Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2011-4100 State: PUBLISHED Published: 2011-11-03T15:00:00 Last Updated: 2024-08-06T23:53:32.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.3 does not initialize a certain variable, which allows remote attackers to cause a denial of service (application crash) via a malformed packet. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=750643 - http://www.securityfocus.com/bid/50479 - http://www.wireshark.org/security/wnpa-sec-2011-17.html - http://secunia.com/advisories/46644 - http://anonsvn
d/50479 - http://www.wireshark.org/security/wnpa-sec-2011-17.html - http://secunia.com/advisories/46644 - http://anonsvn.wireshark.org/viewvc?view=revision&revision=39140 - http://osvdb.org/76768 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14833 - http://openwall.com/lists/oss-security/2011/11/01/9 - https://exchange.xforce.ibmcloud.com/vulnerabilities/71090 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6351
CVE ID: CVE-2011-4101 State: PUBLISHED Published: 2011-11-03T15:00:00 Last Updated: 2024-08-06T23:53:32.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dissect_infiniband_common function in epan/dissectors/packet-infiniband.c in the Infiniband dissector in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.wireshark.org/security/wnpa-sec-2011-18.html - http://secunia.com/advisories/46644 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Ade
ttp://secunia.com/advisories/46644 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14760 - http://osvdb.org/76769 - http://anonsvn.wireshark.org/viewvc?view=revision&revision=39500 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6476 - http://openwall.com/lists/oss-security/2011/11/01/9 - https://exchange.xforce.ibmcloud.com/vulnerabilities/71091 - https://bugzilla.redhat.com/show_bug.cgi?id=750645 - http://www.securityfocus.com/bid/50481
CVE ID: CVE-2011-4102 State: PUBLISHED Published: 2011-11-03T15:00:00 Last Updated: 2024-08-07T00:01:50.294Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file parser in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (application crash) via a malformed file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=750648 - http://rhn.redhat.com/errata/RHSA-2013-0125.html - http://secunia.com/advisories/48947 - http://www.securityfocus.com/bid/50486 - http://secunia.com/advisories/4691
html - http://secunia.com/advisories/48947 - http://www.securityfocus.com/bid/50486 - http://secunia.com/advisories/46913 - http://anonsvn.wireshark.org/viewvc?view=revision&revision=39508 - http://www.wireshark.org/security/wnpa-sec-2011-19.html - http://osvdb.org/76770 - http://secunia.com/advisories/46644 - https://exchange.xforce.ibmcloud.com/vulnerabilities/71092 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15073 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6479 - http://openwall.com/lists/oss-security/2011/11/01/9
CVE ID: CVE-2011-4103 State: PUBLISHED Published: 2014-10-27T01:00:00 Last Updated: 2024-08-07T00:01:49.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=750658 - https://bitbucket.org/jespern/django-piston/commits/91bdaec89543/ - http://www.debian.org/security/2011/dsa-2344 - https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-relea
.debian.org/security/2011/dsa-2344 - https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/ - http://www.openwall.com/lists/oss-security/2011/11/01/10
CVE ID: CVE-2011-4104 State: PUBLISHED Published: 2014-10-27T01:00:00 Last Updated: 2024-08-07T00:01:49.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/django-tastypie/i2aNGDHTUBI - http://www.openwall.com/lists/oss-security/2011/11/02/7 - https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/ - https://github.com/toastdr
7 - https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/ - https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2 - http://www.openwall.com/lists/oss-security/2011/11/02/1
CVE ID: CVE-2011-4105 State: PUBLISHED Published: 2012-02-17T23:00:00 Last Updated: 2024-08-07T00:01:50.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: LightDM before 1.0.6 allows local users to change ownership of arbitrary files via a symlink attack on ~/.Xauthority. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-1262-1 - http://www.openwall.com/lists/oss-security/2011/11/02/9 - http://www.openwall.com/lists/oss-security/2011/11/02/10 - http://www.openwall.com/lists/oss-security/2011/11/02/6 - http://lists.freedesktop.org/archives/lightdm/2011-November/000178.html
