Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2011-0408
pngrtran.c in libpng 1.5.x before 1.5.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted palette-based PNG image that triggers a buffer overflow, related to the png_do_expand_palette function, the png_do_rgb_to_gray function, and an integer underflow.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '42863', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42863'}, {'name': '70417', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70417'}, {'name': 'VU#643140', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/643140'}, {'name': 'libpng-pngsetrgbtogray-bo(64637)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/64637'}, {'tags': ['x_refsource_MISC'], 'url': 'ftp://ftp.simplesystems.org/pub/png-group/src/libpng-1.5.1beta01-README.txt'}, {'name': '1024955', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1024955'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'ftp://ftp.simplesystems.org/pub/png-group/src/libpng-1.5.1beta01-1.5.0-diff.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/mailarchive/forum.php?thread_name=002b01cbb0e2%24ae636c80%240b2a4580%24%40acm.org&forum_name=png-mng-implement'}, {'name': 'ADV-2011-0080', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0080'}]
CVE State: PUBLISHED
Explain CVE-2011-0410
CollabNet ScrumWorks Basic 1.8.4 uses cleartext credentials for network communication and the internal database, which makes it easier for context-dependent attackers to obtain sensitive information by (1) sniffing the network for transmissions of Java objects or (2) reading the database.
Affected Products: n/a
References: [{'name': '70601', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70601'}, {'name': 'VU#547167', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/547167'}, {'name': '70602', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70602'}, {'name': '43010', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43010'}, {'name': 'scrumworks-base64-info-disclosure(64883)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/64883'}]
CVE State: PUBLISHED
Explain CVE-2011-0412
Oracle Solaris 8, 9, and 10 stores back-out patch files (undo.Z) unencrypted with world-readable permissions under /var/sadm/pkg/, which allows local users to obtain password hashes and conduct brute force password guessing attacks.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html'}, {'name': '44047', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44047'}, {'name': 'VU#648244', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/648244'}, {'name': 'solaris-password-info-disclosure(66579)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66579'}, {'name': '47171', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47171'}, {'name': '71646', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/71646'}, {'name': 'ADV-2011-0882', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0882'}]
CVE State: PUBLISHED
Explain CVE-2011-0413
The DHCPv6 server in ISC DHCP 4.0.x and 4.1.x before 4.1.2-P1, 4.0-ESV and 4.1-ESV before 4.1-ESV-R1, and 4.2.x before 4.2.1b1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) by sending a message over IPv6 for a declined and abandoned address.
Affected Products: n/a
References: [{'name': 'ADV-2011-0266', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0266'}, {'name': '43006', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43006'}, {'name': 'ADV-2011-0235', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0235'}, {'name': '43354', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43354'}, {'name': 'dhcp-dhcpv6-dos(64959)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/64959'}, {'name': '70680', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/70680'}, {'name': '43104', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43104'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.isc.org/article/AA-00456'}, {'name': 'MDVSA-2011:022', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:022'}, {'name': 'ADV-2011-0583', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0583'}, {'name': 'ADV-2011-0300', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0300'}, {'name': '43613', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43613'}, {'name': '1024999', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1024999'}, {'name': '43167', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43167'}, {'name': 'RHSA-2011:0256', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0256.html'}, {'name': '46035', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46035'}, {'name': 'FEDORA-2011-0862', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053644.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.isc.org/software/dhcp/advisories/cve-2011-0413'}, {'name': 'ADV-2011-0400', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0400'}, {'name': 'DSA-2184', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2184'}, {'name': 'VU#686084', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/686084'}]
CVE State: PUBLISHED
Explain CVE-2011-0414
ISC BIND 9.7.1 through 9.7.2-P3, when configured as an authoritative server, allows remote attackers to cause a denial of service (deadlock and daemon hang) by sending a query at the time of (1) an IXFR transfer or (2) a DDNS update.
