Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2012-0389
Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4.26 and earlier, 5.x before 5.53, and 6.x before 6.03 allows remote attackers to inject arbitrary web script or HTML via the Username parameter.
Affected Products: n/a
References: [{'name': '47518', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47518'}, {'name': '1026519', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026519'}, {'name': '51401', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51401'}, {'name': '20120112 ME020567: MailEnable webmail cross-site scripting vulnerability CVE-2012-0389', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0090.html'}, {'name': '78242', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78242'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nerv.fi/CVE-2012-0389.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mailenable.com/kb/Content/Article.asp?ID=me020567'}, {'name': 'mailenable-forgottenpassword-xss(72380)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72380'}, {'name': '47562', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47562'}, {'name': '18447', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18447'}]
CVE State: PUBLISHED
Explain CVE-2012-0390
The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.
Affected Products: n/a
References: [{'name': '57260', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57260'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.isg.rhul.ac.uk/~kp/dtls.pdf'}, {'name': 'SUSE-SU-2014:0320', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0391
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Affected Products: n/a
References: [{'name': '18329', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18329'}, {'name': '20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://struts.apache.org/2.x/docs/version-notes-2311.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://struts.apache.org/2.x/docs/s2-008.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/jira/browse/WW-3668'}, {'name': '47393', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47393'}]
CVE State: PUBLISHED
Explain CVE-2012-0392
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
Affected Products: n/a
References: [{'name': '18329', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18329'}, {'name': '20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://struts.apache.org/2.x/docs/version-notes-2311.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://struts.apache.org/2.x/docs/s2-008.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt'}, {'name': '[dailydave] 20120106 Apache Struts', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.immunityinc.com/pipermail/dailydave/2012-January/000011.html'}, {'name': '47393', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47393'}]
CVE State: PUBLISHED
Explain CVE-2012-0393
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
Affected Products: n/a
References: [{'name': '18329', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18329'}, {'name': '20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://struts.apache.org/2.x/docs/version-notes-2311.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://struts.apache.org/2.x/docs/s2-008.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt'}, {'name': '47393', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47393'}]
CVE State: PUBLISHED
Explain CVE-2012-0394
The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors.  NOTE: the vendor characterizes this behavior as not "a security vulnerability itself.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://struts.apache.org/2.x/docs/version-notes-2311.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://struts.apache.org/2.x/docs/s2-008.html'}, {'name': '18329', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18329'}, {'name': '20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html'}, {'name': '31434', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31434'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt'}, {'name': '78276', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78276'}]
CVE State: PUBLISHED
Explain CVE-2012-0395
Buffer overflow in the server in EMC NetWorker 7.5.x and 7.6.x before 7.6.3 SP1 Cumulative Release build 851 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'name': '20120126 ESA-2012-005: EMC NetWorker buffer overflow vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/521374'}]
CVE State: PUBLISHED
Explain CVE-2012-0396
EMC Documentum xPlore 1.0, 1.1 before P07, and 1.2 does not properly enforce the requirement for BROWSE permission, which allows remote authenticated users to determine the existence of an object, or read object metadata, via a search.
Affected Products: n/a
References: [{'name': '51863', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51863'}, {'name': '1026639', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1026639'}, {'name': '20120203 ESA-2012-010: EMC Documentum xPlore information disclosure vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0020.html'}, {'name': 'emc-documentum-info-disc(72994)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72994'}, {'name': '47920', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47920'}]
CVE State: PUBLISHED
Explain CVE-2012-0397
Buffer overflow in EMC RSA SecurID Software Token Converter before 2.6.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'name': '20120305 ESA-2012-013: RSA SecurID(r) Software Token Converter buffer overflow vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/521885'}]
CVE State: PUBLISHED
Explain CVE-2012-0398
EMC Documentum eRoom before 7.4.4 does not properly validate session cookies, which allows remote attackers to hijack or replay sessions via unspecified vectors.
