Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2011-2743 State: PUBLISHED Published: 2011-07-19T21:00:00 Last Updated: 2024-08-06T23:08:23.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php, or the (3) title or (4) body parameter to admin/help.php. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/8312 - https://exchange.xforce.ibmcloud.com/vulnerabilities/68563 - http://www.justanotherhacker.com/advisories/JAHx113.txt - http://www.securityfocus
.ibmcloud.com/vulnerabilities/68563 - http://www.justanotherhacker.com/advisories/JAHx113.txt - http://www.securityfocus.com/bid/48672 - http://www.ocert.org/advisories/ocert-2011-001.html - http://osvdb.org/73888 - http://www.securityfocus.com/archive/1/518890/100/0/threaded - http://osvdb.org/73887 - http://osvdb.org/73889 - http://secunia.com/advisories/45184
CVE ID: CVE-2011-2744 State: PUBLISHED Published: 2011-07-19T20:00:00 Last Updated: 2024-08-06T23:08:23.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/8312 - http://www.justanotherhacker.com/advisories/JAHx113.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/68564 - http://www.securityfocus.com/bid/48672 - http://www.ocert.org/advisories/ocert-2011-001.html
om/vulnerabilities/68564 - http://www.securityfocus.com/bid/48672 - http://www.ocert.org/advisories/ocert-2011-001.html - http://osvdb.org/73890 - http://www.securityfocus.com/archive/1/518890/100/0/threaded - http://www.openwall.com/lists/oss-security/2011/07/13/6 - http://www.openwall.com/lists/oss-security/2011/07/13/5 - http://secunia.com/advisories/45184
CVE ID: CVE-2011-2745 State: PUBLISHED Published: 2011-07-27T01:29:00 Last Updated: 2024-08-06T23:08:24.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/8314 - http://www.justanotherhacker.com/advisories/JAHx113.txt - http://www.securityfocus.com/bid/4867
com/securityalert/8314 - http://www.justanotherhacker.com/advisories/JAHx113.txt - http://www.securityfocus.com/bid/48672 - http://www.openwall.com/lists/oss-security/2011/07/13/6 - http://www.openwall.com/lists/oss-security/2011/07/13/5
CVE ID: CVE-2011-2746 State: PUBLISHED Published: 2011-08-29T15:00:00 Last Updated: 2024-08-06T23:08:24.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Kernel/Modules/AdminPackageManager.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.x before 2.4.11 and 3.x before 3.0.10 allows remote authenticated administrators to read arbitrary files via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/45894 - http://www.securityfocus.com/bid/49251 - http://www.osvdb.org/74602 - http://lists.opensuse.org/opensuse-updates/2011-09/msg00011.html - http://secunia.com/advisories/45701 - http://ot
602 - http://lists.opensuse.org/opensuse-updates/2011-09/msg00011.html - http://secunia.com/advisories/45701 - http://otrs.org/advisory/OSA-2011-03-en/
CVE ID: CVE-2011-2747 State: PUBLISHED Published: 2011-07-28T18:00:00 Last Updated: 2024-08-06T23:08:23.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Picasa before 3.6 Build 105.67 does not properly handle invalid properties in JPEG images, which allows remote attackers to execute arbitrary code via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/73980 - https://exchange.xforce.ibmcloud.com/vulnerabilities/68735 - http://secunia.com/advisories/45293 - http://picasa.google.com/support/bin/static.py?hl=en&page=release_notes.cs&from=53209&rd=1 - http://www.microsoft.com/technet/security/advisory/msvr11-008.mspx
CVE ID: CVE-2011-2748 State: PUBLISHED Published: 2011-08-15T21:00:00 Last Updated: 2024-08-06T23:08:23.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-1190-1 - http://redmine.pfsense.org/issues/1888 - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065176.html - http://secunia.com/advisories/45595 - http://lists.opensuse.org/opensuse-updates/2011-09/msg00014.ht
ember/065176.html - http://secunia.com/advisories/45595 - http://lists.opensuse.org/opensuse-updates/2011-09/msg00014.html - http://www.debian.org/security/2011/dsa-2292 - http://www.redhat.com/support/errata/RHSA-2011-1160.html - http://securitytracker.com/id?1025918 - http://secunia.com/advisories/45817 - http://www.securityfocus.com/bid/49120 - http://www.isc.org/files/release-notes/DHCP%204.1-ESV-R3.html - http://www.isc.org/files/release-notes/DHCP%203.1-ESV-R3_0.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/69139 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 - http://secunia.com/advisories/45582 - https://bugzilla.redhat.com/attachment.cgi?id=517665&ac
page=content&id=JSA10761 - http://secunia.com/advisories/45582 - https://bugzilla.redhat.com/attachment.cgi?id=517665&action=diff - http://secunia.com/advisories/45918 - http://www.isc.org/software/dhcp/advisories/cve-2011-2748 - http://security.gentoo.org/glsa/glsa-201301-06.xml - http://www.isc.org/files/release-notes/DHCP%204.2.2_0.html - http://secunia.com/advisories/45639 - https://bugzilla.redhat.com/show_bug.cgi?id=729382 - http://secunia.com/advisories/45629 - https://hermes.opensuse.org/messages/11695711 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:128 - http://secunia.com/advisories/46780
CVE ID: CVE-2011-2749 State: PUBLISHED Published: 2011-08-15T21:00:00 Last Updated: 2024-08-06T23:08:23.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-1190-1 - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065176.html - http://secunia.com/advisories/45595 - http://lists.opensuse.org/opensuse-updates/2011-09/msg00014.html - http://www.debian.org/security/2011
