Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2012-0891
Multiple cross-site scripting (XSS) vulnerabilities in Puppet Dashboard 1.0 before 1.2.5 and Enterprise 1.0 before 1.2.5 and 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://puppetlabs.com/security/cve/cve-2012-0891'}]
CVE State: PUBLISHED
Explain CVE-2012-0895
Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/extend/plugins/count-per-day/changelog/'}, {'name': '18355', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18355'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://plugins.trac.wordpress.org/changeset/488883/count-per-day'}, {'name': '47529', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47529'}, {'name': '78271', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78271'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/108631/countperday-downloadxss.txt'}, {'name': '51402', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51402'}, {'name': 'countperday-map-xss(72384)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72384'}]
CVE State: PUBLISHED
Explain CVE-2012-0896
Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/extend/plugins/count-per-day/changelog/'}, {'name': '18355', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18355'}, {'name': '78270', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78270'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://plugins.trac.wordpress.org/changeset/488883/count-per-day'}, {'name': '47529', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47529'}, {'name': 'countperday-download-file-download(72385)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72385'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/108631/countperday-downloadxss.txt'}, {'name': '51402', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51402'}]
CVE State: PUBLISHED
Explain CVE-2012-0897
Stack-based buffer overflow in the JPEG2000 plugin in IrfanView PlugIns before 4.33 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.
Affected Products: n/a
References: [{'name': '1032529', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032529'}, {'name': '47360', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47360'}, {'name': '51426', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51426'}, {'name': '78333', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78333'}, {'name': '1032530', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032530'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.irfanview.com/history_old.htm'}, {'name': 'irfanview-qcd-bo(72398)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72398'}]
CVE State: PUBLISHED
Explain CVE-2012-0898
Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dwn_file parameter.
Affected Products: n/a
References: [{'name': 'myeasy-mebdownload-directory-traversal(72404)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72404'}, {'name': '47594', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47594'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/view/108711/wpmyeasybackup-traversal.txt'}]
CVE State: PUBLISHED
Explain CVE-2012-0899
Cross-site scripting (XSS) vulnerability in referencement/sites_inscription.php in Annuaire PHP allows remote attackers to inject arbitrary web script or HTML via the url parameter and possibly the nom parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/view/108719/annuaire-xss.txt'}, {'name': 'annuaire-sitesinscription-xss(72407)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72407'}, {'name': '51434', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51434'}]
CVE State: PUBLISHED
Explain CVE-2012-0900
Multiple cross-site scripting (XSS) vulnerabilities in Beehive Forum 1.0.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) forum/register.php or (2) forum/logon.php.
Affected Products: n/a
References: [{'name': 'beehiveforum101-multiple-xss(72411)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72411'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.darksecurity.de/advisories/SSCHADV2011-042.txt'}, {'name': '47595', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47595'}, {'name': '51424', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51424'}, {'name': '20120115 Beehive Forum 101 Multiple XSS vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0103.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0901
Cross-site scripting (XSS) vulnerability in yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/view/108470/wpystap-xss.txt'}, {'name': 'yousaytooautopublishing-yousaytoo-xss(72271)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72271'}]
CVE State: PUBLISHED
Explain CVE-2012-0902
AirTies Air 4450 1.1.2.18 allows remote attackers to cause a denial of service (reboot) via a direct request to cgi-bin/loader.
Affected Products: n/a
References: [{'name': '51320', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51320'}, {'name': '18336', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18336'}, {'name': 'airties-4450-cgibin-dos(72200)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72200'}]
CVE State: PUBLISHED
Explain CVE-2012-0903
Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Desktop 7.1.2 b10978 allow remote attackers to inject arbitrary web script or HTML via the (1) Username or (2) MailBox Name.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/view/108715/VL-378.txt'}, {'name': '51436', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51436'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.vulnerability-lab.com/get_content.php?id=378'}, {'name': '20120116 Zimbra Desktop v7.1.2 - Persistent Software Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2012/Jan/244'}, {'name': 'zimbra-labelname-xss(72405)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72405'}]
CVE State: PUBLISHED
Explain CVE-2012-0904
VLC media player 1.1.11 allows remote attackers to cause a denial of service (crash) via a long string in an amr file.
