Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2011-0701
wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.
Affected Products: n/a
References: [{'name': 'FEDORA-2011-3746', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-March/057003.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://codex.wordpress.org/Version_3.0.5'}, {'name': 'ADV-2011-0658', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0658'}, {'name': '43729', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43729'}, {'name': 'FEDORA-2011-3408', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056412.html'}, {'name': '46249', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46249'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wordpress.org/news/2011/02/wordpress-3-0-5/'}, {'name': '[oss-security] 20110209 Re: CVE request: wordpress before 3.0.5', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/02/09/13'}, {'name': 'FEDORA-2011-3738', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056998.html'}, {'name': '[oss-security] 20110209 CVE request: wordpress before 3.0.5', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/02/08/7'}, {'name': 'ADV-2011-0721', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0721'}, {'name': 'DSA-2190', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2190'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://core.trac.wordpress.org/changeset/17393'}]
CVE State: PUBLISHED
Explain CVE-2011-0702
The feh_unique_filename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh_ temporary file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=612035'}, {'name': '[oss-security] 20110209 CVE request for feh', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/02/09/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/derf/feh/issues/#issue/32'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://derf.homelinux.org/git/feh/commit/?id=29ab0855f044ef2fe9c295b72abefcb37f0861a5'}, {'name': '43221', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43221'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/feh/+bug/607328'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=676389'}, {'name': '[oss-security] 20110209 Re: CVE request for feh', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/02/09/14'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://derf.homelinux.org/git/feh/commit/?id=23421a86cc826dd30f3dc4f62057fafb04b3ac40'}]
CVE State: PUBLISHED
Explain CVE-2011-0703
In gksu-polkit before 0.0.3, the source file for xauth may contain arbitrary commands that may allow an attacker to overtake an administrator X11 session.
Affected Products: gksu-polkit
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2011-0703'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2011-0703'}]
CVE State: PUBLISHED
Explain CVE-2011-0704
389 Directory Server 1.2.7.5, when built with mozldap, allows remote attackers to cause a denial of service (replica crash) by sending an empty modify request.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=675320'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=676876'}]
CVE State: PUBLISHED
Explain CVE-2011-0706
The JNLPClassLoader class in IcedTea-Web before 1.0.1, as used in OpenJDK Runtime Environment 1.6.0, allows remote attackers to gain privileges via unknown vectors related to multiple signers and the assignment of "an inappropriate security descriptor."
Affected Products: n/a
References: [{'name': 'FEDORA-2011-1631', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.html'}, {'name': 'GLSA-201406-32', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201406-32.xml'}, {'name': 'FEDORA-2011-1645', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.html'}, {'name': '46439', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46439'}, {'name': 'icedtea-jnlpclassloader-priv-esc(65534)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65534'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://dbhole.wordpress.com/2011/02/15/icedtea-web-1-0-1-released/'}, {'name': '43350', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43350'}, {'name': 'DSA-2224', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2224'}, {'name': 'oval:org.mitre.oval:def:14117', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14117'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=677332'}, {'name': 'MDVSA-2011:054', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:054'}]
CVE State: PUBLISHED
Explain CVE-2011-0709
The br_mdb_ip_get function in net/bridge/br_multicast.c in the Linux kernel before 2.6.35-rc5 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an IGMP packet, related to lack of a multicast table.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.35/ChangeLog-2.6.35-rc5'}, {'name': '[oss-security] 20110216 Re: CVE request - kernel: bridge br_multicast NULL pointer dereference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/02/16/14'}, {'name': '41432', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/41432'}, {'name': '[netdev] 20100706 Re: bridge br_multicast: BUG: unable to handle kernel NULL pointer dereference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.spinics.net/lists/netdev/msg134444.html'}, {'name': '[oss-security] 20110216 CVE request - kernel: bridge br_multicast NULL pointer dereference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/02/16/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7f285fa78d4b81b8458f05e77fb6b46245121b4e'}, {'name': '[oss-security] 20110216 Re: CVE request - kernel: bridge br_multicast NULL pointer dereference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/02/16/8'}, {'name': '[netdev] 20100705 bridge br_multicast: BUG: unable to handle kernel NULL pointer dereference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.spinics.net/lists/netdev/msg134414.html'}]
CVE State: PUBLISHED
Explain CVE-2011-0710
The task_show_regs function in arch/s390/kernel/traps.c in the Linux kernel before 2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of an arbitrary process by reading a status file under /proc/.