Affected Products: n/a
References: [{'name': 'VU#449980', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/449980'}, {'name': 'ADV-2011-0489', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0489'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.isc.org/software/bind/advisories/cve-2011-0414'}, {'name': '1025110', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1025110'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=679496'}, {'name': 'SUSE-SR:2011:005', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html'}, {'name': 'VU#559980', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/559980'}, {'name': '43443', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43443'}, {'name': 'DSA-2208', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2208'}, {'name': 'ADV-2011-0466', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0466'}, {'name': '43439', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43439'}, {'name': 'USN-1070-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1070-1'}]
CVE State: PUBLISHED
Explain CVE-2011-0418
The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/glob.c#rev1.28'}, {'name': 'ADV-2011-1273', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/1273'}, {'name': 'MDVSA-2011:094', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:094'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/glob.c.diff?r1=1.27&r2=1.28&f=h'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=704283'}, {'name': '47671', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47671'}, {'name': '20110502 Multiple Vendors libc/glob(3) GLOB_BRACE|GLOB_LIMIT memory exhaustion', 'tags': ['third-party-advisory', 'x_refsource_SREASONRES'], 'url': 'http://securityreason.com/achievement_securityalert/97'}, {'name': '8228', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8228'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.pureftpd.org/project/pure-ftpd/news'}]
CVE State: PUBLISHED
Explain CVE-2011-0420
The grapheme_extract function in the Internationalization extension (Intl) for ICU for PHP 5.3.5 allows context-dependent attackers to cause a denial of service (crash) via an invalid size argument, which triggers a NULL pointer dereference.
Affected Products: n/a
References: [{'name': '20110216 PHP 5.3.5 grapheme_extract() NULL Pointer Dereference', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/516504/100/0/threaded'}, {'name': 'DSA-2266', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2266'}, {'name': 'VU#210829', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/210829'}, {'name': '46429', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46429'}, {'name': '8087', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8087'}, {'name': '16182', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/16182'}, {'name': 'APPLE-SA-2011-10-12-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html'}, {'name': 'php-graphemeextract-dos(65437)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65437'}, {'name': '20110217 Re: PHP 5.3.5 grapheme_extract() NULL Pointer Dereference', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/516518/100/0/threaded'}, {'name': '20110217 PHP 5.3.5 grapheme_extract() NULL Pointer Dereference', 'tags': ['third-party-advisory', 'x_refsource_SREASONRES'], 'url': 'http://securityreason.com/achievement_securityalert/94'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5002'}, {'tags': ['x_refsource_MISC'], 'url': 'http://svn.php.net/viewvc/php/php-src/trunk/ext/intl/grapheme/grapheme_string.c?r1=306449&r2=306448&pathrev=306449'}]
CVE State: PUBLISHED
Explain CVE-2011-0423
The PolyVision RoomWizard with firmware 3.2.3 has a default password of roomwizard for the administrator account, which makes it easier for remote attackers to obtain console access via an HTTP session, a different vulnerability than CVE-2010-0214.
Affected Products: n/a
References: [{'name': 'VU#870601', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/870601'}, {'name': 'roomwizard-password-security-bypass(64543)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/64543'}, {'name': 'ADV-2011-0059', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0059'}, {'name': '70388', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70388'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/view/97291/roomwizard-disclose.txt'}, {'name': 'roomwizard-default-password(64642)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/64642'}, {'name': '20110106 RoomWizard Default Password and Sync Connector Credential Leak [CVE-2010-0214]', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2011/Jan/58'}, {'name': '45699', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/45699'}]
CVE State: PUBLISHED
Explain CVE-2011-0426
Directory traversal vulnerability in vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, and VMware VirtualCenter 2.5 before Update 6a, allows remote attackers to read arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'name': '[security-announce] 20110505 VMSA-2011-0008 VMware vCenter Server and vSphere Client security vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.vmware.com/pipermail/security-announce/2011/000137.html'}, {'name': '1025502', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1025502'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0008.html'}]
CVE State: PUBLISHED
Explain CVE-2011-0427
Heap-based buffer overflow in Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'name': '[or-announce] 20110117 Tor 0.2.1.29 is released (security patches)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.seul.org/or/announce/Jan-2011/msg00000.html'}, {'name': 'ADV-2011-0131', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0131'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitweb.torproject.org/tor.git/blob/refs/heads/release-0.2.2:/ChangeLog'}, {'name': '42907', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42907'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blog.torproject.org/blog/tor-02129-released-security-patches'}, {'name': '1024980', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1024980'}, {'name': 'tor-unspec-bo(64748)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/64748'}, {'name': 'ADV-2011-0132', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0132'}, {'name': 'DSA-2148', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2148'}, {'name': '42905', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42905'}, {'name': '45832', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/45832'}]
CVE State: PUBLISHED
Explain CVE-2011-0428
Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2011-0428'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://ikiwiki.info/security/#index38h2'}]
CVE State: PUBLISHED
Explain CVE-2011-0430
Double free vulnerability in the Rx server process in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions allows remote attackers to cause a denial of service and execute arbitrary code via unknown vectors.