Affected Products: n/a
References: [{'name': 'vlcmediaplayer-amr-dos(72085)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72085'}, {'name': '20120104 VLC media player v1.1.11 (.amr) Local Crash PoC', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0033.html'}, {'name': '18309', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18309'}, {'name': 'oval:org.mitre.oval:def:14327', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14327'}, {'name': '51255', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51255'}]
CVE State: PUBLISHED
Explain CVE-2012-0905
SQL injection vulnerability in deV!L'z Clanportal (DZCP) Gamebase addon allows remote attackers to execute arbitrary SQL commands via the gameid parameter in a detail action to index.php.
Affected Products: n/a
References: [{'name': '18385', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18385'}, {'name': 'clanportal-index-sql-injection(72452)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72452'}, {'name': '47563', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47563'}]
CVE State: PUBLISHED
Explain CVE-2012-0906
SQL injection vulnerability in the Moviebase addon for deV!L'z Clanportal (DZCP) 1.5.5 allows remote attackers to execute arbitrary SQL commands via the id parameter in a showkat action to index.php.
Affected Products: n/a
References: [{'name': 'clanportal-id-sql-injection(72453)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72453'}, {'name': '18386', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18386'}]
CVE State: PUBLISHED
Explain CVE-2012-0907
Directory traversal vulnerability in the web player in NeoAxis NeoAxis web player 1.4 and earlier allows user-assisted remote attackers to write arbitrary files via a .. (dot dot) in a filename in the neoaxis_web_application_win32.zip ZIP archive.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/neoaxis_1-adv.txt'}, {'name': '78311', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78311'}, {'name': 'neoaxis-neoaxis-directory-traversal(72427)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72427'}]
CVE State: PUBLISHED
Explain CVE-2012-0908
Cross-site scripting (XSS) vulnerability in logout.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the link_href parameter.
Affected Products: n/a
References: [{'name': 'simplesamlphp-nocookie-logout-xss(72313)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72313'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/simplesamlphp/issues/detail?id=468'}, {'name': '78255', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78255'}, {'name': '[oss-security] 20120120 Re: CVE request: simpleSAMLphp 1.8.2 cross site scripting', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/20/20'}, {'name': '51372', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51372'}, {'name': '47491', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47491'}]
CVE State: PUBLISHED
Explain CVE-2012-0909
Cross-site scripting (XSS) vulnerability in Horde_Form in Horde Groupware Webmail Edition before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to email verification.  NOTE: Some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.horde.org/apps/webmail/docs/CHANGES'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.horde.org/apps/webmail/docs/RELEASE_NOTES'}, {'name': '51586', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51586'}, {'name': '[oss-security] 20120121 Re: Re: CVE Request -- Horde IMP -- Multiple XSS flaws', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/22/2'}, {'name': '47592', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47592'}]
CVE State: PUBLISHED
Explain CVE-2012-0911
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function.
Affected Products: n/a
References: [{'name': '19630', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/19630'}, {'name': '19573', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/19573'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://info.tiki.org/article190-Tiki-Wiki-CMS-Groupware-Updates-Tiki-6-7-LTS'}, {'name': '54298', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/54298'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://dev.tiki.org/item4109'}, {'name': '83534', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/83534'}, {'name': '20120704 [CVE-2012-0911] Tiki Wiki CMS Groupware <= 8.3 "unserialize()" PHP Code Execution', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-07/0020.html'}, {'name': 'tikiwiki-unserialize-code-exec(76758)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/76758'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://info.tiki.org/article191-Tiki-Releases-8-4'}]
CVE State: PUBLISHED
Explain CVE-2012-0912
SQL injection vulnerability in Stoneware webNetwork before 6.0.8.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.stone-ware.com/support/techdocs/kb/d1960/sb_6_0_8.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.stone-ware.com/swql.jsp?kb=d1960'}]
CVE State: PUBLISHED
Explain CVE-2012-0913
SQL injection vulnerability in checklogin.aspx in ICloudCenter ICTimeAttendance 1.0 allows remote attackers to execute arbitrary SQL commands via the passw parameter.  NOTE: Some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '78444', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78444'}, {'name': '18394', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18394'}, {'name': '47660', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47660'}, {'name': '51589', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51589'}, {'name': 'ictimeattendance-passw-sql-injection(72569)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72569'}]
CVE State: PUBLISHED
Explain CVE-2012-0914
Cross-site scripting (XSS) vulnerability in display_renderers/panels_renderer_editor.class.php in the admin view in the Panels module 6.x-2.x before 6.x-3.10 and 7.x-3.x before 7.x-3.0 for Drupal allows remote authenticated users with certain privileges to inject arbitrary web script or HTML via the Region title.