Affected Products: n/a
References: [{'name': '20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/520102/100/0/threaded'}, {'name': '46397', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/46397'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v2.6/next/patch-v2.6.38-rc4-next-20110216.bz2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=677850'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0012.html'}, {'name': '[oss-security] 20110216 CVE request - kernel: s390 task_show_regs infoleak', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/02/16/3'}, {'name': '[oss-security] 20110216 Re: CVE request - kernel: s390 task_show_regs infoleak', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/02/16/9'}, {'name': '46421', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46421'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=261cd298a8c363d7985e3482946edb4bfedacf98'}, {'name': 'kernel-taskshowregs-info-disclosure(65464)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65464'}]
CVE State: PUBLISHED
Explain CVE-2011-0711
The xfs_fs_geometry function in fs/xfs/xfs_fsops.c in the Linux kernel before 2.6.38-rc6-git3 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FSGEOMETRY_V1 ioctl call.
Affected Products: n/a
References: [{'name': '46417', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46417'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://patchwork.kernel.org/patch/555461/'}, {'name': 'RHSA-2011:0927', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2011-0927.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=677260'}, {'name': '[oss-security] 20110216 Re: CVE request - kernel: xfs infoleak', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/02/16/10'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3a3675b7f23f83ca8c67c9c2b6edf707fd28d1ba'}, {'name': '[oss-security] 20110216 CVE request - kernel: xfs infoleak', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/02/16/4'}, {'name': '70950', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70950'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.38-rc6-git3.log'}]
CVE State: PUBLISHED
Explain CVE-2011-0712
Multiple buffer overflows in the caiaq Native Instruments USB audio functionality in the Linux kernel before 2.6.38-rc4-next-20110215 might allow attackers to cause a denial of service or possibly have unspecified other impact via a long USB device name, related to (1) the snd_usb_caiaq_audio_init function in sound/usb/caiaq/audio.c and (2) the snd_usb_caiaq_midi_init function in sound/usb/caiaq/midi.c.
Affected Products: n/a
References: [{'name': 'USN-1146-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1146-1'}, {'name': '[oss-security] 20110216 Re: kernel: ALSA: caiaq - Fix possible string-buffer overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/02/16/11'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=677881'}, {'name': 'kernel-usbdevice-bo(65461)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65461'}, {'name': '46419', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46419'}, {'name': '[oss-security] 20110216 kernel: ALSA: caiaq - Fix possible string-buffer overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/02/16/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/tiwai/sound-2.6.git%3Ba=commit%3Bh=eaae55dac6b64c0616046436b294e69fc5311581'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v2.6/next/patch-v2.6.38-rc4-next-20110215.bz2'}, {'name': '[oss-security] 20110216 Re: kernel: ALSA: caiaq - Fix possible string-buffer overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/02/16/12'}]
CVE State: PUBLISHED
Explain CVE-2011-0714
Use-after-free vulnerability in a certain Red Hat patch for the RPC server sockets functionality in the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 might allow remote attackers to cause a denial of service (crash) via malformed data in a packet, related to lockd and the svc_xprt_received function.
Affected Products: n/a
References: [{'name': '[oss-security] 20110308 CVE-2011-0714 kernel: deficiency in handling of invalid data packets in lockd', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/03/08/17'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=678144'}, {'name': '[oss-security] 20110309 Re: CVE-2011-0714 kernel: deficiency in handling of invalid data packets in lockd', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/03/09/1'}, {'name': 'RHSA-2011:0329', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2011-0329.html'}]
CVE State: PUBLISHED
Explain CVE-2011-0716
The br_multicast_add_group function in net/bridge/br_multicast.c in the Linux kernel before 2.6.38, when a certain Ethernet bridge configuration is used, allows local users to cause a denial of service (memory corruption and system crash) by sending IGMP packets to a local interface.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6b0d6a9b4296fa16a28d10d416db7a770fc03287'}, {'name': '[oss-security] 20110217 Re: CVE request -- kernel: deficiency in processing igmp host membership reports in br_multicast', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/02/17/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=678169'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.38'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/6b0d6a9b4296fa16a28d10d416db7a770fc03287'}]
CVE State: PUBLISHED
Explain CVE-2011-0717
Session fixation vulnerability in Red Hat Network (RHN) Satellite Server 5.4 allows remote attackers to hijack web sessions via unspecified vectors related to Spacewalk.
