/grsound.cpp in The Open Racing Car Simulator (TORCS) before 1.3.3 and Speed Dreams allows user-assisted remote attackers to execute arbitrary code via a long file name in an engine sample attribute in an xml configuration file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://freecode.com/projects/torcs/releases/341672'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://torcs.sourceforge.net/index.php?name=News&file=article&sid=79'}, {'name': '18471', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18471'}, {'name': '[oss-security] 20120218 TORCS 1.3.2 xml buffer overflow - CVE-2012-1189', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/18/2'}, {'name': '79372', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79372'}, {'name': '[oss-security] 20120305 Re: TORCS 1.3.2 xml buffer overflow - CVE-2012-1189', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/05/18'}]
CVE State: PUBLISHED
Explain CVE-2012-1190
Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php'}, {'name': 'FEDORA-2012-5599', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html'}, {'name': 'FEDORA-2012-5631', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html'}, {'name': 'MDVSA-2012:050', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:050'}, {'name': 'FEDORA-2012-5624', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html'}, {'name': '52857', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52857'}, {'name': 'phpmyadmin-replication-xss(75304)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75304'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/phpmyadmin/phpmyadmin/commit/86073d532aed656550cb731aa5b4288b126ae7a6'}]
CVE State: PUBLISHED
Explain CVE-2012-1191
The resolver in dnscache in Daniel J. Bernstein djbdns 1.05 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.isc.org/files/imce/ghostdomain_camera.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1192
The resolver in Unbound before 1.4.11 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.isc.org/files/imce/ghostdomain_camera.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1193
The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.isc.org/files/imce/ghostdomain_camera.pdf'}, {'name': 'FEDORA-2013-6279', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104177.html'}, {'name': 'FEDORA-2013-5692', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102729.html'}, {'name': 'FEDORA-2013-6316', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104173.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1194
The resolver in the DNS Server service in Microsoft Windows Server 2008 before R2 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.isc.org/files/imce/ghostdomain_camera.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1195
Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a PutUpdateFileCore command in a RunAMTCommand SOAP request, then accessing the file via a direct request to the file in the web root.
Affected Products: n/a
References: [{'name': '79276', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79276'}, {'name': '1026693', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026693'}, {'name': '52023', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52023'}, {'name': 'thinkmanagement-serversetup-file-upload(73207)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73207'}, {'name': '47666', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47666'}]
CVE State: PUBLISHED
Explain CVE-2012-1196
Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. (dot dot) in the filename parameter in a SetTaskLogByFile SOAP request.
Affected Products: n/a
References: [{'name': '1026693', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026693'}, {'name': '52023', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52023'}, {'name': 'thinkmanagement-vulcore-dir-traversal(73208)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73208'}, {'name': '79277', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79277'}, {'name': '47666', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47666'}]
CVE State: PUBLISHED
Explain CVE-2012-1197
Integer overflow in the IDE_ACDStd.apl module for ACDSee 14.1 Build 137 allows remote attackers to execute arbitrary code via crafted "image dimension values" in a BMP file, which triggers a heap-based buffer overflow.
Affected Products: n/a
References: [{'name': '52047', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52047'}, {'name': '79305', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79305'}, {'name': 'acdsee-bmp-image-bo(73242)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73242'}, {'name': '47450', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47450'}]
CVE State: PUBLISHED
Explain CVE-2012-1198
base_ag_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allows remote attackers to execute arbitrary code by uploading contents of the file with an executable extension via a create action, then accessing it via a view action.
