Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2011-1476
Integer underflow in the Open Sound System (OSS) subsystem in the Linux kernel before 2.6.39 on unspecified non-x86 platforms allows local users to cause a denial of service (memory corruption) by leveraging write access to /dev/sequencer.
Affected Products: n/a
References: [{'name': '[oss-security] 20110325 Re: CVE request: kernel: two OSS fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/03/25/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b769f49463711205d57286e64cf535ed4daf59e9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/b769f49463711205d57286e64cf535ed4daf59e9'}, {'name': 'SUSE-SU-2015:0812', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1477
Multiple array index errors in sound/oss/opl3.c in the Linux kernel before 2.6.39 allow local users to cause a denial of service (heap memory corruption) or possibly gain privileges by leveraging write access to /dev/sequencer.
Affected Products: n/a
References: [{'name': '[oss-security] 20110325 Re: CVE request: kernel: two OSS fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/03/25/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/4d00135a680727f6c3be78f8befaac009030e4df'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4d00135a680727f6c3be78f8befaac009030e4df'}, {'name': 'SUSE-SU-2015:0812', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1478
The napi_reuse_skb function in net/core/dev.c in the Generic Receive Offload (GRO) implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denial of service (NULL pointer dereference) via a malformed VLAN frame.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://mirror.anl.gov/pub/linux/kernel/v2.6/ChangeLog-2.6.38'}, {'name': '20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/520102/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6d152e23ad1a7a5b40fef1f42e017d66e6115159'}, {'name': '8480', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8480'}, {'name': '46397', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/46397'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=691270'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=66c46d741e2e60f0e8b625b80edb0ab820c46d7a'}, {'name': '[oss-security] 20110328 CVE-2011-1478 kernel: gro: reset dev and skb_iff on skb reuse', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/03/28/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0012.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1479
Double free vulnerability in the inotify subsystem in the Linux kernel before 2.6.39 allows local users to cause a denial of service (system crash) via vectors involving failed attempts to create files.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-4250.
Affected Products: n/a
References: [{'name': '[oss-security] 20110411 Re: CVE request: kernel: inotify memory leak', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/04/11/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/d0de4dc584ec6aa3b26fffea320a8457827768fc'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d0de4dc584ec6aa3b26fffea320a8457827768fc'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=691793'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39'}]
CVE State: PUBLISHED
Explain CVE-2011-1480
SQL injection vulnerability in admin.php in the administration backend in Francisco Burzi PHP-Nuke 8.0 and earlier allows remote attackers to execute arbitrary SQL commands via the chng_uid parameter.
Affected Products: n/a
References: [{'name': '[oss-security] 20110323 CVE Request: PHP-Nuke 8.x <= "chng_uid" Blind SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/03/23/7'}, {'name': '[oss-security] 20110330 Re: CVE Request: PHP-Nuke 8.x <= "chng_uid" Blind SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/03/30/6'}, {'tags': ['x_refsource_MISC'], 'url': 'http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_sql_injection'}]
CVE State: PUBLISHED
Explain CVE-2011-1481
Multiple cross-site scripting (XSS) vulnerabilities in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) sender_name or (2) sender_email parameter in a Feedback action to modules.php.
Affected Products: n/a
References: [{'name': '[oss-security] 20110323 CVE Request: PHP-Nuke 8.x <= Cross Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/03/23/8'}, {'name': '[oss-security] 20110330 Re: CVE Request: PHP-Nuke 8.x <= Cross Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/03/30/7'}, {'tags': ['x_refsource_MISC'], 'url': 'http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_scripting'}]
CVE State: PUBLISHED
Explain CVE-2011-1482
Multiple cross-site request forgery (CSRF) vulnerabilities in mainfile.php in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts or (2) grant the administrative privilege to a user account, related to a Referer check that uses a substring comparison.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_request_forgery'}, {'name': '[oss-security] 20110330 Re: CVE Request: PHP-Nuke 8.x <= Cross Site Request Forgery (CSRF) / Anti-CSRF Bypass Vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/03/30/8'}, {'name': '[oss-security] 20110323 CVE Request: PHP-Nuke 8.x <= Cross Site Request Forgery (CSRF) / Anti-CSRF Bypass Vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/03/23/9'}]
CVE State: PUBLISHED
Explain CVE-2011-1483
wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://source.jboss.org/changelog/JBossWS/?cs=13996'}, {'name': 'SSRT101110', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03824583'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=692584'}, {'name': 'HPSBMU02894', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03824583'}]
CVE State: PUBLISHED
Explain CVE-2011-1484
jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 and JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0.CP09 and 5.1.0, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application.
