Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-4923 State: PUBLISHED Published: 2012-09-15T17:00:00 Last Updated: 2024-08-06T20:50:17.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Endian Firewall 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) createrule parameter to dnat.cgi, (2) addrule parameter to dansguardian.cgi, or (3) PATH_INFO to openvpn_users.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/73330 - http://www.securityfocus.com/bid/52076 - http://www.vulnerability-lab.com/get_content.php?id=436 - http://packetstormsecurity.org/files/10994
cus.com/bid/52076 - http://www.vulnerability-lab.com/get_content.php?id=436 - http://packetstormsecurity.org/files/109942/Endian-UTM-Firewall-2.4.x-Cross-Site-Scripting.html
CVE ID: CVE-2012-4924 State: PUBLISHED Published: 2012-09-15T17:00:00 Last Updated: 2024-08-06T20:50:18.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the CxDbgPrint function in the ipswcom.dll ActiveX component 1.0.0.1 for ASUS Net4Switch 1.0.0020 allows remote attackers to execute arbitrary code via a long parameter to the Alert method. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/48125 - http://www.securityfocus.com/bid/52110 - http://osvdb.org/79438 - https://exchange.xforce.ibmcloud.com/vulnerabilities/73384 - http://www.exploit-db.com/exploits/18538 - http://dsecrg.com/pages/vul/show.php?id=417
CVE ID: CVE-2012-4925 State: PUBLISHED Published: 2012-09-15T17:00:00 Last Updated: 2024-08-06T20:50:18.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in approve.php in Img Pals Photo Host 1.0 allow remote attackers to execute arbitrary SQL commands via the u parameter in a (1) app0 or (2) app1 action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/48182 - http://www.securityfocus.com/bid/52195 - http://www.exploit-db.com/exploits/18544 - http://archives.neohapsis.com/archives
tp://www.securityfocus.com/bid/52195 - http://www.exploit-db.com/exploits/18544 - http://archives.neohapsis.com/archives/bugtraq/2012-02/0180.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/73526 - http://www.osvdb.org/79670
CVE ID: CVE-2012-4926 State: PUBLISHED Published: 2012-09-15T17:00:00Z Last Updated: 2024-09-16T23:05:52.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u parameter in an (1) app0 (disable) or (2) app1 (enable) action. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/18544 - http://archives.neohapsis.com/archives/bugtraq/2012-02/0180.html
CVE ID: CVE-2012-4927 State: PUBLISHED Published: 2012-09-15T17:00:00 Last Updated: 2024-08-06T20:50:17.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/52114 - http://packetstormsecurity.org/files/110100/limesurvey-sql.txt - http://www.limesurvey.org/en/stable-release - http://www.exploit-db.com/exploits/18508 - http://secunia.com/advisories/48051 - https://exchange.xforce.ibmcloud.
ase - http://www.exploit-db.com/exploits/18508 - http://secunia.com/advisories/48051 - https://exchange.xforce.ibmcloud.com/vulnerabilities/73395 - http://osvdb.org/79459 - http://freecode.com/projects/limesurvey/releases/342070
CVE ID: CVE-2012-4928 State: PUBLISHED Published: 2012-09-15T17:00:00 Last Updated: 2024-08-06T20:50:17.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ow_updates/index.php in Oxwall 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the plugin parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/73399 - http://advisories.ariko-security.com/2012/audyt_bezpieczenstwa_2m2.html - http://packetstormsecurity.org/files/110046/Oxwall-1.1.1-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/52125
CVE ID: CVE-2012-4929 State: PUBLISHED Published: 2012-09-15T18:00:00 Last Updated: 2024-08-06T20:50:18.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugt
header, aka a "CRIME" attack. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=136612293908376&w=2 - http://rhn.redhat.com/errata/RHSA-2013-0587.html - http://www.debian.org/security/2012/dsa-2579 - https://gist.github.com/3696912 - http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091 - http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html - http://www.ubuntu.com/usn/USN-1898-1 - https://chromiumcodereview.appspot.com/10825183 - http://lists.opensuse.org/opensuse-updates/2012-10/msg00096.html - http://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-0913