Affected Products: n/a
References: [{'name': '46428', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46428'}, {'name': 'DSA-2168', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2168'}, {'name': 'ADV-2011-0410', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0410'}, {'name': '43371', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43371'}, {'name': '1025095', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1025095'}, {'name': 'ADV-2011-0411', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0411'}, {'name': '43407', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43407'}]
CVE State: PUBLISHED
Explain CVE-2011-0431
The afs_linux_lock function in afs/LINUX/osi_vnodeops.c in the kernel module in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions does not properly handle errors, which allows attackers to cause a denial of service via unknown vectors.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '46428', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46428'}, {'name': 'DSA-2168', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2168'}, {'name': 'ADV-2011-0410', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0410'}, {'name': '43371', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43371'}, {'name': '1025095', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1025095'}, {'name': 'ADV-2011-0411', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0411'}, {'name': '43407', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43407'}]
CVE State: PUBLISHED
Explain CVE-2011-0432
Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': 'DSA-2177', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2177'}, {'name': 'FEDORA-2011-2427', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055444.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://pywebdav.googlecode.com/files/PyWebDAV-0.9.4.1.tar.gz'}, {'name': '43602', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43602'}, {'name': '43571', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43571'}, {'name': 'ADV-2011-0553', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0553'}, {'name': 'FEDORA-2011-2470', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055413.html'}, {'name': 'FEDORA-2011-2460', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055412.html'}, {'name': '43703', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43703'}, {'name': 'ADV-2011-0554', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0554'}, {'name': 'ADV-2011-0634', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0634'}, {'name': '46655', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46655'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/pywebdav/updates/list'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=677718'}]
CVE State: PUBLISHED
Explain CVE-2011-0433
Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, a different vulnerability than CVE-2010-2642.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=679732'}, {'name': '48985', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48985'}, {'tags': ['x_refsource_MISC'], 'url': 'http://xorl.wordpress.com/2011/02/20/cve-2011-0433-evince-linetoken-buffer-overflow/'}, {'name': 'RHSA-2012:1201', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1201.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.gnome.org/show_bug.cgi?id=640923'}, {'name': 'MDVSA-2012:144', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:144'}, {'name': 'GLSA-201701-57', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-57'}]
CVE State: PUBLISHED
Explain CVE-2011-0434
Multiple SQL injection vulnerabilities in Domain Technologie Control (DTC) before 0.32.9 allow remote attackers to execute arbitrary SQL commands via the cid parameter to (1) admin/bw_per_month.php or (2) client/bw_per_month.php.
Affected Products: n/a
References: [{'name': '43523', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43523'}, {'name': 'ADV-2011-0556', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0556'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://packages.debian.org/changelogs/pool/main/d/dtc/dtc_0.29.17-1+lenny1/changelog'}, {'name': 'dtc-cid-sql-injection(65895)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65895'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commit%3Bh=89da9c519b04cda1b23e6290d2b0a6cea1bae31e'}, {'name': 'DSA-2179', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2179'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commit%3Bh=e94e8b9cc354bfcaeb284d5331b815256bb46162'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://packages.debian.org/changelogs/pool/main/d/dtc/dtc_0.32.10-1/changelog'}, {'name': '[dtcannounce] 20110303 Fwd: [SECURITY] [DSA 2179-1] dtc security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.gplhost.sg/lists/dtcannounce/msg00025.html'}]
CVE State: PUBLISHED
Explain CVE-2011-0435
Domain Technologie Control (DTC) before 0.32.9 does not require authentication for (1) admin/bw_per_month.php and (2) client/bw_per_month.php, which allows remote attackers to obtain potentially sensitive bandwidth information via a direct request.