Affected Products: n/a
References: [{'name': 'RHSA-2011:1251', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-1251.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=692421'}, {'name': 'RHSA-2011:0462', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0462.html'}, {'name': 'RHSA-2011:0463', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0463.html'}, {'name': 'RHSA-2011:0461', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0461.html'}, {'name': 'RHSA-2011:0460', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0460.html'}, {'name': 'RHSA-2011:1148', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-1148.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://docs.redhat.com/docs/en-US/JBoss_Communications_Platform/5.1/html/5.1.1_Release_Notes/ar01s05.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1485
Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.
Affected Products: n/a
References: [{'name': 'RHSA-2011:0455', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0455.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=692922'}, {'name': 'DSA-2319', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2319'}, {'name': '8424', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8424'}, {'name': 'FEDORA-2011-5676', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059859.html'}, {'name': 'USN-1117-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1117-1'}, {'name': 'FEDORA-2011-5589', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058752.html'}, {'name': 'GLSA-201204-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201204-06.xml'}, {'name': '48817', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48817'}, {'name': 'MDVSA-2011:086', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:086'}]
CVE State: PUBLISHED
Explain CVE-2011-1486
libvirtd in libvirt before 0.9.0 does not use thread-safe error reporting, which allows remote attackers to cause a denial of service (crash) by causing multiple threads to report errors at the same time.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/css/P8/documents/100134583'}, {'name': '44459', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44459'}, {'name': 'RHSA-2011:0479', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0479.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=f44bfb7fb978c9313ce050a1c4149bf04aa0a670'}, {'name': '1025477', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1025477'}, {'name': '47148', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47148'}, {'name': 'USN-1152-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1152-1'}, {'name': 'RHSA-2011:0478', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-0478.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=693391'}, {'name': '[libvirt] 20110323 [PATCH] Make error reporting in libvirtd thread safe', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://www.redhat.com/archives/libvir-list/2011-March/msg01087.html'}, {'name': 'DSA-2280', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2280'}]
CVE State: PUBLISHED
Explain CVE-2011-1487
The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=692844'}, {'name': 'SUSE-SR:2011:009', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html'}, {'name': 'FEDORA-2011-4610', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057891.html'}, {'name': '44168', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44168'}, {'name': '43921', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43921'}, {'name': 'DSA-2265', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2265'}, {'name': 'FEDORA-2011-4631', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057971.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336'}, {'name': '47124', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47124'}, {'name': '[oss-security] 20110404 Re: CVE Request -- perl -- lc(), uc() routines are laundering tainted data', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/04/35'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://perl5.git.perl.org/perl.git/commit/539689e74a3bcb04d29e4cd9396de91a81045b99'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=692898'}, {'name': 'MDVSA-2011:091', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:091'}, {'name': 'perl-laundering-security-bypass(66528)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66528'}, {'name': '[oss-security] 20110401 CVE Request -- perl -- lc(), uc() routines are laundering tainted data', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/01/3'}]
CVE State: PUBLISHED
Explain CVE-2011-1488
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker could use this flaw to cause a denial of the rsyslogd daemon service by crashing the service via a sequence of repeated log messages sent within short periods of time.
Affected Products: rsyslog
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2011-1488'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1488'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2011-1488'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/rsyslog/rsyslog/commit/1ef709cc97d54f74d3fdeb83788cc4b01f4c6a2a'}]
CVE State: PUBLISHED
Explain CVE-2011-1489
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset.
Affected Products: rsyslog
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2011-1489'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1489'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2011-1489'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/rsyslog/rsyslog/commit/1ef709cc97d54f74d3fdeb83788cc4b01f4c6a2a'}]
CVE State: PUBLISHED
Explain CVE-2011-1490
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset
Affected Products: rsyslog
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2011-1490'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1490'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2011-1490'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/rsyslog/rsyslog/commit/1ef709cc97d54f74d3fdeb83788cc4b01f4c6a2a'}]
CVE State: PUBLISHED
Explain CVE-2011-1491
The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an e-mail message, related to a "login CSRF" issue.