p://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312 - http://www.debian.org/security/2015/dsa-3253 - http://isecpartners.com/blog/2012/9/14/details-on-the-crime-attack.html - http://lists.opensuse.org/opensuse-updates/2013-01/msg00048.html - https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls - https://github.com/mpgn/CRIME-poc - http://news.ycombinator.com/item?id=4510829 - http://support.apple.com/kb/HT5784 - http://www.theregister.co.uk/2012/09/14/crime_tls_attack/ - http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html - http://jvndb.jvn.jp/en/c
/crime_tls_attack/ - http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000129.html - http://www.ubuntu.com/usn/USN-1627-1 - http://www.debian.org/security/2013/dsa-2627 - http://code.google.com/p/chromium/issues/detail?id=139744 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18920 - http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/ - http://www.securityfocus.com/bid/55704 - http://www.ubuntu.com/usn/USN-1628-1 - https://threatpost.com/en_us/blogs/demo-crime-tls-attack-091212 - http://threatpost.com/en_us/blogs/new-attack-uses-ssltls-information-leak-hijack-ht
blogs/demo-crime-tls-attack-091212 - http://threatpost.com/en_us/blogs/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512 - http://www.ekoparty.org/2012/thai-duong.php - http://lists.opensuse.org/opensuse-updates/2013-01/msg00034.html - http://security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor - http://marc.info/?l=bugtraq&m=136612293908376&w=2 - http://jvn.jp/en/jp/JVN65273415/index.html - https://bugzilla.redhat.com/show_bug.cgi?id=857051
CVE ID: CVE-2012-4930 State: PUBLISHED Published: 2012-09-15T18:00:00 Last Updated: 2024-08-06T20:50:18.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.
ng in an HTTP header, aka a "CRIME" attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091 - http://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312 - http://isecpartners.com/blog/2012/9/14/details-on-the-crime-attack.html - https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls - http://www.theregister.co.uk/2012/09/14/crime_tls_attack/ - https://bugzilla.redhat.com/show_bug.cgi?id=857737 - http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/ - http://lists.opensuse.org/opensuse-se
d=857737 - http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/ - http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html - http://www.ekoparty.org/2012/thai-duong.php
CVE ID: CVE-2012-4932 State: PUBLISHED Published: 2012-12-28T11:00:00Z Last Updated: 2024-09-16T17:08:50.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in SimpleInvoices before stable-2012-1-CIS3000 allow remote attackers to inject arbitrary web script or HTML via (1) the having parameter in a manage action to index.php; (2) the Email field in an Add User action; (3) the Customer Name field in an Add Customer action; the (4) Street address, (5) Street address 2, (6) City, (7) Zip code, (8) State, (9) Country, (10) Mobile Phone, (11) Phone, (12) Fax, (13) Email, (14) PayPal business name, (15) PayPal notify url, (16) PayPal
ry, (10) Mobile Phone, (11) Phone, (12) Fax, (13) Email, (14) PayPal business name, (15) PayPal notify url, (16) PayPal return url, (17) Eway customer ID, (18) Custom field 1, (19) Custom field 2, (20) Custom field 3, or (21) Custom field 4 field in an Add Biller action; (22) the Customer field in an Add Invoice action; the (23) Invoice or (24) Notes field in a Process Payment action; (25) the Payment type description field in a Payment Types action; (26) the Description field in an Invoice Preferences action; (27) the Description field in a Manage Products action; or (28) the Description field in a Tax Rates action. Additional Analyst Notes: - CVE Program Container: References: - http://arc
the Description field in a Tax Rates action. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2012-12/0074.html
CVE ID: CVE-2012-4933 State: PUBLISHED Published: 2012-10-20T18:00:00 Last Updated: 2024-08-06T20:50:18.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rtrlet web application in the Web Console in Novell ZENworks Asset Management (ZAM) 7.5 uses a hard-coded username of Ivanhoe and a hard-coded password of Scott for the (1) GetFile_Password and (2) GetConfigInfo_Password operations, which allows remote attackers to obtain sensitive information via a crafted rtrlet/rtr request for the HandleMaintenanceCalls function. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1027682 - https://community.rapid7.com/community/metasploit/