Affected Products: n/a
References: [{'name': '46528', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46528'}, {'name': 'ADV-2011-0491', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0491'}, {'name': 'RHSA-2011:0300', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0300.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=672159'}, {'name': '1025116', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1025116'}, {'name': 'rhnss-session-hijacking(65658)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65658'}, {'name': '43487', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43487'}]
CVE State: PUBLISHED
Explain CVE-2011-0718
Red Hat Network (RHN) Satellite Server 5.4 does not use a time delay after a failed login attempt, which makes it easier for remote attackers to conduct brute force password guessing attacks.
Affected Products: n/a
References: [{'name': '46528', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46528'}, {'name': 'ADV-2011-0491', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0491'}, {'name': 'RHSA-2011:0300', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0300.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=672159'}, {'name': '1025116', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1025116'}, {'name': 'rhnss-weak-security(65657)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65657'}, {'name': '43487', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43487'}]
CVE State: PUBLISHED
Explain CVE-2011-0720
Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.
Affected Products: n/a
References: [{'name': '70753', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70753'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://plone.org/products/plone/security/advisories/cve-2011-0720'}, {'name': '46102', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46102'}, {'name': '43146', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43146'}, {'name': 'RHSA-2011:0393', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0393.html'}, {'name': 'plone-unspec-priv-escalation(65099)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65099'}, {'name': 'ADV-2011-0796', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0796'}, {'name': '43914', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43914'}, {'name': '1025258', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1025258'}, {'name': 'RHSA-2011:0394', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0394.html'}]
CVE State: PUBLISHED
Explain CVE-2011-0721
Multiple CRLF injection vulnerabilities in (1) chfn and (2) chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field.
Affected Products: n/a
References: [{'name': 'ADV-2011-0398', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0398'}, {'name': 'ADV-2011-0773', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0773'}, {'name': '43345', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43345'}, {'name': 'DSA-2164', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2164'}, {'name': 'USN-1065-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1065-1'}, {'name': 'ADV-2011-0396', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0396'}, {'name': 'shadow-chfnchsh-crlf-injection(65564)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65564'}, {'name': '70895', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70895'}, {'name': '46426', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46426'}, {'name': 'SSA:2011-086-03', 'tags': ['vendor-advisory', 'x_refsource_SLACKWARE'], 'url': 'http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.380014'}, {'name': '42505', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42505'}]
CVE State: PUBLISHED
Explain CVE-2011-0722
FFmpeg before 0.5.4, as used in MPlayer and other products, allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a malformed RealMedia file.
Affected Products: n/a
References: [{'name': 'DSA-2306', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2306'}, {'name': 'MDVSA-2011:061', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:061'}, {'name': 'MDVSA-2011:062', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:062'}, {'name': 'MDVSA-2011:114', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:114'}, {'name': 'USN-1104-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-1104-1/'}, {'name': 'MDVSA-2011:089', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:089'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.mplayerhq.hu/'}, {'name': 'ADV-2011-1241', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/1241'}, {'name': '47149', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47149'}]
CVE State: PUBLISHED
Explain CVE-2011-0723
FFmpeg 0.5.x, as used in MPlayer and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed VC-1 file.