Affected Products: n/a
References: [{'name': 'base-baseagmain-security-bypass(73201)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73201'}, {'name': '51979', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51979'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109663/BASE-1.4.5-Remote-File-Inclusion-Shell-Creation.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1199
Multiple PHP remote file inclusion vulnerabilities in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) BASE_path parameter to base_ag_main.php, (2) base_db_setup.php, (3) base_graph_common.php, (4) base_graph_display.php, (5) base_graph_form.php, (6) base_graph_main.php, (7) base_local_rules.php, (8) base_logout.php, (9) base_main.php, (10) base_maintenance.php, (11) base_payload.php, (12) base_qry_alert.php, (13) base_qry_common.php, (14) base_qry_main.php, (15) base_stat_alerts.php, (16) base_stat_class.php, (17) base_stat_common.php, (18) base_stat_ipaddr.php, (19) base_stat_iplink.php, (20) base_stat_ports.php, (21) base_stat_sensor.php, (22) base_stat_time.php, (23) base_stat_uaddr.php, (24) base_user.php, (25) index.php, (26) admin/base_roleadmin.php, (27) admin/base_useradmin.php, (28) admin/index.php, (29) help/base_setup_help.php, (30) includes/base_action.inc.php, (31) includes/base_cache.inc.php, (32) includes/base_db.inc.php, (33) includes/base_db.inc.php, (34) includes/base_include.inc.php, (35) includes/base_output_html.inc.php, (36) includes/base_output_query.inc.php, (37) includes/base_state_criteria.inc.php, (38) includes/base_state_query.inc.php or (39) setup/base_conf_contents.php; (40) GLOBALS[user_session_path] parameter to includes/base_state_common.inc.php; (41) BASE_Language parameter to setup/base_conf_contents.php; or (42) ado_inc_php parameter to setup/setup2.php.
Affected Products: n/a
References: [{'name': '51979', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51979'}, {'name': 'base-multiple-file-include(73200)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73200'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109663/BASE-1.4.5-Remote-File-Inclusion-Shell-Creation.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1200
Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the (1) fileType parameter to optimizer/index.php, (2) id parameter to administrator/modules/moduleslist.php, (3) filename parameter to includes/function/gets.php, or (4) conf[blockfile] parameter to includes/function/usertpl.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109669/Nova-CMS-Remote-File-Inclusion.html'}, {'name': 'novacms-multiple-file-include(73159)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73159'}, {'name': '51976', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51976'}]
CVE State: PUBLISHED
Explain CVE-2012-1203
Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts via a save_user action.
Affected Products: n/a
References: [{'name': '18498', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18498/'}]
CVE State: PUBLISHED
Explain CVE-2012-1205
PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
Affected Products: n/a
References: [{'name': '47976', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47976'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/extend/plugins/relocate-upload/changelog/'}, {'name': '79250', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79250'}, {'name': '49693', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/49693'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://plugins.trac.wordpress.org/changeset/504380/relocate-upload'}]
CVE State: PUBLISHED
Explain CVE-2012-1206
Multiple integer overflows in Hancom Office 2010 SE 8.5.5 allow remote attackers to execute arbitrary code via large dimension values in a (1) JPG image to the ImportGR in the JPG image filter module (HncJpeg10.flt) or (2) PNG image to the PNG image filter module (HncPng10.flt), which triggers a heap-based buffer overflow.
Affected Products: n/a
References: [{'name': 'hancom-png-bo(73026)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73026'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hancom.co.kr/notice.noticeView.do?targetRow=1&notice_seqno=100'}, {'name': '47386', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47386'}, {'name': 'hancom-importgr-bo(73025)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73025'}, {'name': '78906', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78906'}, {'name': '51892', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51892'}, {'name': '78907', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78907'}]
CVE State: PUBLISHED
Explain CVE-2012-1207
Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter to frontend/js.php.
Affected Products: n/a
References: [{'name': '51972', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51972'}, {'name': 'forkcms-js-file-include(73169)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73169'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fork-cms.com/blog/detail/fork-cms-3-2-5-released'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/forkcms/forkcms/commit/a9986b86c53de0582248b39605660fbba0c21a29'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109709/Fork-CMS-3.2.4-Cross-Site-Scripting-Local-File-Inclusion.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1208
Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) report parameter to blog/settings or (2) error parameter to users/index.
Affected Products: n/a
References: [{'name': '47937', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47937'}, {'name': '51972', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51972'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/forkcms/forkcms/commit/d65c083adc91c88d21bd9a0df4c2688df634c6ff'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/forkcms/forkcms/commit/df75e0797a6540c4d656969a2e7df7689603b2cf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fork-cms.com/blog/detail/fork-cms-3-2-5-released'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109709/Fork-CMS-3.2.4-Cross-Site-Scripting-Local-File-Inclusion.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/forkcms/forkcms/commit/8fa74dd3e2e32723cd121177dce6aeac37e29df6'}]
CVE State: PUBLISHED
Explain CVE-2012-1209
Cross-site scripting (XSS) vulnerability in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.