Container: References: - http://www.securitytracker.com/id?1027682 - https://community.rapid7.com/community/metasploit/blog/2012/10/15/cve-2012-4933-novell-zenworks - https://exchange.xforce.ibmcloud.com/vulnerabilities/79252 - http://www.kb.cert.org/vuls/id/332412
CVE ID: CVE-2012-4934 State: PUBLISHED Published: 2012-10-31T10:00:00 Last Updated: 2024-08-06T20:50:18.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/86883 - http://www.kb.cert.org/vuls/id/207540 - http://www.securityfocus.com/bid/56333 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79696
CVE ID: CVE-2012-4935 State: PUBLISHED Published: 2012-11-18T21:00:00 Last Updated: 2024-08-06T20:50:18.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/79783 - http://www.kb.cert.org/vuls/id/802596 - http://www.securityfocus.com/bid/56381 - http://secunia.com/advisories/51203
CVE ID: CVE-2012-4936 State: PUBLISHED Published: 2012-11-18T21:00:00 Last Updated: 2024-08-06T20:50:18.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface in Pattern Insight 2.3 allows remote attackers to conduct clickjacking attacks via a FRAME element. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/802596 - http://www.securityfocus.com/bid/56381 - http://secunia.com/advisories/51203 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79784
CVE ID: CVE-2012-4937 State: PUBLISHED Published: 2012-11-18T21:00:00 Last Updated: 2024-08-06T20:50:18.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Session fixation vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack web sessions via a jsession_id cookie. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/802596 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79785 - http://www.securityfocus.com/bid/56381 - http://secunia.com/advisories/51203
CVE ID: CVE-2012-4938 State: PUBLISHED Published: 2012-11-18T21:00:00 Last Updated: 2024-08-06T20:50:18.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the web interface in Pattern Insight 2.3 allows remote authenticated administrators to inject arbitrary web script or HTML via the banner message. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/802596 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79786 - http://www.securityfocus.com/bid/56381 - http://secunia.com/advisories/51203
CVE ID: CVE-2012-4939 State: PUBLISHED Published: 2012-10-31T19:00:00Z Last Updated: 2024-09-17T03:52:52.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/203844
CVE ID: CVE-2012-4940 State: PUBLISHED Published: 2012-10-31T19:00:00 Last Updated: 2024-08-06T20:50:18.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. (dot dot) in (1) the fileName parameter in a download action to source/loggin/page_log_dwn_file.hsp, or the fileName parameter in (2) an edit action or (3) a delete action to the default URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/56343 - http://www.kb.cert.org/vuls/id/586556
CVE ID: CVE-2012-4941 State: PUBLISHED Published: 2012-11-18T21:00:00 Last Updated: 2024-08-06T20:50:18.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/427547 - http://www.securityfocus.com/bid/56427
CVE ID: CVE-2012-4942 State: PUBLISHED Published: 2012-11-18T21:00:00 Last Updated: 2024-08-06T20:50:18.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to inject arbitrary web script or HTML via an arbitrary text field. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/427547 - http://www.securityfocus.com/bid/56427
CVE ID: CVE-2012-4943 State: PUBLISHED Published: 2012-11-18T21:00:00 Last Updated: 2024-08-06T20:50:18.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to hijack the authentication of arbitrary users for requests that modify (1) passwords, (2) accounts, or (3) permissions. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/79854 - http://www.kb.cert.org/vuls/id/427547 - http://www.securityfocus.com/bid/56427
CVE ID: CVE-2012-4944 State: PUBLISHED Published: 2012-11-18T21:00:00 Last Updated: 2024-08-06T20:50:18.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unrestricted file upload vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary code by uploading a file via an unspecified page. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/427547 - http://www.securityfocus.com/bid/56427