Affected Products: n/a
References: [{'name': '20120313 ESA-2012-012: EMC Documentum eRoom Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0057.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0399
Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '52557', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52557'}, {'name': '48484', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48484'}, {'name': '1026819', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026819'}, {'name': '80206', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80206'}, {'name': '20120318 ESA-2012-014: RSA enVision Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0081.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0400
EMC RSA enVision 4.x before 4.1 Patch 4 does not properly restrict the number of failed authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
Affected Products: n/a
References: [{'name': '52557', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52557'}, {'name': '48484', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48484'}, {'name': '1026819', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026819'}, {'name': '80207', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80207'}, {'name': 'envision-weak-security(74140)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74140'}, {'name': '20120318 ESA-2012-014: RSA enVision Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0081.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0401
Multiple SQL injection vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': '52557', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52557'}, {'name': '48484', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48484'}, {'name': 'envision-unspec-sql-injection(74137)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74137'}, {'name': '1026819', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026819'}, {'name': '20120318 ESA-2012-014: RSA enVision Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0081.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0402
EMC RSA enVision 4.x before 4.1 Patch 4 uses unspecified hardcoded credentials, which makes it easier for remote attackers to obtain access via unknown vectors.
Affected Products: n/a
References: [{'name': '52557', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52557'}, {'name': '48484', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48484'}, {'name': '1026819', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026819'}, {'name': 'envision-default-account(74138)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74138'}, {'name': '20120318 ESA-2012-014: RSA enVision Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0081.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0403
Directory traversal vulnerability in EMC RSA enVision 4.x before 4.1 Patch 4 allows remote authenticated users to have an unspecified impact via unknown vectors.
Affected Products: n/a
References: [{'name': '52557', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52557'}, {'name': '80210', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80210'}, {'name': '48484', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48484'}, {'name': '1026819', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026819'}, {'name': '20120318 ESA-2012-014: RSA enVision Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0081.html'}, {'name': 'envision-unspec-dir-traversal(74139)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74139'}]
CVE State: PUBLISHED
Explain CVE-2012-0404
Cross-site scripting (XSS) vulnerability in EMC Documentum eRoom before 7.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '20120313 ESA-2012-012: EMC Documentum eRoom Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0057.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0406
The DPA_Utilities.cProcessAuthenticationData function in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an AUTHENTICATECONNECTION command that (1) lacks a password field or (2) has an empty password.
Affected Products: n/a
References: [{'name': '20120418 ESA-2012-018: EMC Data Protection Advisor Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/522408/30/0/threaded'}, {'name': '18688', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18688/'}, {'name': '1026956', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026956'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/dpa_1-adv.txt'}]
CVE State: PUBLISHED
Explain CVE-2012-0407
Integer overflow in the DPA_Utilities library in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (infinite loop) via a negative 64-bit value in a certain size field.
Affected Products: n/a
References: [{'name': '20120418 ESA-2012-018: EMC Data Protection Advisor Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/522408/30/0/threaded'}, {'name': '18688', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18688/'}, {'name': '1026956', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026956'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/dpa_1-adv.txt'}]
CVE State: PUBLISHED
Explain CVE-2012-0409
Multiple buffer overflows in EMC AutoStart 5.3.x and 5.4.x before 5.4.3 allow remote attackers to cause a denial of service (agent crash) or possibly execute arbitrary code via crafted packets.
Affected Products: n/a
References: [{'name': '53682', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53682'}, {'name': '1027100', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027100'}, {'name': '20120522 ESA-2012-020: EMC AutoStart Multiple Buffer Overflow Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/522835'}]
CVE State: PUBLISHED
Explain CVE-2012-0410
Directory traversal vulnerability in WebAccess in Novell GroupWise before 8.03 allows remote attackers to read arbitrary files via the User.interface parameter.