Affected Products: n/a
References: [{'name': 'forkcms-base-xss(73393)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73393'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/forkcms/forkcms/commit/df75e0797a6540c4d656969a2e7df7689603b2cf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fork-cms.com/blog/detail/fork-cms-3-2-5-released'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/forkcms/forkcms/commit/c8ec9c58a6b3c46cdd924532c1de99bcda6072ed'}]
CVE State: PUBLISHED
Explain CVE-2012-1210
SQL injection vulnerability in pfile/file.php in Powie pFile 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109670/Pfile-1.02-Cross-Site-Scripting-SQL-Injection.html'}, {'name': '51982', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51982'}, {'name': 'pfile-file-sql-injection(73166)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73166'}]
CVE State: PUBLISHED
Explain CVE-2012-1211
Cross-site scripting (XSS) vulnerability in pfile/kommentar.php in Powie pFile 1.02 allows remote attackers to inject arbitrary web script or HTML via the filecat parameter.
Affected Products: n/a
References: [{'name': 'pfile-kommentar-xss(73165)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73165'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109670/Pfile-1.02-Cross-Site-Scripting-SQL-Injection.html'}, {'name': '51982', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51982'}]
CVE State: PUBLISHED
Explain CVE-2012-1212
Cross-site scripting (XSS) vulnerability in the smwfOnSfSetTargetName function in extensions/SMWHalo/includes/SMW_Initialize.php in Semantic Enterprise Wiki (SMW+) 1.5.6, 1.6.0_2 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter to index.php/Special:FormEdit.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '47968', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47968'}, {'name': 'smw-target-xss(73167)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73167'}, {'name': '51980', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51980'}, {'tags': ['x_refsource_MISC'], 'url': 'http://st2tea.blogspot.com/2012/02/smw-enterprise-wiki-156-cross-site.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109637/SMW-1.5.6-Cross-Site-Scripting.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1213
Cross-site scripting (XSS) vulnerability in zimbra/h/calendar in Zimbra Web Client in Zimbra Collaboration Suite (ZCS) 6.x before 6.0.15 and 7.x before 7.1.3 allows remote attackers to inject arbitrary web script or HTML via the view parameter.
Affected Products: n/a
References: [{'name': 'zimbra-view-xss(73168)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73168'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109710/Zimbra-Cross-Site-Scripting.html'}, {'name': '51974', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51974'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.zimbra.com/show_bug.cgi?id=63849'}, {'tags': ['x_refsource_MISC'], 'url': 'http://st2tea.blogspot.com/2012/02/zimbra-cross-site-scripting.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1214
Cross-site scripting (XSS) vulnerability in the Add friends module in Yoono Desktop Application before 1.8.21 allows remote attackers to inject arbitrary web script or HTML via the create field in a "Create a group" action.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.yoono.com/yoono/topics/xss-w35in'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109618/Yoono-Desktop-1.8.16-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109618/#comment-10343'}, {'name': 'yoono-addfriends-xss(73149)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73149'}]
CVE State: PUBLISHED
Explain CVE-2012-1215
Cross-site scripting (XSS) vulnerability in the Add friends module in the Yoono extension before 7.7.8 for Firefox allows remote attackers to inject arbitrary web script or HTML via the create field in a "Create a group" action.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109617/Yoono-Firefox-7.7.0-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.yoono.com/yoono/topics/xss-w35in'}, {'name': '51970', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51970'}, {'name': 'yoonofirefoxextension-addfriends-xss(73150)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73150'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109617/#comment-10344'}]
CVE State: PUBLISHED
Explain CVE-2012-1216
Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in PBBoard 2.1.4 allow remote attackers to hijack the authentication of administrators for requests that (1) upload a file via an add action or (2) change the contents of a file via a dit action.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109706/PBBoard-2.1.4-Cross-Site-Request-Forgery-Shell-Upload.html'}, {'name': '47948', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47948'}]
CVE State: PUBLISHED
Explain CVE-2012-1217
Multiple cross-site scripting (XSS) vulnerabilities in STHS v2 Web Portal 2.2 allow remote attackers to inject arbitrary web script or HTML via the team parameter to (1) prospects.php, (2) prospect.php, or (3) team.php.