CVE ID: CVE-2011-4106 State: PUBLISHED Published: 2013-10-26T16:00:00Z Last Updated: 2024-09-16T22:09:33.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/17872 - http://www.binarymoon.co.uk/2011/08/timthumb-2/ - http://markmaunder.com/201
http://www.exploit-db.com/exploits/17872 - http://www.binarymoon.co.uk/2011/08/timthumb-2/ - http://markmaunder.com/2011/08/02/technical-details-and-scripts-of-the-wordpress-timthumb-php-hack/ - http://www.openwall.com/lists/oss-security/2011/11/03/4 - http://www.exploit-db.com/exploits/17602 - http://code.google.com/p/timthumb/issues/detail?id=212 - http://markmaunder.com/2011/08/01/zero-day-vulnerability-in-many-wordpress-themes/
CVE ID: CVE-2011-4107 State: PUBLISHED Published: 2011-11-17T19:00:00 Last Updated: 2024-08-07T00:01:50.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/71108 - http://secunia.com/advisories/46447 - http://osvdb.org/76798 - http://lists.fedoraproject.org/pi
vulnerabilities/71108 - http://secunia.com/advisories/46447 - http://osvdb.org/76798 - http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html - http://www.openwall.com/lists/oss-security/2011/11/03/5 - http://seclists.org/fulldisclosure/2011/Nov/21 - http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php - http://www.debian.org/security/2012/dsa-2391 - http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html - http://www.securityfocus.com/bid/50497 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:198 - https://bugzilla.redhat.com/show_bug.cgi?id=751112 - http://securityreason.com/securityalert/8533 - http://www.open
98 - https://bugzilla.redhat.com/show_bug.cgi?id=751112 - http://securityreason.com/securityalert/8533 - http://www.openwall.com/lists/oss-security/2011/11/03/3 - http://www.wooyun.org/bugs/wooyun-2010-03185 - http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt - http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html
CVE ID: CVE-2011-4108 State: PUBLISHED Published: 2012-01-06T01:00:00 Last Updated: 2024-08-07T00:01:49.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/48528 - http://secunia.com/advisories/57260 - http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 - http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564 - http://lists.opensuse.org/op
ument.jsp?objectID=c03360041 - http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564 - http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html - http://www.mandriva.com/security/advisories?name=MDVSA-2012:006 - http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html - http://www.openssl.org/news/secadv_20120104.txt - http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html - http://rhn.redhat.com/errata/RHSA-2012-1308.html - http://rhn.redhat.com/errata/RHSA-2012-1307.html - http://www.isg.rhul.ac.uk/~kp/dtls.pdf - http://support.apple.com/kb/HT5784 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.ht
dtls.pdf - http://support.apple.com/kb/HT5784 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html - http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html - http://www.kb.cert.org/vuls/id/737740 - http://marc.info/?l=bugtraq&m=132750648501816&w=2 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:007 - http://rhn.redhat.com/errata/RHSA-2012-1306.html - http://marc.info/?l=bugtraq&m=134039053214295&w=2 - http://secunia.com/advisories/57353 - http://marc.info/?l=bugtraq&m=134039053214295&w=2 - http://marc.info/?l=bugtraq&m=133951357207000&w=2 - http://marc.info/?l=bugtraq&m=132750648501816&w=2 - http://h20000.www2.hp.com/bizsupport/TechSupp
=133951357207000&w=2 - http://marc.info/?l=bugtraq&m=132750648501816&w=2 - http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 - http://www.debian.org/security/2012/dsa-2390 - http://marc.info/?l=bugtraq&m=133951357207000&w=2 - http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc - https://security.paloaltonetworks.com/CVE-2011-4108
CVE ID: CVE-2011-4109 State: PUBLISHED Published: 2012-01-06T01:00:00 Last Updated: 2024-08-07T00:01:50.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/48528 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:006 - http://www.openssl.org/news/secadv_20120104.txt - http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html - http://rhn.redhat.com/errata/RHSA-2012-13