Affected Products: n/a
References: [{'name': 'DSA-2306', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2306'}, {'name': 'MDVSA-2011:061', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:061'}, {'name': 'MDVSA-2011:062', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:062'}, {'name': 'MDVSA-2011:112', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:112'}, {'name': 'MDVSA-2011:114', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:114'}, {'name': 'USN-1104-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-1104-1/'}, {'name': 'MDVSA-2011:089', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:089'}, {'name': '47151', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47151'}, {'name': 'ADV-2011-1241', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/1241'}, {'tags': ['x_refsource_MISC'], 'url': 'http://ffmpeg.mplayerhq.hu/'}]
CVE State: PUBLISHED
Explain CVE-2011-0724
The Live DVD for Edubuntu 9.10, 10.04 LTS, and 10.10 does not correctly regenerate iTALC private keys after installation, which causes each installation to have the same fixed key, which allows remote attackers to gain privileges.
Affected Products: n/a
References: [{'name': 'USN-1061-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1061-1'}, {'name': 'italc-keys-security-bypass(65389)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65389'}, {'name': '46346', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46346'}, {'name': 'ADV-2011-0378', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0378'}]
CVE State: PUBLISHED
Explain CVE-2011-0725
Absolute path traversal vulnerability in the org.debian.apt.UpdateCachePartially method in worker.py in Aptdaemon 0.40 in Ubuntu 10.10 and 11.04 allows local users to read arbitrary files via a full pathname in the sources_list argument, related to the D-Bus interface.
Affected Products: n/a
References: [{'name': '46490', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46490'}, {'name': 'ADV-2011-0459', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0459'}, {'name': 'aptdaemon-updatecache-info-disc(65652)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65652'}, {'name': 'USN-1068-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1068-1'}, {'name': '1025107', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1025107'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/bugs/722228'}]
CVE State: PUBLISHED
Explain CVE-2011-0726
The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE binary.
Affected Products: n/a
References: [{'name': '[mm-commits] 20110314 + proc-protect-mm-start_code-end_code-in-proc-pid-stat.patch added to -mm tree', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.spinics.net/lists/mm-commits/msg82726.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=684569'}, {'name': '47791', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47791'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5883f57ca0008ffc93e09cbb9847a1928e50c6f3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.39/ChangeLog-2.6.39-rc1'}, {'name': 'RHSA-2011:0833', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2011-0833.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://downloads.avaya.com/css/P8/documents/100145416'}, {'name': '[linux-kernel] 20110311 [PATCH] proc: protect mm start_code/end_code in /proc/pid/stat', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lkml.org/lkml/2011/3/11/380'}]
CVE State: PUBLISHED
Explain CVE-2011-0727
GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership of arbitrary files via a symlink attack on a (1) dmrc or (2) face icon file under /var/cache/gdm/.
Affected Products: n/a
References: [{'name': 'USN-1099-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1099-1'}, {'name': '43714', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43714'}, {'name': '1025264', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1025264'}, {'name': 'FEDORA-2011-4351', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057931.html'}, {'name': '43854', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43854'}, {'name': 'ADV-2011-0847', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0847'}, {'name': 'ADV-2011-0787', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0787'}, {'name': 'display-manager-priv-escalation(66377)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66377'}, {'name': 'ADV-2011-0911', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0911'}, {'name': 'MDVSA-2011:070', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:070'}, {'name': 'DSA-2205', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2205'}, {'name': 'RHSA-2011:0395', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0395.html'}, {'name': '47063', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47063'}, {'name': 'ADV-2011-0786', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0786'}, {'name': '[gdm-list] 20110328 GDM 2.32.1 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail.gnome.org/archives/gdm-list/2011-March/msg00020.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=688323'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ftp.gnome.org/pub/GNOME/sources/gdm/2.32/gdm-2.32.1.news'}, {'name': '44021', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44021'}, {'name': 'FEDORA-2011-4335', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057333.html'}, {'name': 'ADV-2011-0797', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0797'}]
CVE State: PUBLISHED
Explain CVE-2011-0728
Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/loggerhead/1.18/1.18.1'}, {'name': 'FEDORA-2011-4107', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057502.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/loggerhead/+bug/740142'}, {'name': 'ADV-2011-0849', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0849'}, {'name': '47032', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47032'}, {'name': 'FEDORA-2011-4050', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057413.html'}, {'name': '43822', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43822'}, {'name': 'ADV-2011-0848', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0848'}, {'name': '71279', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/71279'}, {'name': 'FEDORA-2011-4085', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057479.html'}, {'name': '44017', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44017'}, {'name': 'loggerhead-filename-xss(66305)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66305'}]
CVE State: PUBLISHED
Explain CVE-2011-0729
dbus_backend/ls-dbus-backend in the D-Bus backend in language-selector before 0.6.7 does not restrict access on the basis of a PolicyKit check result, which allows local users to modify the /etc/default/locale and /etc/environment files via a (1) SetSystemDefaultLangEnv or (2) SetSystemDefaultLanguageEnv call.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/bugs/764397'}, {'name': '44214', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44214'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ubuntuupdates.org/packages/show/307975'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/language-selector/0.6.7'}, {'name': 'ADV-2011-1032', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/1032'}, {'name': '47502', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47502'}, {'name': 'USN-1115-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1115-1/'}]
CVE State: PUBLISHED
Explain CVE-2011-0730
Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud (UEC) and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request, related to an "XML Signature Element Wrapping" or a "SOAP signature replay" issue.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://open.eucalyptus.com/wiki/esa-02'}, {'name': '44705', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44705'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://launchpadlibrarian.net/72472626/eucalyptus_2.0.1%2Bbzr1256-0ubuntu5_2.0.1%2Bbzr1256-0ubuntu6.diff.gz'}, {'name': 'eucalyptus-soap-command-execution(67670)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/67670'}, {'name': 'USN-1137-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1137-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/bugs/746101'}, {'name': '48000', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/48000'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/eucalyptus/+changelog'}]
CVE State: PUBLISHED
Explain CVE-2011-0731
Buffer overflow in the DB2 Administration Server (DAS) component in IBM DB2 9.1 before FP10, 9.5 before FP7, and 9.7 before FP3 on Linux, UNIX, and Windows allows remote attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'name': 'IC71203', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IC71203'}, {'name': '46052', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46052'}, {'name': '70683', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/70683'}, {'name': 'oval:org.mitre.oval:def:14699', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14699'}, {'name': 'IC72028', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IC72028'}, {'name': '43059', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43059'}, {'name': 'IC72029', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IC72029'}]
CVE State: PUBLISHED
Explain CVE-2011-0732
Multiple unspecified vulnerabilities in IBM Tivoli Integrated Portal (TIP) 1.1.1.1, as used in IBM Tivoli Common Reporting (TCR) 1.2.0 before Interim Fix 9, have unknown impact and attack vectors, related to "security vulnerabilities of Websphere Application Server bundled within" and "many internal defects and APARs."
Affected Products: n/a
References: [{'name': '43030', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43030'}, {'name': 'IY99978', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1IY99978'}]
CVE State: PUBLISHED
Explain CVE-2011-0733
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header in an id=- query to a .cfm file.
Affected Products: n/a
References: [{'name': '70777', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70777'}, {'tags': ['x_refsource_MISC'], 'url': 'http://websecurity.com.ua/4879/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb2.adobe.com/cps/890/cpsid_89094.html'}, {'name': '1025012', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1025012'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb11-04.html'}, {'name': '20110128 Vulnerabilities in Adobe ColdFusion', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html'}]
CVE State: PUBLISHED
Explain CVE-2011-0734
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element, related to a "tag body" attack.  NOTE: this was originally reported as affecting 9.0.1 CHF1 and earlier.
Affected Products: n/a
References: [{'name': '70778', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70778'}, {'tags': ['x_refsource_MISC'], 'url': 'http://websecurity.com.ua/4879/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb2.adobe.com/cps/890/cpsid_89094.html'}, {'name': '1025012', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1025012'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb11-04.html'}, {'name': '20110128 Vulnerabilities in Adobe ColdFusion', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html'}]
CVE State: PUBLISHED
Explain CVE-2011-0735
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script."