Affected Products: n/a
References: [{'name': '51991', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51991'}, {'name': 'sths-prospects-team-sql-injection(73154)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73154'}, {'tags': ['x_refsource_MISC'], 'url': 'http://0nto.wordpress.com/2012/02/13/sths-v2-web-portal-2-2-sql-injection-vulnerabilty/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109665/STHS-v2-Web-Portal-2.2-SQL-Injection.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1218
Multiple SQL injection vulnerabilities in freelancerKit 2.35 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to the (1) notes and (2) tickets components.
Affected Products: n/a
References: [{'name': 'freelancerkit-multiple-sql-injection(73105)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73105'}, {'name': '51946', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51946'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.vulnerability-lab.com/get_content.php?id=402'}, {'name': '47766', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47766'}]
CVE State: PUBLISHED
Explain CVE-2012-1219
Multiple cross-site scripting (XSS) vulnerabilities in freelancerKit 2.35 allow remote attackers to inject arbitrary web script or HTML via the (1) ticket parameter to tickets.php, (2) title parameter to notes.php, or (3) task parameter to todo.php.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': 'freelancerkit-multiple-xss(73104)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73104'}, {'name': '51946', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51946'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.vulnerability-lab.com/get_content.php?id=402'}, {'name': '47766', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47766'}]
CVE State: PUBLISHED
Explain CVE-2012-1220
Cross-site request forgery (CSRF) vulnerability in modules/config/admin_utente.php in GAzie 5.20 and earlier allows remote attackers to hijack the authentication of administrators for requests that change account information via an update action, as demonstrated by changing the password.
Affected Products: n/a
References: [{'name': 'gazie-adminutente-csrf(72991)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72991'}, {'name': '47947', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47947'}, {'name': '18464', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18464'}]
CVE State: PUBLISHED
Explain CVE-2012-1221
Directory traversal vulnerability in the telnet server in RabidHamster R2/Extreme 1.65 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the File command.
Affected Products: n/a
References: [{'name': '47966', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47966'}, {'name': 'r2-file-dir-traversal(73114)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73114'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.org/adv/r2_1-adv.txt'}, {'name': '52061', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52061'}, {'name': '79094', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79094'}]
CVE State: PUBLISHED
Explain CVE-2012-1222
Stack-based buffer overflow in RabidHamster R2/Extreme 1.65 and earlier allows remote authenticated users to execute arbitrary code via a long string to TCP port 23.
Affected Products: n/a
References: [{'name': '79093', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79093'}, {'name': '47966', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47966'}, {'name': 'r2-file-bo(73113)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73113'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.org/adv/r2_1-adv.txt'}, {'name': '52061', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52061'}]
CVE State: PUBLISHED
Explain CVE-2012-1223
RabidHamster R2/Extreme 1.65 and earlier uses a small search space of values for the PIN number, which allows remote attackers to obtain the PIN number via a brute force attack.
Affected Products: n/a
References: [{'name': '47966', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47966'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.org/adv/r2_1-adv.txt'}, {'name': 'r2-telnet-unauth-access(73115)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73115'}, {'name': '79095', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79095'}]
CVE State: PUBLISHED
Explain CVE-2012-1224
Cross-site scripting (XSS) vulnerability in system/classes/login.php in ContentLion Alpha 1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.darksecurity.de/advisories/2012/SSCHADV2012-004.txt'}, {'name': '78833', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78833'}]
CVE State: PUBLISHED
Explain CVE-2012-1225
Multiple SQL injection vulnerabilities in Dolibarr CMS 3.2.0 Alpha and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) memberslist parameter (aka Member List) in list.php or (2) rowid parameter to adherents/fiche.php.