CVE ID: CVE-2012-4945 State: PUBLISHED Published: 2012-11-18T21:00:00 Last Updated: 2024-08-06T20:50:18.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection" issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/427547 - http://www.securityfocus.com/bid/56427
CVE ID: CVE-2012-4946 State: PUBLISHED Published: 2012-11-18T21:00:00 Last Updated: 2024-08-06T20:50:18.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: Agile FleetCommander and FleetCommander Kiosk before 4.08 use an XOR format for password encryption, which makes it easier for context-dependent attackers to obtain sensitive information by reading a key file and the encrypted strings. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/427547 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79857 - http://www.securityfocus.com/bid/56427
CVE ID: CVE-2012-4947 State: PUBLISHED Published: 2012-11-18T21:00:00 Last Updated: 2024-08-06T20:50:18.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: Agile FleetCommander and FleetCommander Kiosk before 4.08 store database credentials in cleartext, which allows remote attackers to obtain sensitive information via requests to unspecified pages. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/79858 - http://www.kb.cert.org/vuls/id/427547 - http://www.securityfocus.com/bid/56427
CVE ID: CVE-2012-4948 State: PUBLISHED Published: 2012-11-14T11:00:00 Last Updated: 2024-08-06T20:50:18.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Fortinet_CA_SSLProxy certificate in a list of trusted root certification authorities. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/111708 - http://www.securityfocus.com/bid/56382 - http://osvdb.o
Container: References: - http://www.kb.cert.org/vuls/id/111708 - http://www.securityfocus.com/bid/56382 - http://osvdb.org/87048
CVE ID: CVE-2012-4949 State: PUBLISHED Published: 2012-11-14T11:00:00 Last Updated: 2024-08-06T20:50:18.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/79977 - http://www.kb.cert.org/vuls/id/795644
CVE ID: CVE-2012-4950 State: PUBLISHED Published: 2012-11-18T21:00:00 Last Updated: 2024-08-06T20:50:18.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Keyword Search page in the web interface in Pattern Insight 2.3 allows remote attackers to inject arbitrary web script or HTML via crafted characters that are not properly handled during construction of error messages. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/79787 - http://www.kb.cert.org/vuls/id/802596 - http://osvdb.org/87053 - http://www.securityfocus.com/bid/56381 - http://secunia.com/advisories/512
org/vuls/id/802596 - http://osvdb.org/87053 - http://www.securityfocus.com/bid/56381 - http://secunia.com/advisories/51203
CVE ID: CVE-2012-4951 State: PUBLISHED Published: 2012-11-15T11:00:00 Last Updated: 2024-08-06T20:50:18.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in terminal/paramedit.aspx in VeriFone VeriCentre Web Console before 2.2 build 36 allow remote attackers to execute arbitrary SQL commands via the (1) TerminalId, (2) ModelName, or (3) ApplicationName parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/180091 - http://www.clearskies.net/documents/css-advisory-css1211-vericentre.pdf - http://www.securityfocus.com/bid/56409 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79832
CVE ID: CVE-2012-4952 State: PUBLISHED Published: 2013-05-01T10:00:00Z Last Updated: 2024-09-16T19:37:04.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: Henry Schein Dentrix G5 before 15.1.294 has a single internal-database password that is shared across different customers' installations, which allows remote attackers to obtain sensitive information about patients by leveraging knowledge of this password from another installation. Additional Analyst Notes: - CVE Program Container: References: - http://www.dentrix.com/support/software-updates/g5.aspx - http://www.kb.cert.org/vuls/id/JALR-8ZRHUK - http://www.kb.cert.org/vuls/id/948155
CVE ID: CVE-2012-4953 State: PUBLISHED Published: 2012-11-14T11:00:00 Last Updated: 2024-08-06T20:50:18.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: The decomposer engine in Symantec Endpoint Protection (SEP) 11.0, Symantec Endpoint Protection Small Business Edition 12.0, Symantec AntiVirus Corporate Edition (SAVCE) 10.x, and Symantec Scan Engine (SSE) before 5.2.8 does not properly perform bounds checks of the contents of CAB archives, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.symantec.com/security_response