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html - http://rhn.redhat.com/errata/RHSA-2012-1308.html - http://rhn.redhat.com/errata/RHSA-2012-1307.html - http://support.apple.com/kb/HT5784 - http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html - http://www.kb.cert.org/vuls/id/737740 - http://marc.info/?l=bugtraq&m=132750648501816&w=2 - https://exchange.xforce.ibmcloud.com/vulnerabilities/72129 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:007 - http://rhn.redhat.com/errata/RHSA-2012-1306.html - http://marc.info/?l=bugtraq&m=134039053214295&w=2 - http://marc.info/?l=bugtraq&m=134039053214295&w=2 - http://marc.info/?l=bugtraq&m=132
?l=bugtraq&m=134039053214295&w=2 - http://marc.info/?l=bugtraq&m=134039053214295&w=2 - http://marc.info/?l=bugtraq&m=132750648501816&w=2 - http://www.debian.org/security/2012/dsa-2390 - http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc
CVE ID: CVE-2011-4110 State: PUBLISHED Published: 2012-01-27T15:00:00 Last Updated: 2024-08-07T00:01:50.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and "updating a negative key into a fully instantiated key." Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2011/11/15/363 - http://www.securityfocus.com/bid/50755 - http://www.ubuntu.com/usn/USN-1328-1 - http://www.ubuntu.com/usn/USN-1344-1 - http://www.openwall.com/lists/oss-
50755 - http://www.ubuntu.com/usn/USN-1328-1 - http://www.ubuntu.com/usn/USN-1344-1 - http://www.openwall.com/lists/oss-security/2011/11/22/5 - http://www.openwall.com/lists/oss-security/2011/11/21/19 - http://www.ubuntu.com/usn/USN-1324-1 - https://bugzilla.redhat.com/show_bug.cgi?id=751297 - http://secunia.com/advisories/47754 - http://www.openwall.com/lists/oss-security/2011/11/22/6 - http://marc.info/?l=bugtraq&m=139447903326211&w=2
CVE ID: CVE-2011-4111 State: PUBLISHED Published: 2014-02-26T15:00:00 Last Updated: 2024-08-07T00:01:49.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=751310 - http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log - http://git.qemu.org/?p=qemu.git%3Ba=log%3Bh=refs/heads/stable-1.0 - http://rhn.redhat.com/errata
able-0.15.git%3Ba=log - http://git.qemu.org/?p=qemu.git%3Ba=log%3Bh=refs/heads/stable-1.0 - http://rhn.redhat.com/errata/RHSA-2011-1777.html - http://rhn.redhat.com/errata/RHSA-2011-1801.html
CVE ID: CVE-2011-4112 State: PUBLISHED Published: 2012-05-17T10:00:00 Last Updated: 2024-08-07T00:01:50.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: The net subsystem in the Linux kernel before 3.1 does not properly restrict use of the IFF_TX_SKB_SHARING flag, which allows local users to cause a denial of service (panic) by leveraging the CAP_NET_ADMIN capability to access /proc/net/pktgen/pgctrl, and then using the pktgen package in conjunction with a bridge device for a VLAN interface. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=751006 - https://github.com/torvalds/linux/commit/550fd08c2cebad61c548def135f67
ps://bugzilla.redhat.com/show_bug.cgi?id=751006 - https://github.com/torvalds/linux/commit/550fd08c2cebad61c548def135f67aba284c6162 - http://downloads.avaya.com/css/P8/documents/100156038 - http://www.openwall.com/lists/oss-security/2011/11/21/4 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=550fd08c2cebad61c548def135f67aba284c6162 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1
CVE ID: CVE-2011-4113 State: PUBLISHED Published: 2012-02-17T23:00:00 Last Updated: 2024-08-07T00:01:50.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Views module before 6.x-2.13 for Drupal allows remote attackers to execute arbitrary SQL commands via vectors related to "filters/arguments on certain types of views with specific configurations of arguments." Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2011/11/04/3 - https://exchange.xforce.ibmcloud.com/vulnerabilities/71124 - http://www.securityfocus.com/bid/50500 - http://lists.fedoraproject.org/pipermail/package-announce/2011
bilities/71124 - http://www.securityfocus.com/bid/50500 - http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069499.html - http://drupal.org/node/1329898 - http://drupal.org/node/1329842 - http://www.osvdb.org/76809 - http://secunia.com/advisories/46680 - http://secunia.com/advisories/46962
CVE ID: CVE-2011-4114 State: PUBLISHED Published: 2012-01-13T18:00:00Z Last Updated: 2024-08-07T00:01:50.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: The par_mktmpdir function in the PAR::Packer module before 1.012 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program. NOTE: a similar vulnerability was reported for PAR, but this has been assigned a different CVE identifier. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2011-Dec
Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071091.html - https://bugzilla.redhat.com/show_bug.cgi?id=753955 - http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071099.html - http://www.openwall.com/lists/oss-security/2011/11/04/2 - https://rt.cpan.org/Public/Bug/Display.html?id=69560 - http://www.openwall.com/lists/oss-security/2011/11/04/4