Affected Products: n/a
References: [{'name': '[oss-security] 20110324 CVE request: roundcube < 0.5.1 CSRF', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/03/24/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.roundcube.net/changeset/4490'}, {'name': '[oss-security] 20110324 Re: CVE request: roundcube < 0.5.1 CSRF', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/03/24/4'}, {'name': '[oss-security] 20110404 Re: CVE request: roundcube < 0.5.1 CSRF', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/04/50'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.roundcube.net/wiki/Changelog'}, {'name': 'roundcube-login-info-disclosure(66815)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66815'}]
CVE State: PUBLISHED
Explain CVE-2011-1492
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.
Affected Products: n/a
References: [{'name': '[oss-security] 20110324 CVE request: roundcube < 0.5.1 CSRF', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/03/24/3'}, {'name': '44050', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44050'}, {'name': '[oss-security] 20110324 Re: CVE request: roundcube < 0.5.1 CSRF', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/03/24/4'}, {'name': 'roundcube-modcss-security-bypass(66613)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66613'}, {'name': '[oss-security] 20110404 Re: CVE request: roundcube < 0.5.1 CSRF', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/04/50'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.roundcube.net/wiki/Changelog'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.roundcube.net/changeset/4488'}]
CVE State: PUBLISHED
Explain CVE-2011-1493
Array index error in the rose_parse_national function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by composing FAC_NATIONAL_DIGIS data that specifies a large number of digipeaters, and then sending this data to a ROSE socket.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/be20250c13f88375345ad99950190685eda51eb8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=be20250c13f88375345ad99950190685eda51eb8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=770777'}, {'name': '[oss-security] 20110405 Re: CVE request: kernel: multiple issues in ROSE', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2011/04/05/19'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39'}, {'name': 'SUSE-SU-2015:0812', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1494
Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
Affected Products: n/a
References: [{'name': '[linux-kernel] 20110405 [PATCH] drivers/scsi/mpt2sas: prevent heap overflows and unchecked reads', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lkml.org/lkml/2011/4/5/327'}, {'name': '[oss-security] 20110405 CVE request: kernel: two issues in mpt2sas', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/05/32'}, {'name': '20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/520102/100/0/threaded'}, {'name': '46397', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/46397'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=694021'}, {'name': '[oss-security] 20110406 Re: CVE request: kernel: two issues in mpt2sas', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/06/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://patchwork.kernel.org/patch/688021/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0012.html'}, {'name': 'RHSA-2011:0833', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2011-0833.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://downloads.avaya.com/css/P8/documents/100145416'}, {'name': '47185', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47185'}, {'name': 'SUSE-SU-2015:0812', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1495
drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
Affected Products: n/a
References: [{'name': '[linux-kernel] 20110405 [PATCH] drivers/scsi/mpt2sas: prevent heap overflows and unchecked reads', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lkml.org/lkml/2011/4/5/327'}, {'name': '[oss-security] 20110405 CVE request: kernel: two issues in mpt2sas', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/05/32'}, {'name': '20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/520102/100/0/threaded'}, {'name': '46397', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/46397'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=694021'}, {'name': '[oss-security] 20110406 Re: CVE request: kernel: two issues in mpt2sas', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/06/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://patchwork.kernel.org/patch/688021/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0012.html'}, {'name': 'RHSA-2011:0833', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2011-0833.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://downloads.avaya.com/css/P8/documents/100145416'}, {'name': '47185', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47185'}, {'name': 'SUSE-SU-2015:0812', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1496
tmux 1.3 and 1.4 does not properly drop group privileges, which allows local users to gain utmp group privileges via a filename to the -S command-line option.
Affected Products: n/a
References: [{'name': 'ADV-2011-1015', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/1015'}, {'name': '44081', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44081'}, {'name': '44239', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44239'}, {'name': '17147', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/17147'}, {'name': 'FEDORA-2011-5156', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058452.html'}, {'name': '47283', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47283'}, {'name': 'DSA-2212', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2212'}, {'name': 'ADV-2011-0897', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0897'}, {'name': 'ADV-2011-1002', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/1002'}, {'name': 'FEDORA-2011-5486', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058548.html'}, {'name': 'FEDORA-2011-5167', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058367.html'}, {'name': 'tmux-setgid-privilege-escalation(66693)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66693'}]
CVE State: PUBLISHED
Explain CVE-2011-1497
A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.