Affected Products: n/a
References: [{'name': '47969', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47969'}, {'name': '20120210 Dolibarr CMS v3.2.0 Alpha - SQL Injection Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0056.html'}, {'name': '51956', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51956'}, {'name': '79011', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79011'}]
CVE State: PUBLISHED
Explain CVE-2012-1226
Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the (1) file parameter to document.php or (2) backtopage parameter in a create action to comm/action/fiche.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/Dolibarr/dolibarr/commit/5381986e50dd6055f2b3b63281eaacffa0449da2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/Dolibarr/dolibarr/commit/8f9b9987ffb42cfbe907fe31ded3001bfc1b3417'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.vulnerability-lab.com/get_content.php?id=428'}, {'name': '20120210 Dolibarr CMS v3.2.0 Alpha - File Include Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/521583'}, {'name': '20120227 Re: Dolibarr CMS v3.2.0 Alpha - File Include Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0168.html'}, {'name': '18480', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18480'}, {'name': 'dolibarr-multiple-file-include(73136)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73136'}]
CVE State: PUBLISHED
Explain CVE-2012-1227
Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in pluck 4.7 allow remote attackers to hijack the authentication of admins for requests that (1) modify the admin email address or (2) modify the blog title via a settings action; (3) add a page via an editpage action, or (4) add a categorie via the blog module.
Affected Products: n/a
References: [{'name': '18474', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18474'}, {'name': '47934', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47934'}, {'name': '79005', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79005'}]
CVE State: PUBLISHED
Explain CVE-2012-1234
SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0234.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1235
Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0235.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-1236
Multiple cross-site request forgery (CSRF) vulnerabilities in Janetter before 3.3.0.0 (aka 3.3.0) allow remote attackers to hijack the authentication of arbitrary users for requests that (1) tweet, (2) upload an image file, or (3) execute arbitrary commands.
Affected Products: n/a
References: [{'name': 'JVNDB-2012-000027', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000027'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://janetter.net/history.html'}, {'name': '48480', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48480'}, {'name': 'JVN#83459967', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN83459967/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blog.janetter.net/'}]
CVE State: PUBLISHED
Explain CVE-2012-1237
Cross-site request forgery (CSRF) vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack the authentication of arbitrary users.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://oss.icz.co.jp/news/?p=501'}, {'name': '52900', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52900'}, {'name': 'JVNDB-2012-000029', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000029'}, {'name': 'JVN#44913777', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN44913777/index.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1238
Session fixation vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack web sessions via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://oss.icz.co.jp/news/?p=501'}, {'name': '52900', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52900'}, {'name': 'JVN#97200417', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN97200417/index.html'}, {'name': 'JVNDB-2012-000030', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000030'}, {'name': '81020', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81020'}]
CVE State: PUBLISHED
Explain CVE-2012-1239
The TopAccess web-based management interface on TOSHIBA TEC e-Studio multi-function peripheral (MFP) devices with firmware 30x through 302, 35x through 354, and 4xx through 421 allows remote attackers to bypass authentication and obtain administrative privileges via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#92830293', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN92830293/index.html'}, {'name': 'JVNDB-2012-000028', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000028'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.toshibatec.co.jp/information/2012/20120405/'}]
CVE State: PUBLISHED
Explain CVE-2012-1240
Cross-site scripting (XSS) vulnerability in the RECRUIT Dokodemo Rikunabi 2013 extension before 1.0.1 for Google Chrome allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '48813', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48813'}, {'name': 'JVN#90055996', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN90055996/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://chrome.google.com/webstore/detail/cfmkbngdlheahmooldblflapbpngmmbg'}, {'name': '53008', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53008'}, {'name': 'dokodemorikunabi2012-unspecified-xss(74893)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74893'}, {'name': 'JVNDB-2012-000032', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000032'}]
CVE State: PUBLISHED
Explain CVE-2012-1241
GRScript18.dll before 1.2.2.0 in ActiveScriptRuby (ASR) before 1.8.7 does not properly restrict interaction with an Internet Explorer ActiveX environment, which allows remote attackers to execute arbitrary Ruby code via a crafted HTML document.