Affected Products: n/a
References: [{'name': '43523', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43523'}, {'name': 'ADV-2011-0556', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0556'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://packages.debian.org/changelogs/pool/main/d/dtc/dtc_0.29.17-1+lenny1/changelog'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commit%3Bh=89da9c519b04cda1b23e6290d2b0a6cea1bae31e'}, {'name': 'DSA-2179', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2179'}, {'name': 'dtc-bwpermonth-info-disc(65896)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65896'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commit%3Bh=e94e8b9cc354bfcaeb284d5331b815256bb46162'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://packages.debian.org/changelogs/pool/main/d/dtc/dtc_0.32.10-1/changelog'}, {'name': '[dtcannounce] 20110303 Fwd: [SECURITY] [DSA 2179-1] dtc security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.gplhost.sg/lists/dtcannounce/msg00025.html'}]
CVE State: PUBLISHED
Explain CVE-2011-0436
The register_user function in client/new_account_form.php in Domain Technologie Control (DTC) before 0.32.9 includes a cleartext password in an e-mail message, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Affected Products: n/a
References: [{'name': '43523', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43523'}, {'name': 'ADV-2011-0556', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0556'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://packages.debian.org/changelogs/pool/main/d/dtc/dtc_0.29.17-1+lenny1/changelog'}, {'name': '[oss-security] 20110222 CVE-2011-0436: dtc sends password of new users to site admin by unencrypted email', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/02/22/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commit%3Bh=adffff7efb3687ff465ee0552a944dd3109f3cb0'}, {'name': 'DSA-2179', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2179'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614302'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commit%3Bh=f8e3b2d7cc2da313addc05394568ab9599499285'}, {'name': 'dtc-passwords-info-disc(65898)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65898'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://packages.debian.org/changelogs/pool/main/d/dtc/dtc_0.32.10-1/changelog'}, {'name': '[dtcannounce] 20110303 Fwd: [SECURITY] [DSA 2179-1] dtc security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.gplhost.sg/lists/dtcannounce/msg00025.html'}]
CVE State: PUBLISHED
Explain CVE-2011-0437
shared/inc/sql/ssh.php in the SSH accounts management implementation in Domain Technologie Control (DTC) before 0.32.9 allows remote authenticated users to delete arbitrary accounts via the edssh_account parameter in a deletesshaccount Delete action.
Affected Products: n/a
References: [{'name': '43523', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43523'}, {'name': 'ADV-2011-0556', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0556'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commit%3Bh=9b75112fc12fead5740b1aaf0df562b5a9045ec0'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://packages.debian.org/changelogs/pool/main/d/dtc/dtc_0.29.17-1+lenny1/changelog'}, {'name': 'DSA-2179', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2179'}, {'name': 'dtc-ssh-sec-bypass(65897)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65897'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://packages.debian.org/changelogs/pool/main/d/dtc/dtc_0.32.10-1/changelog'}, {'name': '[dtcannounce] 20110303 Fwd: [SECURITY] [DSA 2179-1] dtc security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.gplhost.sg/lists/dtcannounce/msg00025.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commit%3Bh=c97ab4ae43945de36534c40004d713b3b10113db'}]
CVE State: PUBLISHED
Explain CVE-2011-0438
nslcd/pam.c in the nss-pam-ldapd 0.8.0 PAM module returns a success code when a user is not found in LDAP, which allows remote attackers to bypass authentication.