Affected Products: rails
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.openwall.com/lists/oss-security/2011/04/06/13'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/rails/rails/blob/38df020c95beca7e12f0188cb7e18f3c37789e20/actionpack/CHANGELOG'}]
CVE State: PUBLISHED
Explain CVE-2011-1498
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
Affected Products: n/a
References: [{'name': '[httpclient-users] 20110224 Proxy-Authorization header received on server side', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=httpclient-users&m=129853896315461&w=2'}, {'name': '[oss-security] 20110408 Re: Apache HttpClient CVE request  [VU#153049]', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/08/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=709531'}, {'name': '[httpclient-users] 20110224 Re: Proxy-Authorization header received on server side', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=httpclient-users&m=129856318011586&w=2'}, {'name': '[httpclient-users] 20110224 RE: Proxy-Authorization header received on server side', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=httpclient-users&m=129857589129183&w=2'}, {'name': '[oss-security] 20110407 Apache HttpClient CVE request  [VU#153049]', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/07/7'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/jira/browse/HTTPCLIENT-1061'}, {'name': 'VU#153049', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/153049'}, {'name': '46974', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46974'}, {'name': '[httpclient-users] 20110224 Re: Proxy-Authorization header received on server side', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=httpclient-users&m=129858274406594&w=2'}, {'name': '8298', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8298'}, {'name': 'FEDORA-2011-7747', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061440.html'}, {'name': '[httpclient-users] 20110224 RE: Proxy-Authorization header received on server side', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=httpclient-users&m=129858299106950&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.1.x.txt'}]
CVE State: PUBLISHED
Explain CVE-2011-1499
acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=621493'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=694658'}, {'name': '44274', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44274'}, {'name': '[oss-security] 20110408 Re: CVE request: tinyproxy runs as an open proxy when attempting to restrict allowable IP ranges', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/08/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://banu.com/cgit/tinyproxy/diff/?id=e8426f6662dc467bd1d827100481b95d9a4a23e4'}, {'name': 'tinyproxy-aclc-sec-bypass(67256)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/67256'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://banu.com/bugzilla/show_bug.cgi?id=90'}, {'name': 'DSA-2222', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2222'}, {'name': '[oss-security] 20110407 CVE request: tinyproxy runs as an open proxy when attempting to restrict allowable IP ranges', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/07/9'}]
CVE State: PUBLISHED
Explain CVE-2011-1500
PreferencesPithosDialog.py in Pithos 0.3.7 does not properly restrict permissions for the .config/pithos.ini file in a user's home directory, which allows local users to obtain Pandora credentials by reading this file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/pithos/+bug/733307'}, {'name': '44059', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44059'}, {'name': 'pithos-pithos-info-disclosure(66661)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66661'}, {'name': '[oss-security] 20110408 Re: CVE request for pithos information disclosure', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/08/4'}, {'name': '47300', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47300'}, {'name': '[oss-security] 20110408 CVE request for pithos information disclosure', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/08/2'}]
CVE State: PUBLISHED
Explain CVE-2011-1502
Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.liferay.com/browse/LPS-14927'}, {'name': '[oss-security] 20110408 Re: CVE requests : Liferay 6.0.6', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/08/5'}, {'name': '[oss-security] 20110411 Re: CVE requests : Liferay 6.0.6', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/11/9'}, {'name': '[oss-security] 20110329 CVE requests : Liferay 6.0.6', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/03/29/1'}]
CVE State: PUBLISHED
Explain CVE-2011-1503
The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.
Affected Products: n/a
References: [{'name': '[oss-security] 20110408 Re: CVE requests : Liferay 6.0.6', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/08/5'}, {'name': '[oss-security] 20110411 Re: CVE requests : Liferay 6.0.6', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/11/9'}, {'name': '[oss-security] 20110329 CVE requests : Liferay 6.0.6', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/03/29/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.liferay.com/browse/LPS-13762'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952'}]
CVE State: PUBLISHED
Explain CVE-2011-1504
Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA allows remote authenticated users to inject arbitrary web script or HTML via a blog title.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.liferay.com/browse/LPS-11506'}, {'name': '[oss-security] 20110408 Re: CVE requests : Liferay 6.0.6', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/08/5'}, {'name': '[oss-security] 20110411 Re: CVE requests : Liferay 6.0.6', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/04/11/9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://issues.liferay.com/browse/LPS-12145'}, {'name': '[oss-security] 20110329 CVE requests : Liferay 6.0.6', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/03/29/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952'}]
CVE State: PUBLISHED
Explain CVE-2011-1505
Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.27 services for Lotus Domino has unknown impact and attack vectors, aka SPR ESEO8DQME2.