Affected Products: n/a
References: [{'name': '47649', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47649'}, {'name': '51568', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51568'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1409436'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/panels.git/commit/d844942'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1409446'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/panels.git/commit/2066d59'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.madirish.net/content/drupal-panels-6x-39-xss-vulnerability'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1409448'}, {'name': 'drupal-panels-unspecified-xss(72549)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72549'}, {'name': '78367', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78367'}]
CVE State: PUBLISHED
Explain CVE-2012-0915
Integer signedness error in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via crafted dimensions of a skin file, leading to a heap-based buffer overflow, as demonstrated using a BMP image.
Affected Products: n/a
References: [{'name': '51585', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51585'}, {'name': '47314', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47314'}]
CVE State: PUBLISHED
Explain CVE-2012-0916
Heap-based buffer overflow in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via a crafted image in a chat message, as demonstrated using a PNG file.
Affected Products: n/a
References: [{'name': '51585', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51585'}, {'name': '47314', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47314'}]
CVE State: PUBLISHED
Explain CVE-2012-0917
Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Analyzer 02-01, 02-51 through 02-51-01, and 02-53 through 02-53-02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '47467', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47467'}, {'name': '78221', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78221'}, {'name': '51340', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51340'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-001/index.html'}, {'name': 'hitachi-it-unspecified-xss(72248)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72248'}]
CVE State: PUBLISHED
Explain CVE-2012-0918
Unspecified vulnerability in Hitachi COBOL2002 Net Developer, Net Server Suite, and Net Client Suite 01-00, 01-01 through 01-01-/D, 01-02 through 01-02-/F, 01-03 through 01-03-/F, 02-00 through 02-00-/D, 02-01 through 02-01-/C, and possibly other versions before 02-01-/D allows remote attackers to execute arbitrary code via unknown attack vectors.
Affected Products: n/a
References: [{'name': 'hitachi-cobol2002-unspec-code-exec(72558)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72558'}, {'name': '47643', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47643'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-002/index.html'}, {'name': '47612', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47612'}, {'name': '51580', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51580'}]
CVE State: PUBLISHED
Explain CVE-2012-0919
Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 through 03-00-04, and possibly other versions before 03-00-06, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '47490', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47490'}, {'name': '51340', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51340'}, {'name': '78215', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78215'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-001/index.html'}, {'name': 'hitachi-it-unspecified-xss(72248)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72248'}]
CVE State: PUBLISHED
Explain CVE-2012-0920
Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authentication are enabled, allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to "channels concurrency."
Affected Products: n/a
References: [{'name': 'dropbear-code-execution(73444)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73444'}, {'name': '48147', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48147'}, {'name': 'DSA-2456', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2456'}, {'name': '79590', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79590'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://matt.ucc.asn.au/dropbear/CHANGES'}, {'name': '52159', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52159'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.mantor.org/~northox/misc/CVE-2012-0920.html'}, {'name': '48929', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48929'}]
CVE State: PUBLISHED
Explain CVE-2012-0922
rvrender.dll in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via crafted flags in an RMFF file.
Affected Products: n/a
References: [{'name': '47896', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47896'}, {'name': 'realplayer-rmff-code-execution(73018)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73018'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://service.real.com/realplayer/security/02062012_player/en/'}, {'name': '78911', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78911'}, {'name': '51883', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51883'}]
CVE State: PUBLISHED
Explain CVE-2012-0923
The RV20 codec in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, does not properly handle the frame size array, which allows remote attackers to execute arbitrary code via a crafted RV20 RealVideo video stream.
Affected Products: n/a
References: [{'name': '47896', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47896'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://service.real.com/realplayer/security/02062012_player/en/'}, {'name': '78912', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78912'}, {'name': '51884', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51884'}]
CVE State: PUBLISHED
Explain CVE-2012-0924
RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via vectors involving a VIDOBJ_START_CODE code in a header within a video stream.