Affected Products: n/a
References: [{'name': '8132', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8132'}, {'name': '46819', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46819'}, {'name': 'nsspamldapd-pam-sec-bypass(66028)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66028'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.arthurdejong.org/nss-pam-ldapd-announce/2011/attachments/txtVf3rHgt8qQ.txt'}, {'name': '[nss-pam-ldapd-announce] 20110309 nss-pam-ldapd security advisory (CVE-2011-0438)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.arthurdejong.org/nss-pam-ldapd-announce/2011/msg00000.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://arthurdejong.org/nss-pam-ldapd/news.html#20110309'}]
CVE State: PUBLISHED
Explain CVE-2011-0439
Cross-site scripting (XSS) vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the Pieforms select box.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://mahara.org/interaction/forum/topic.php?id=3208'}, {'name': 'DSA-2206', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2206'}, {'name': '47033', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47033'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://mahara.org/interaction/forum/topic.php?id=3205'}, {'name': 'mahara-pieform-xss(66327)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66327'}, {'name': '43858', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43858'}]
CVE State: PUBLISHED
Explain CVE-2011-0440
Cross-site request forgery (CSRF) vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that delete blogs.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://mahara.org/interaction/forum/topic.php?id=3208'}, {'name': 'DSA-2206', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2206'}, {'name': '47033', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47033'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://mahara.org/interaction/forum/topic.php?id=3206'}, {'name': 'mahara-blogposts-csrf(66326)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66326'}, {'name': '43858', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43858'}]
CVE State: PUBLISHED
Explain CVE-2011-0441
The Debian GNU/Linux /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/.
Affected Products: n/a
References: [{'name': '46928', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46928'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.debian.org/?p=pkg-php/php.git%3Ba=commit%3Bh=d09fd04ed7bfcf7f008360c6a42025108925df09'}, {'name': 'ADV-2011-0910', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0910'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618489'}, {'name': 'php-php5common-file-deletion(66180)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66180'}, {'name': 'MDVSA-2011:069', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:069'}]
CVE State: PUBLISHED
Explain CVE-2011-0442
The service utility in EMC Avamar 5.x before 5.0.4 uses cleartext to transmit event details in (1) service requests and (2) e-mail messages, which might allow remote attackers to obtain sensitive information by sniffing the network.
Affected Products: n/a
References: [{'name': 'avamar-service-utility-info-disclosure(66109)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66109'}, {'name': 'ADV-2011-0678', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0678'}, {'name': 'ADV-2011-0677', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0677'}, {'name': '20110315 ESA-2011-007: EMC Avamar sensitive information disclosure vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/517022/100/0/threaded'}, {'name': '43797', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43797'}, {'name': '1025213', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1025213'}, {'name': '8139', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8139'}, {'name': '46879', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46879'}]
CVE State: PUBLISHED
Explain CVE-2011-0443
SQL injection vulnerability in inc/tinybb-settings.php in tinyBB 1.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '45737', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/45737'}, {'name': '1024949', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1024949'}, {'name': 'tinybb-index-sql-injection(64570)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/64570'}, {'name': '42854', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42854'}, {'name': '15961', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/15961'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tinybb.net/forum/?page=thread&post=989525101'}, {'name': '70394', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70394'}]
CVE State: PUBLISHED
Explain CVE-2011-0444
Buffer overflow in the MAC-LTE dissector (epan/dissectors/packet-mac-lte.c) in Wireshark 1.2.0 through 1.2.13 and 1.4.0 through 1.4.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of RARs.
Affected Products: n/a
References: [{'name': '43175', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43175'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5676'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5530'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wireshark.org/security/wnpa-sec-2011-01.html'}, {'name': 'MDVSA-2011:007', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:007'}, {'name': 'ADV-2011-0270', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0270'}, {'name': '45775', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/45775'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wireshark.org/security/wnpa-sec-2011-02.html'}, {'name': 'wireshark-maclte-bo(64624)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/64624'}, {'name': 'ADV-2011-0719', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0719'}, {'name': 'FEDORA-2011-0450', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053650.html'}, {'name': 'ADV-2011-0079', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0079'}, {'name': 'FEDORA-2011-0460', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053669.html'}, {'name': 'ADV-2011-0104', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0104'}, {'name': 'RHSA-2011:0369', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0369.html'}, {'name': 'oval:org.mitre.oval:def:14283', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14283'}, {'name': '70403', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70403'}]
CVE State: PUBLISHED
Explain CVE-2011-0445
The ASN.1 BER dissector in Wireshark 1.4.0 through 1.4.2 allows remote attackers to cause a denial of service (assertion failure) via crafted packets, as demonstrated by fuzz-2010-12-30-28473.pcap.