Affected Products: n/a
References: [{'name': 'ibm-lotusquickr-unspecified(66142)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66142'}, {'name': '43689', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43689'}, {'name': 'LO58209', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1LO58209'}, {'name': '46903', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46903'}, {'name': '1025228', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1025228'}, {'name': 'ADV-2011-0707', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0707'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27013341'}]
CVE State: PUBLISHED
Explain CVE-2011-1506
The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kb.cert.org/vuls/id/MAPG-8D9M4P'}, {'name': 'multiple-starttls-command-execution(65932)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/65932'}, {'name': 'ADV-2011-0610', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0610'}, {'name': '46767', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46767'}, {'name': 'VU#555316', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/555316'}, {'name': '43678', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43678'}]
CVE State: PUBLISHED
Explain CVE-2011-1507
Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial of service (file descriptor exhaustion and disk space exhaustion) via a series of TCP connections.
Affected Products: n/a
References: [{'name': 'ADV-2011-1188', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/1188'}, {'name': 'FEDORA-2011-5835', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058922.html'}, {'name': 'DSA-2225', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2225'}, {'name': '1025432', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1025432'}, {'name': 'ADV-2011-1086', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/1086'}, {'name': 'ADV-2011-1107', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/1107'}, {'name': '44529', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44529'}, {'name': 'FEDORA-2011-6208', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059702.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://downloads.digium.com/pub/security/AST-2011-005.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=698916'}, {'name': '44197', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44197'}]
CVE State: PUBLISHED
Explain CVE-2011-1508
Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, does not properly manage memory allocations for function pointers, which allows user-assisted remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Function Pointer Overwrite Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:14816', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14816'}, {'name': 'MS11-091', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-091'}]
CVE State: PUBLISHED
Explain CVE-2011-1509
The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Affected Products: n/a
References: [{'name': 'servicedesk-loginjs-security-bypass(69841)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/69841'}, {'name': '49636', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/49636'}, {'name': '8385', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8385'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp'}, {'name': '20110914 CORE-2011-0506 - Multiples Vulnerabilities in ManageEngine ServiceDesk Plus', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/519652/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2011-1510
Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter.
Affected Products: n/a
References: [{'name': 'servicedesk-solutionsearch-xss(69840)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/69840'}, {'name': '49636', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/49636'}, {'name': '8385', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8385'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp'}, {'name': '20110914 CORE-2011-0506 - Multiples Vulnerabilities in ManageEngine ServiceDesk Plus', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/519652/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2011-1511
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Products Suite 2.1.1 and 3.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to Administration.
Affected Products: n/a
References: [{'name': 'TA11-201A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA11-201A.html'}, {'name': '8254', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8254'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html'}]
CVE State: PUBLISHED
Explain CVE-2011-1512
Heap-based buffer overflow in xlssr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a malformed BIFF record in a .xls Excel spreadsheet attachment, aka SPR PRAD8E3HKR.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg21500034'}, {'name': '47962', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/47962'}, {'name': '20110524 CORE-2010-0908: Lotus Notes XLS viewer malformed BIFF record heap overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/518120/100/0/threaded'}, {'name': '44624', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/44624'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/content/LotusNotes-XLS-viewer-heap-overflow'}, {'name': '8263', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/8263'}, {'name': 'oval:org.mitre.oval:def:14203', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14203'}, {'name': 'lotus-notes-xlssr-bo(67619)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/67619'}]
CVE State: PUBLISHED
Explain CVE-2011-1513
Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107_config.php via a crafted MySQL server name.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/content/e107-cms-script-command-injection'}, {'name': '50339', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/50339'}, {'name': 'e107-cmd-command-execution(70921)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/70921'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.8/install_.php?r1=11931&r2=12376&pathrev=12376'}]
CVE State: PUBLISHED