Affected Products: n/a
References: [{'name': '47896', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47896'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://service.real.com/realplayer/security/02062012_player/en/'}]
CVE State: PUBLISHED
Explain CVE-2012-0925
Unspecified vulnerability in the RV40 codec in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via a crafted RV40 RealVideo video stream.
Affected Products: n/a
References: [{'name': '47896', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47896'}, {'name': 'realplayer-rv40-code-exec(73021)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73021'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://service.real.com/realplayer/security/02062012_player/en/'}, {'name': '51887', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51887'}, {'name': '78914', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78914'}]
CVE State: PUBLISHED
Explain CVE-2012-0926
The RV10 codec in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, does not properly handle height and width values, which allows remote attackers to execute arbitrary code via a crafted RV10 RealVideo video stream.
Affected Products: n/a
References: [{'name': '47896', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47896'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://service.real.com/realplayer/security/02062012_player/en/'}]
CVE State: PUBLISHED
Explain CVE-2012-0927
Unspecified vulnerability in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via vectors involving the coded_frame_size value in a RealAudio audio stream.
Affected Products: n/a
References: [{'name': '47896', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47896'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://service.real.com/realplayer/security/02062012_player/en/'}]
CVE State: PUBLISHED
Explain CVE-2012-0928
The ATRAC codec in RealNetworks RealPlayer 11.x and 14.x through 14.0.7, RealPlayer SP 1.0 through 1.1.5, and Mac RealPlayer 12.x before 12.0.0.1703 does not properly decode samples, which allows remote attackers to execute arbitrary code via a crafted ATRAC audio file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://service.real.com/realplayer/security/02062012_player/en/'}]
CVE State: PUBLISHED
Explain CVE-2012-0929
Multiple buffer overflows in Schneider Electric Modicon Quantum PLC allow remote attackers to cause a denial of service via malformed requests to the (1) FTP server or (2) HTTP server.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf'}, {'name': '51605', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51605'}, {'name': '47723', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47723'}, {'name': 'schneider-modicon-http-dos(72588)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72588'}, {'name': 'schneider-modicon-ftp-dos(72589)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72589'}, {'tags': ['x_refsource_MISC'], 'url': 'https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-12-020-03'}]
CVE State: PUBLISHED
Explain CVE-2012-0930
Cross-site scripting (XSS) vulnerability in Schneider Electric Modicon Quantum PLC allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf'}, {'name': '51605', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51605'}, {'name': '47723', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47723'}, {'name': 'schneider-modicon-unspec-xss(72590)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72590'}, {'tags': ['x_refsource_MISC'], 'url': 'https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-12-020-03'}]
CVE State: PUBLISHED
Explain CVE-2012-0931
Schneider Electric Modicon Quantum PLC does not perform authentication between the Unity software and PLC, which allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf'}, {'name': '51605', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51605'}, {'name': '47723', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47723'}, {'name': 'schneider-modicon-unity-dos(72586)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72586'}, {'tags': ['x_refsource_MISC'], 'url': 'https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-12-020-03'}]
CVE State: PUBLISHED
Explain CVE-2012-0932
Cross-site scripting (XSS) vulnerability in admin/login.php in Lead Capture Page System allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/108887/leadcapturepagesystem-xss.txt'}, {'name': 'leadcapture-login-xss(72623)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72623'}, {'name': '47702', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47702'}, {'name': '78455', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78455'}]
CVE State: PUBLISHED
Explain CVE-2012-0933
Multiple cross-site scripting (XSS) vulnerabilities in Acidcat CMS 3.5.1, 3.5.2, 3.5.6, and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin_colors.asp, (2) admin_config.asp, and (3) admin_cat_add.asp in admin/.
Affected Products: n/a
References: [{'name': '47705', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47705'}, {'name': '78458', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78458'}, {'name': 'acidcatcms-multiple-xss(72624)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72624'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/108869/acidcat-xss.txt'}, {'name': '51608', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51608'}]
CVE State: PUBLISHED
Explain CVE-2012-0934
PHP remote file inclusion vulnerability in ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the tt-abspath parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://spareclockcycles.org/2011/09/18/exploitring-the-wordpress-extension-repos/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://plugins.trac.wordpress.org/changeset/492167/theme-tuner#file2'}, {'name': '47722', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47722'}, {'name': 'themetuner-savetag-file-include(72626)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72626'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/extend/plugins/theme-tuner/changelog/'}, {'name': '51636', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51636'}]
CVE State: PUBLISHED
Explain CVE-2012-0935
SQL injection vulnerability in Default.aspx in Aryadad CMS allows remote attackers to execute arbitrary SQL commands via the PageID parameter.