Affected Products: n/a
References: [{'name': '1027217', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027217'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=712163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7000708'}]
CVE State: PUBLISHED
Explain CVE-2012-0411
Unspecified vulnerability in Novell iPrint Client before 5.82 allows remote attackers to execute arbitrary code via an op-client-interface-version action.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7008708'}]
CVE State: PUBLISHED
Explain CVE-2012-0414
Cross-site scripting (XSS) vulnerability in the Spacewalk service in SUSE Manager 1.2 for SUSE Linux Enterprise (SLE) 11 SP1 allows remote attackers to inject arbitrary web script or HTML via an image name.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=761165'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5145796.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.novell.com/security/cve/CVE-2012-0414.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0417
Integer overflow in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=740041'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7010770'}, {'name': '1027599', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027599'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.novell.com/Download?buildid=O5hTjIiMdMo~'}]
CVE State: PUBLISHED
Explain CVE-2012-0418
Unspecified vulnerability in the client in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7010771'}, {'name': '55729', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/55729'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.novell.com/Download?buildid=O5hTjIiMdMo~'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=752521'}]
CVE State: PUBLISHED
Explain CVE-2012-0419
Directory traversal vulnerability in the agent HTTP interfaces in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to read arbitrary files via directory traversal sequences in a request.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=756330'}, {'name': '20120921 DDIVRT-2012-42 Novell GroupWise Agents Arbitrary File Retrieval (CVE-2012-0419)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2012/Sep/161'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=756924'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7010772'}, {'name': '20120921 DDIVRT-2012-42 Novell GroupWise Agents Arbitrary File Retrieval (CVE-2012-0419)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-09/0106.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.novell.com/Download?buildid=O5hTjIiMdMo~'}]
CVE State: PUBLISHED
Explain CVE-2012-0420
zypp-refresh-wrapper in SUSE Zypper before 1.3.20 and 1.6.x before 1.6.166 allows local users to create files in arbitrary directories, or possibly have unspecified other impact, via a pathname in the ZYPP_LOCKFILE_ROOT environment variable.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=770630'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.novell.com/security/cve/CVE-2012-0420.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0421
The SUSE Audit Log Keeper daemon before 0.2.1-0.4.6.1 for SUSE Manager and Spacewalk uses world-readable permissions for /etc/auditlog-keeper.conf, which allows local users to obtain passwords by reading this file.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2012:0958', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00001.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/771335'}]
CVE State: PUBLISHED
Explain CVE-2012-0425
LanItems.ycp in save_y2logs in yast2-network before 2.24.4 in SUSE YaST writes cleartext Wi-Fi credentials to the y2log log file, which allows context-dependent attackers to obtain sensitive information by reading the (1) WIRELESS_WPA_PASSWORD or (2) WIRELESS_CLIENT_KEY_PASSWORD field.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.novell.com/security/cve/CVE-2012-0425.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=752464'}]
CVE State: PUBLISHED
Explain CVE-2012-0426
Race condition in sap_suse_cluster_connector before 1.0.0-0.8.1 in SUSE Linux Enterprise for SAP Applications 11 SP2 allows local users to have an unspecified impact via vectors related to a tmp/ directory.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=777453'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.novell.com/security/cve/CVE-2012-0426.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=778273'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.novell.com/Download?buildid=DshQViDsMLE~'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=778293'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=763793'}]
CVE State: PUBLISHED
Explain CVE-2012-0427
yast2-add-on-creator in SUSE inst-source-utils 2008.11.26 before 2008.11.26-0.9.1 and 2012.9.13 before 2012.9.13-0.8.1 allows local users to gain privileges via a crafted (1) file name or (2) directory name.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.novell.com/security/cve/CVE-2012-0427.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=604730'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.novell.com/Download?buildid=tGCXHQR48E4~'}]
CVE State: PUBLISHED
Explain CVE-2012-0428
Cross-site scripting (XSS) vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '1027911', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027911'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7011539'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=772899'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=3426981'}]
CVE State: PUBLISHED
Explain CVE-2012-0429
dhost in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote authenticated users to cause a denial of service (daemon crash) via crafted characters in an HTTP request.
Affected Products: n/a
References: [{'name': '1027912', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027912'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7011533'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=772895'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=3426981'}]
CVE State: PUBLISHED
Explain CVE-2012-0430
Unspecified vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote attackers to obtain an administrator cookie and bypass authorization checks via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7011538'}, {'name': '1027910', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027910'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=3426981'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=772898'}]
CVE State: PUBLISHED
Explain CVE-2012-0432
Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=3426981'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=785272'}]
CVE State: PUBLISHED
Explain CVE-2012-0433
The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data.