Affected Products: n/a
References: [{'name': 'JVNDB-2012-000031', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000031'}, {'name': '[ruby-list] 20100619 ANN: ActiveScriptRuby 1.8.7', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-list/47170'}, {'name': '53011', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53011'}, {'name': '48811', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48811'}, {'name': 'activescriptruby-grscript18-code-exec(74866)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74866'}, {'name': 'JVN#33283707', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN33283707/index.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1242
Untrusted search path vulnerability in JustSystems Ichitaro 2011 Sou, Ichitaro 2006 through 2011, Ichitaro Government 2006 through 2010, Ichitaro Portable with oreplug, Ichitaro Viewer, JUST School, JUST School 2009 and 2010, JUST Jump 4, JUST Frontier, and oreplug allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Affected Products: n/a
References: [{'name': '81472', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81472'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.justsystems.com/jp/info/js12001.html'}, {'name': 'JVNDB-2012-000034', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000034'}, {'name': 'JVN#95378720', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN95378720/index.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1243
The TwitRocker2 application before 1.0.23 for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.
Affected Products: n/a
References: [{'name': 'JVN#00000601', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN00000601/index.html'}, {'name': '53173', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53173'}, {'name': 'JVNDB-2012-000033', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000033'}, {'name': '48894', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48894'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=com.studiohitori.twitrocker2'}, {'name': 'twitrocker2-webview-sec-bypass(75036)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75036'}, {'name': '81447', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81447'}]
CVE State: PUBLISHED
Explain CVE-2012-1244
The NTT DOCOMO sp mode mail application 5400 and earlier for Android does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: n/a
References: [{'name': 'spmode-android-ssl-spoofing(75159)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75159'}, {'name': '53254', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53254'}, {'name': 'JVN#82029095', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN82029095/index.html'}, {'name': '48955', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48955'}, {'name': '81629', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/81629'}, {'name': 'JVNDB-2012-000037', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000037'}]
CVE State: PUBLISHED
Explain CVE-2012-1245
Cross-site scripting (XSS) vulnerability in the cleanup_urls function in forum/utils/html.py in OSQA before 1234, and 0.9.0 Beta 3 and earlier, allows remote attackers to inject arbitrary web script or HTML via vectors related to a crafted URI.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.osqa.net/changelog/OSQA/osqa/trunk?cs=1234'}, {'name': 'osqa-unspecified-xss(75182)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75182'}, {'name': 'JVN#15503729', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN15503729/index.html'}, {'name': '53259', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53259'}, {'name': 'JVNDB-2012-000036', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000036'}]
CVE State: PUBLISHED
Explain CVE-2012-1246
Cross-site scripting (XSS) vulnerability in KENT-WEB WEB MART 1.7 and earlier might allow remote attackers to inject arbitrary web script or HTML via a crafted cookie.
Affected Products: n/a
References: [{'name': '53539', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53539'}, {'name': 'JVNDB-2012-000041', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000041'}, {'name': 'JVN#47536971', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN47536971/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kent-web.com/cart/mart.html'}, {'name': 'webmart-craftedcookies-xss(75673)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75673'}]
CVE State: PUBLISHED
Explain CVE-2012-1247
Cross-site scripting (XSS) vulnerability in KENT-WEB WEB MART 1.7 and earlier, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML by leveraging support for Cascading Style Sheets (CSS) expressions.
Affected Products: n/a
References: [{'name': 'JVNDB-2012-000042', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000042'}, {'name': '53541', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53541'}, {'name': 'webmart-internetexplorer-cssexpr-xss(75674)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75674'}, {'name': 'JVN#63941302', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN63941302/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kent-web.com/cart/mart.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1248
app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain.
Affected Products: n/a
References: [{'name': 'JVNDB-2012-000043', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000043'}, {'name': 'JVN#53465692', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN53465692/index.html'}, {'name': 'basercms-core-sec-bypass(75660)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75660'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://basercms.net/security/1'}, {'name': '53543', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53543'}]
CVE State: PUBLISHED