Affected Products: n/a
References: [{'name': 'aryadad-default-sql-injection(72639)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72639'}, {'name': '51627', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51627'}, {'name': '18405', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18405'}]
CVE State: PUBLISHED
Explain CVE-2012-0936
Cross-site scripting (XSS) vulnerability in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via the Username field, related to login.
Affected Products: n/a
References: [{'name': '78454', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78454'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.opennms.org/browse/NMS-5128?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel#issue-tabs'}, {'name': '51632', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51632'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.opennms.org/browse/NMS/fixforversion/10824#atl_token=BCL8-RCDX-MB62-2EZT%7C38eaf469042162355c28f5393587690a8388d556%7Clout&selectedTab=com.atlassian.jira.plugin.system.project%3Aversion-summary-panel'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://fisheye.opennms.org/browse/opennms/features/springframework-security/src/main/java/org/opennms/web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java?r2=d2ce15470cb6c87c115c918eb86ef147486a9166&r1=80b80e110e4bce568fc2c6c0a15a'}, {'name': '47646', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47646'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.opennms.org/browse/NMS/fixforversion/10825'}, {'name': 'opennms-username-xss(72625)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72625'}]
CVE State: PUBLISHED
Explain CVE-2012-0937
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898.  NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time
Affected Products: n/a
References: [{'name': '18417', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18417'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt'}, {'name': '20120124 TWSL2012-002: Multiple Vulnerabilities in WordPress', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0150.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0938
Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the root_node parameter in the display_children function to (1) getrequirementnodes.php or (2) gettprojectnodes.php in lib/ajax/; the (3) cfield_id parameter in an edit action to lib/cfields/cfieldsEdit.php; the (4) id parameter in an edit action or (5) plan_id parameter in a create action to lib/plan/planMilestonesEdit.php; or the req_spec_id parameter to (6) reqImport.php or (7) in a create action to reqEdit.php in lib/requirements/.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '79451', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79451'}, {'name': '79453', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79453'}, {'name': '20120220 SQL Injection Vulnerabilities in TestLink', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0104.html'}, {'name': '48054', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48054'}, {'name': '79454', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79454'}, {'name': '79452', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79452'}, {'name': 'testlink-multiple-scripts-sql-injection(73327)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73327'}, {'name': '79450', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79450'}, {'name': '52086', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52086'}]
CVE State: PUBLISHED
Explain CVE-2012-0939
Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the req_spec_id parameter to (1) reqSpecAnalyse.php, (2) reqSpecPrint.php, or (3) reqSpecView.php in requirements/.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '20120220 SQL Injection Vulnerabilities in TestLink', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0104.html'}, {'name': '48054', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48054'}, {'name': '79447', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79447'}, {'name': '79448', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79448'}, {'name': 'testlink-multiple-parameters-sql-injection(73389)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73389'}, {'name': '52086', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52086'}, {'name': '79449', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79449'}]
CVE State: PUBLISHED
Explain CVE-2012-0941
Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiGate UTM WAF appliances with FortiOS 4.3.x before 4.3.6 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) Endpoint Monitor, (2) Dialup List, or (3) Log&Report Display modules, or the fields_sorted_opt parameter to (4) user/auth/list or (5) endpointcompliance/app_detect/predefined_sig_list.
Affected Products: n/a
References: [{'name': '1026594', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'https://securitytracker.com/id/1026594'}, {'name': 'fortigateutm-fieldssortedopt-xss(72761)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72761'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/109168/VL-144.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.vulnerability-lab.com/get_content.php?id=144'}, {'name': '51708', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51708'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fortiguard.com/psirt/FG-IR-012-001'}]
CVE State: PUBLISHED
Explain CVE-2012-0942
Buffer overflow in rn5auth.dll in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to execute arbitrary code via crafted authentication credentials.