CVE ID: CVE-2011-4115 State: PUBLISHED Published: 2020-01-31T17:12:44 Last Updated: 2024-08-07T00:01:49.976Z Vendors: Parallel::ForkManager Products: Parallel::ForkManager Problem Types: Other Description: Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2011/11/04/2 - http://www.openwall.com/lists/oss-security/2011/11/04/4 - https://rt.cpan.org/Public/Bug/Display.html?id=68298
CVE ID: CVE-2011-4116 State: PUBLISHED Published: 2020-01-31T17:12:40 Last Updated: 2024-08-07T00:01:50.528Z Vendors: File::Temp Products: File::Temp Problem Types: Other Description: _is_safe in the File::Temp module for Perl does not properly handle symlinks. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2011/11/04/2 - http://www.openwall.com/lists/oss-security/2011/11/04/4 - https://seclists.org/oss-sec/2011/q4/238 - https://rt.cpan.org/Public/Bug/Display.html?id=69106 - https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14
CVE ID: CVE-2011-4117 State: PUBLISHED Published: 2020-01-31T17:12:36 Last Updated: 2024-08-07T00:01:50.583Z Vendors: Batch::BatchRun Products: Batch::BatchRun Problem Types: Other Description: The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2011/11/04/2 - http://www.openwall.com/lists/oss-security/2011/11/04/4 - https://rt.cpan.org/Public/Bug/Display.html?id=69594
CVE ID: CVE-2011-4118 State: PUBLISHED Published: 2011-11-15T02:00:00Z Last Updated: 2024-09-17T02:47:30.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara before 1.4.1, when MNet (aka the Moodle network feature) is used, allows remote authenticated users to gain privileges via a jump to an XMLRPC target. Additional Analyst Notes: - CVE Program Container: References: - http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz - https://launchpad.net/mahara/+milestone/1.4.1 - http://mahara.org/interaction/forum/topic.php?id=4138 - http://openwall.com/lists/oss-security/2011/11/04/10 - http://www.debian.org/security/2011/dsa
forum/topic.php?id=4138 - http://openwall.com/lists/oss-security/2011/11/04/10 - http://www.debian.org/security/2011/dsa-2334 - http://openwall.com/lists/oss-security/2011/11/04/7 - http://secunia.com/advisories/46719 - https://bugs.launchpad.net/mahara/+bug/884223
CVE ID: CVE-2011-4119 State: PUBLISHED Published: 2021-10-26T12:11:15 Last Updated: 2024-08-07T00:01:50.576Z Vendors: n/a Products: caml-light Problem Types: CWE-377 Description: caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/oss-sec/2011/q4/249 - https://vuxml.freebsd.org/freebsd/9dde9dac-08f4-11e1-af36-003067b2972c.html - http://gnats.netbsd.org/45558
CVE ID: CVE-2011-4120 State: PUBLISHED Published: 2019-11-26T04:17:52 Last Updated: 2024-08-07T00:01:50.367Z Vendors: yubico-pam Products: yubico-pam Problem Types: Other Description: Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the account in question by providing a NULL value (pressing Ctrl-D keyboard sequence) as the password string. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CV
string. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2011-4120 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4120 - https://access.redhat.com/security/cve/cve-2011-4120 - https://www.openwall.com/lists/oss-security/2011/11/07/6
CVE ID: CVE-2011-4121 State: PUBLISHED Published: 2019-11-26T04:35:56 Last Updated: 2024-08-07T00:01:50.387Z Vendors: OpenSSL Products: OpenSSL extension of Ruby (Git trunk) Problem Types: Other Description: The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2011-4121 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-412
: - https://security-tracker.debian.org/tracker/CVE-2011-4121 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4121 - https://access.redhat.com/security/cve/cve-2011-4121 - http://www.openwall.com/lists/oss-security/2013/07/01/1
CVE ID: CVE-2011-4122 State: PUBLISHED Published: 2011-11-17T19:00:00 Last Updated: 2024-08-07T00:01:50.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in openpam_configure.c in OpenPAM before r478 on FreeBSD 8.1 allows local users to load arbitrary DSOs and gain privileges via a .. (dot dot) in the service_name argument to the pam_start function, as demonstrated by a .. in the -c option to kcheckpass. Additional Analyst Notes: - CVE Program Container: References: - http://stealth.openwall.net/xSports/pamslam - http://secunia.com/advisories/46756 - http://openwall.com/lists/oss-security/2011/12/07/3 - http://trac.des.no/openpam/changeset/478/