Affected Products: crowbar
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.suse.com/show_bug.cgi?id=783195'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.suse.com/security/cve/CVE-2012-0433/'}]
CVE State: PUBLISHED
Explain CVE-2012-0434
The server in Crowbar, as used in SUSE Cloud 1.0, uses weak permissions for the production.log file, which has unspecified impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.suse.com/support/update/announcement/2013/suse-ru-20130020-1.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=784857'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.novell.com/security/cve/CVE-2012-0434.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0435
SUSE WebYaST before 1.2 0.2.63-0.6.1 allows remote attackers to modify the hosts list, and subsequently conduct man-in-the-middle attacks, via a crafted /host request on TCP port 4984.
Affected Products: n/a
References: [{'name': 'VU#806908', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/806908'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.novell.com/security/cve/CVE-2012-0435.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=792712'}, {'name': 'SUSE-SU-2013:0053', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00008.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0439
An ActiveX control in gwcls1.dll in the client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code via (1) a pointer argument to the SetEngine method or (2) an XPItem pointer argument to an unspecified method.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=743674'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=712144'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-13-008/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/kb/doc.php?id=7011688'}]
CVE State: PUBLISHED
Explain CVE-2012-0440
Cross-site request forgery (CSRF) vulnerability in jsonrpc.cgi in Bugzilla 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 allows remote attackers to hijack the authentication of arbitrary users for requests that use the JSON-RPC API.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.bugzilla.org/security/3.4.13/'}, {'name': '47814', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47814'}, {'name': '1026623', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026623'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=718319'}, {'name': 'bugzilla-jsonrpc-csrf(72882)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72882'}]
CVE State: PUBLISHED
Explain CVE-2012-0441
The ASN.1 decoder in the QuickDER decoder in Mozilla Network Security Services (NSS) before 3.13.4, as used in Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10, allows remote attackers to cause a denial of service (application crash) via a zero-length item, as demonstrated by (1) a zero-length basic constraint or (2) a zero-length field in an OCSP response.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2012/mfsa2012-39.html'}, {'name': '49976', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49976'}, {'name': 'USN-1540-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1540-2'}, {'name': 'MDVSA-2012:088', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:088'}, {'name': 'oval:org.mitre.oval:def:16701', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16701'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=715073'}, {'name': '53798', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53798'}, {'name': 'DSA-2490', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2490'}, {'name': 'SUSE-SU-2012:0746', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html'}, {'name': 'openSUSE-SU-2012:0760', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html'}, {'name': '50316', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/50316'}, {'name': 'USN-1540-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1540-1'}]
CVE State: PUBLISHED
Explain CVE-2012-0442
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=705347'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=693399'}, {'name': 'DSA-2402', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2402'}, {'name': 'DSA-2400', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2400'}, {'name': 'SUSE-SU-2012:0198', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2012/mfsa2012-01.html'}, {'name': 'MDVSA-2012:013', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:013'}, {'name': 'DSA-2406', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2406'}, {'name': 'SUSE-SU-2012:0221', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.html'}, {'name': 'oval:org.mitre.oval:def:14678', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14678'}, {'name': 'openSUSE-SU-2012:0234', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0443
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=711651'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=665578'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=712169'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=695076'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=714600'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=684938'}, {'name': 'oval:org.mitre.oval:def:14444', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14444'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=713209'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=707051'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=696748'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=715662'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2012/mfsa2012-01.html'}, {'name': 'MDVSA-2012:013', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:013'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=712289'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=692817'}, {'name': 'openSUSE-SU-2012:0234', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0444
Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file.