Affected Products: n/a
References: [{'name': '70779', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70779'}, {'tags': ['x_refsource_MISC'], 'url': 'http://websecurity.com.ua/4879/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb2.adobe.com/cps/890/cpsid_89094.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb11-04.html'}, {'name': '20110128 Vulnerabilities in Adobe ColdFusion', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html'}]
CVE State: PUBLISHED
Explain CVE-2011-0736
Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file.  NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure
Affected Products: n/a
References: [{'name': '70780', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70780'}, {'tags': ['x_refsource_MISC'], 'url': 'http://websecurity.com.ua/4879/'}, {'name': '20110128 Vulnerabilities in Adobe ColdFusion', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html'}]
CVE State: PUBLISHED
Explain CVE-2011-0737
Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message.  NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure
Affected Products: n/a
References: [{'name': '70781', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70781'}, {'tags': ['x_refsource_MISC'], 'url': 'http://websecurity.com.ua/4879/'}, {'name': '20110128 Vulnerabilities in Adobe ColdFusion', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2011-01/0537.html'}]
CVE State: PUBLISHED
Explain CVE-2011-0738
MyProxy 5.0 through 5.2, as used in Globus Toolkit 5.0.0 through 5.0.2, does not properly verify the (1) hostname or (2) identity in the X.509 certificate for the myproxy-server, which allows remote attackers to spoof the server and conduct man-in-the-middle (MITM) attacks via a crafted certificate when executing (a) myproxy-logon or (b) myproxy-get-delegation.
Affected Products: n/a
References: [{'name': 'FEDORA-2011-0514', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053461.html'}, {'name': 'ADV-2011-0227', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0227'}, {'name': '[security-announce] 20110118 Globus Security Advisory 2011-01: myproxy-logon identity checking of server', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.globus.org/pipermail/security-announce/2011-January/000018.html'}, {'name': '43103', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43103'}, {'name': 'myproxy-ssl-spoofing(64830)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/64830'}, {'name': 'FEDORA-2011-0512', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053473.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://grid.ncsa.illinois.edu/myproxy/security/myproxy-adv-2011-01.txt'}, {'name': '45916', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/45916'}, {'name': '70494', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70494'}, {'name': '42972', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42972'}]
CVE State: PUBLISHED
Explain CVE-2011-0739
The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address.
Affected Products: n/a
References: [{'name': 'ADV-2011-0233', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0233'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1'}, {'name': 'ruby-mail-deliver-command-execution(65010)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65010'}, {'name': '46021', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46021'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/mikel/mail/raw/master/patches/20110126_sendmail.patch'}, {'name': '43077', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43077'}, {'name': '70667', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70667'}]
CVE State: PUBLISHED
Explain CVE-2011-0740
Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in RSS Feed Reader 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.
Affected Products: n/a
References: [{'name': 'rssfeedreader-slashbox-xss(64949)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/64949'}, {'name': '45997', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/45997'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.autosectools.com/Advisories/WordPress.RSS.Feed.Reader.for.WordPress.0.1_Reflected.Cross-site.Scripting_82.html'}, {'name': '70644', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70644'}, {'name': '43071', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43071'}]
CVE State: PUBLISHED
Explain CVE-2011-0741
Multiple cross-site scripting (XSS) vulnerabilities in ModX Evolution before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) installer or (2) image editor.
Affected Products: n/a
References: [{'name': 'evolution-multiple-xss(65164)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65164'}, {'name': '46154', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46154'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://modxcms.com/forums/index.php/topic%2C60045.0.html'}]
CVE State: PUBLISHED
Explain CVE-2011-0742
Buffer overflow in ZfHIPCND.exe in Novell ZENworks Handheld Management 7.0 allows remote attackers to execute arbitrary code via a crafted IP Conduit packet to TCP port 2400.
Affected Products: n/a
References: [{'name': 'zhm-zfhipcnd-bo(64930)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/64930'}, {'name': '20110128 TELUS Security Labs VR - Novell ZENworks Handheld Management ZfHIPCND.exe Buffer Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/516045/100/0/threaded'}, {'name': 'ADV-2011-0221', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0221'}, {'name': '70694', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70694'}, {'name': '43094', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43094'}, {'name': '46024', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46024'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/viewContent.do?externalId=7007663'}, {'name': '1024993', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1024993'}, {'tags': ['x_refsource_MISC'], 'url': 'http://telussecuritylabs.com/threats/show/FSC20110125-06'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-11-026/'}]
CVE State: PUBLISHED