Affected Products: n/a
References: [{'name': '52929', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52929'}, {'name': '1026898', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026898'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://helixproducts.real.com/docs/security/SecurityUpdate04022012HS.pdf'}]
CVE State: PUBLISHED
Explain CVE-2012-0943
debian/guest-account in Light Display Manager (lightdm) 1.0.x before 1.0.6 and 1.1.x before 1.1.7, as used in Ubuntu Linux 11.10, allows local users to delete arbitrary files via a space in the name of a file in /tmp.  NOTE: this identifier was SPLIT per ADT1/ADT2 due to different codebases and affected versions. CVE-2012-6648 has been assigned for the gdm-guest-session issue.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/%2Bsource/lightdm/%2Bbug/953044'}, {'name': 'USN-1399-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1399-2'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpadlibrarian.net/96471251/lightdm.secure-cleanup.debdiff'}]
CVE State: PUBLISHED
Explain CVE-2012-0944
Aptdaemon 0.43 and earlier in Ubuntu 11.04, 11.10, and 12.04 LTS does not authenticate packages when the transaction is not simulated, which allows remote attackers to install arbitrary packages via a man-in-the-middle attack.
Affected Products: n/a
References: [{'name': '52855', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52855'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/%2Bsource/aptdaemon/%2Bbug/959131'}, {'name': '80887', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/80887'}, {'name': 'USN-1414-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1414-1'}, {'name': 'aptdaemon-transaction-security-bypass(74553)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74553'}, {'name': '48688', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48688'}]
CVE State: PUBLISHED
Explain CVE-2012-0945
whoopsie-daisy before 0.1.26: Root user can remove arbitrary files
Affected Products: whoopsie-daisy
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/whoopsie-daisy/+bug/973687'}]
CVE State: PUBLISHED
Explain CVE-2012-0946
The NVIDIA UNIX driver before 295.40 allows local users to access arbitrary memory locations by leveraging GPU device-node read/write privileges.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/3109'}, {'name': '48793', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48793'}, {'name': 'nvidia-graphics-gpu-priv-escalation(74822)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74822'}, {'name': '48650', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48650'}, {'name': 'USN-1420-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-1420-1/'}]
CVE State: PUBLISHED
Explain CVE-2012-0947
Heap-based buffer overflow in the vqa_decode_chunk function in the VQA codec (vqavideo.c) in libavcodec in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VQA media file in which the image size is not a multiple of the block size.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/libav/+bug/980963'}, {'name': 'USN-1479-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1479-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.libav.org/?p=libav.git%3Ba=commit%3Bh=58b2e0f0f2fc96c1158e04f8aba95cbe6157a1a3'}, {'name': '49089', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49089'}, {'name': 'DSA-2471', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2471'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://libav.org/'}, {'name': '53389', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53389'}, {'name': '[oss-security] 20120503 Security issue in libav/ffmpeg', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/05/03/4'}]
CVE State: PUBLISHED
Explain CVE-2012-0948
DistUpgrade/DistUpgradeMain.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uses weak permissions for (1) apt-clone_system_state.tar.gz and (2) system_state.tar.gz, which allows local users to obtain repository credentials.
Affected Products: n/a
References: [{'name': '82019', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/82019'}, {'name': 'USN-1443-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1443-1'}, {'name': 'update-manager-info-disclosure(75727)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75727'}, {'name': '53604', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53604'}, {'name': '49230', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49230'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://launchpadlibrarian.net/105380733/update-manager_1%3A0.156.14.3_1%3A0.156.14.4.diff.gz'}]
CVE State: PUBLISHED
Explain CVE-2012-0949
The Apport hook in Update Manager as used by Ubuntu 12.04 LTS, 11.10, and 11.04 uploads certain system state archive files when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report.
Affected Products: n/a
References: [{'name': 'update-manager-archives-info-disclosure(75728)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75728'}, {'name': 'USN-1443-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1443-1'}, {'name': '49230', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49230'}, {'name': '82020', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/82020'}, {'name': '53605', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53605'}]
CVE State: PUBLISHED
Explain CVE-2012-0950
The Apport hook (DistUpgradeApport.py) in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uploads the /var/log/dist-upgrade directory when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0949.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/%2Bsource/update-manager/%2Bbug/1004503'}, {'name': 'USN-1443-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1443-2'}]
CVE State: PUBLISHED
Explain CVE-2012-0951
A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registry.
Affected Products: graphics drivers
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-0951.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://vuldb.com/?id.10060'}]
CVE State: PUBLISHED