Affected Products: n/a
References: [{'name': '43175', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43175'}, {'name': 'ADV-2011-0270', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0270'}, {'name': '45775', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/45775'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wireshark.org/security/wnpa-sec-2011-02.html'}, {'name': 'oval:org.mitre.oval:def:14505', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14505'}, {'name': '70402', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70402'}, {'name': 'FEDORA-2011-0450', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053650.html'}, {'name': 'ADV-2011-0079', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0079'}, {'name': 'FEDORA-2011-0460', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053669.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5537'}, {'name': 'wireshark-asn1ber-dissector-dos(64625)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/64625'}]
CVE State: PUBLISHED
Explain CVE-2011-0446
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
Affected Products: n/a
References: [{'name': 'ADV-2011-0587', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0587'}, {'name': 'FEDORA-2011-2138', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html'}, {'name': '46291', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46291'}, {'name': 'DSA-2247', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2247'}, {'name': 'FEDORA-2011-4358', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html'}, {'name': '43274', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43274'}, {'name': '1025064', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1025064'}, {'name': '[rubyonrails-security] 20110209 Potential XSS Problem with mail_to :encode => :javascript', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain'}, {'name': 'ADV-2011-0877', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0877'}, {'name': 'FEDORA-2011-2133', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html'}, {'name': '43666', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43666'}]
CVE State: PUBLISHED
Explain CVE-2011-0447
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.
Affected Products: n/a
References: [{'name': 'ADV-2011-0587', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0587'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails'}, {'name': '1025060', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1025060'}, {'name': 'FEDORA-2011-2138', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html'}, {'name': '46291', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46291'}, {'name': 'DSA-2247', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2247'}, {'name': '[rubyonrails-security] 20110209 CSRF Protection Bypass in Ruby on Rails', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain'}, {'name': 'FEDORA-2011-4358', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html'}, {'name': '43274', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43274'}, {'name': 'ADV-2011-0877', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0877'}, {'name': 'FEDORA-2011-2133', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html'}, {'name': '43666', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43666'}]
CVE State: PUBLISHED
Explain CVE-2011-0448
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
Affected Products: n/a
References: [{'name': '[rubyonrails-security] 20110209 Potential SQL Injection in Rails 3.0.x', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://groups.google.com/group/rubyonrails-security/msg/4e19864cf6ad40ad?dmode=source&output=gplain'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4'}, {'name': '1025063', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1025063'}, {'name': 'FEDORA-2011-4358', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html'}, {'name': '43278', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43278'}, {'name': 'ADV-2011-0877', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0877'}]
CVE State: PUBLISHED
Explain CVE-2011-0449
actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
Affected Products: n/a
References: [{'name': '1025061', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1025061'}, {'name': '[rubyonrails-security] 20110209 Filter Problems on Case-Insensitive Filesystems', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4'}, {'name': 'FEDORA-2011-4358', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html'}, {'name': '43278', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43278'}, {'name': 'ADV-2011-0877', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0877'}]
CVE State: PUBLISHED
Explain CVE-2011-0450
The downloads manager in Opera before 11.01 on Windows does not properly determine the pathname of the filesystem-viewing application, which allows user-assisted remote attackers to execute arbitrary code via a crafted web site that hosts an executable file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.opera.com/support/kb/view/985/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.opera.com/docs/changelogs/windows/1101/'}, {'name': 'ADV-2011-0231', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0231'}, {'name': 'oval:org.mitre.oval:def:12369', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12369'}, {'name': 'JVNDB-2011-000010', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000010.html'}, {'name': '70726', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/70726'}, {'name': 'JVN#33880169', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN33880169/index.html'}, {'name': '43023', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43023'}]
CVE State: PUBLISHED