Affected Products: n/a
References: [{'name': '48043', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48043'}, {'name': '48095', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48095'}, {'name': 'DSA-2402', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2402'}, {'name': '51753', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51753'}, {'name': 'oval:org.mitre.oval:def:14464', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14464'}, {'name': 'DSA-2400', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2400'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2012/mfsa2012-07.html'}, {'name': 'SUSE-SU-2012:0198', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.html'}, {'name': 'MDVSA-2012:013', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:013'}, {'name': 'DSA-2406', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2406'}, {'name': 'SUSE-SU-2012:0221', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.html'}, {'name': 'USN-1370-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1370-1'}, {'name': 'mozilla-nschildview-code-exec(72858)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72858'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=719612'}, {'name': 'openSUSE-SU-2012:0234', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0445
Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to bypass the HTML5 frame-navigation policy and replace arbitrary sub-frames by creating a form submission target with a sub-frame's name attribute.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=701071'}, {'name': 'mozilla-iframeelement-security-bypass(72835)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72835'}, {'name': '49055', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49055'}, {'name': '78735', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78735'}, {'name': 'MDVSA-2012:013', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:013'}, {'name': 'oval:org.mitre.oval:def:14907', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14907'}, {'name': '51765', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51765'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2012/mfsa2012-03.html'}, {'name': 'openSUSE-SU-2012:0234', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0446
Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to inject arbitrary web script or HTML via a (1) web page or (2) Firefox extension, related to improper enforcement of XPConnect security restrictions for frame scripts that call untrusted objects.
Affected Products: n/a
References: [{'name': '51752', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51752'}, {'name': '49055', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49055'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=705651'}, {'name': 'mozilla-xpconnect-xss(72837)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72837'}, {'name': 'MDVSA-2012:013', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:013'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2012/mfsa2012-05.html'}, {'name': 'openSUSE-SU-2012:0234', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html'}, {'name': 'oval:org.mitre.oval:def:14304', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14304'}]
CVE State: PUBLISHED
Explain CVE-2012-0447
Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize data for image/vnd.microsoft.icon images, which allows remote attackers to obtain potentially sensitive information by reading a PNG image that was created through conversion from an ICO image.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=710079'}, {'name': 'mozilla-mimagebuffersize-info-disclosure(72856)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72856'}, {'name': 'oval:org.mitre.oval:def:14912', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14912'}, {'name': '49055', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49055'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2012/mfsa2012-06.html'}, {'name': 'MDVSA-2012:013', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:013'}, {'name': 'openSUSE-SU-2012:0234', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0448
Bugzilla 2.x and 3.x before 3.4.14, 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 does not reject non-ASCII characters in e-mail addresses of new user accounts, which makes it easier for remote authenticated users to spoof other user accounts by choosing a similar e-mail address.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.bugzilla.org/security/3.4.13/'}, {'name': '47814', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47814'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=714472'}, {'name': '1026623', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026623'}, {'name': '51784', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51784'}, {'name': 'bugzilla-unspecified-spoofing(72877)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72877'}]
CVE State: PUBLISHED
Explain CVE-2012-0449
Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a malformed XSLT stylesheet that is embedded in a document.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2012/mfsa2012-08.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=701806'}, {'name': 'mozilla-xsltstylesheets-code-execution(72868)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72868'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=702466'}, {'name': 'DSA-2402', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2402'}, {'name': 'DSA-2400', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2400'}, {'name': 'SUSE-SU-2012:0198', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.html'}, {'name': 'MDVSA-2012:013', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:013'}, {'name': 'oval:org.mitre.oval:def:14618', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14618'}, {'name': 'DSA-2406', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2406'}, {'name': 'SUSE-SU-2012:0221', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.html'}, {'name': '51754', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51754'}, {'name': 'openSUSE-SU-2012:0234', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0450
Mozilla Firefox 4.x through 9.0 and SeaMonkey before 2.7 on Linux and Mac OS X set weak permissions for Firefox Recovery Key.html, which might allow local users to read a Firefox Sync key via standard filesystem operations.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2012/mfsa2012-09.html'}, {'name': 'oval:org.mitre.oval:def:14670', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14670'}, {'name': '78741', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78741'}, {'name': 'mozilla-keyhtml-info-disclosure(72869)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72869'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=716868'}, {'name': 'MDVSA-2012:013', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:013'}, {'name': 'openSUSE-SU-2012:0234', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html'}]
CVE State: PUBLISHED