dvisories/45595 - http://lists.opensuse.org/opensuse-updates/2011-09/msg00014.html - http://www.debian.org/security/2011/dsa-2292 - http://www.redhat.com/support/errata/RHSA-2011-1160.html - http://securitytracker.com/id?1025918 - http://secunia.com/advisories/45817 - http://www.securityfocus.com/bid/49120 - http://www.isc.org/files/release-notes/DHCP%204.1-ESV-R3.html - http://www.isc.org/files/release-notes/DHCP%203.1-ESV-R3_0.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 - http://secunia.com/advisories/45582 - https://bugzilla.redhat.com/attachment.cgi?id=517665&action=diff - http://secunia.com/advisories/45918 - http://www.isc.org/software/dhcp/advisories/cve-201
nt.cgi?id=517665&action=diff - http://secunia.com/advisories/45918 - http://www.isc.org/software/dhcp/advisories/cve-2011-2748 - http://security.gentoo.org/glsa/glsa-201301-06.xml - http://www.isc.org/files/release-notes/DHCP%204.2.2_0.html - http://secunia.com/advisories/45639 - https://bugzilla.redhat.com/show_bug.cgi?id=729382 - http://secunia.com/advisories/45629 - https://hermes.opensuse.org/messages/11695711 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:128 - http://secunia.com/advisories/46780
CVE ID: CVE-2011-2750 State: PUBLISHED Published: 2011-07-17T20:00:00 Last Updated: 2024-08-06T23:08:23.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: NFRAgent.exe in Novell File Reporter 1.0.4.2 and earlier allows remote attackers to delete arbitrary files via a full pathname in an SRS OPERATION 4 CMD 5 request to /FSF/CMD. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1025716 - http://secunia.com/advisories/45071 - http://aluigi.org/adv/nfr_2-adv.txt - http://www.securityfocus.com/archive/1/518626/100/0/threaded - http://securityreason.com/securityalert/8309
CVE ID: CVE-2011-2751 State: PUBLISHED Published: 2011-07-17T20:00:00Z Last Updated: 2024-09-16T20:32:25.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Parodia before 6.809 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/246310 - http://secunia.com/advisories/45093
CVE ID: CVE-2011-2752 State: PUBLISHED Published: 2011-07-17T20:00:00 Last Updated: 2024-08-06T23:08:23.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \n (newline) character, a different vulnerability than CVE-2010-4555. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2011/dsa-2291 - https://exchange.xforce.ibmcloud.com/vulnerabilities/68587 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:123 - http://www.squirrelmail.org/security/issue/2011-07-11 - http://rhn.redhat.com/errata/RHSA-2012
ies?name=MDVSA-2011:123 - http://www.squirrelmail.org/security/issue/2011-07-11 - http://rhn.redhat.com/errata/RHSA-2012-0103.html
CVE ID: CVE-2011-2753 State: PUBLISHED Published: 2011-07-17T20:00:00 Last Updated: 2024-08-06T23:08:24.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka options_order) page, a different issue than CVE-2010-4555. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2011/dsa-2291 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:123 - http://squirrelmail.svn.sourceforge.net/
11/dsa-2291 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:123 - http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119 - https://bugzilla.redhat.com/show_bug.cgi?id=720694 - http://rhn.redhat.com/errata/RHSA-2012-0103.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/68586
CVE ID: CVE-2011-2754 State: PUBLISHED Published: 2011-07-17T20:00:00Z Last Updated: 2024-09-16T18:38:36.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the PageBuilder2 (aka Page Builder) theme in IBM WebSphere Portal 7.x before 7.0.0.1 CF006, as used in IBM Web Content Manager (WCM) and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/45106 - http://www.ibm.com/support/docview.wss?uid=swg21503959
CVE ID: CVE-2011-2755 State: PUBLISHED Published: 2011-07-17T20:00:00Z Last Updated: 2024-09-16T23:36:27.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/543310
CVE ID: CVE-2011-2756 State: PUBLISHED Published: 2011-07-17T20:00:00Z Last Updated: 2024-09-16T19:51:57.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 does not require authentication, which allows remote attackers to read files from a specific directory via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/543310
CVE ID: CVE-2011-2757 State: PUBLISHED Published: 2011-07-17T20:00:00Z Last Updated: 2024-09-16T22:50:37.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the FILENAME parameter. NOTE: this might overlap the US-CERT VU#543310 issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/17503/
CVE ID: CVE-2011-2758 State: PUBLISHED Published: 2011-07-17T20:00:00Z Last Updated: 2024-09-16T22:08:50.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: IDSWebApp in the Web Administration Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.3-TIV-ITDS-IF0004 does not require authentication for access to LDAP Server log files, which allows remote attackers to obtain sensitive information via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/45107 - http://www.ibm.com/support/docview.wss?uid=swg24030320 - http://www.ibm.com/support/docview.wss?uid=swg1IO14060 - http://www.securityfocus.com/bid/48512 - http://www
g24030320 - http://www.ibm.com/support/docview.wss?uid=swg1IO14060 - http://www.securityfocus.com/bid/48512 - http://www.ibm.com/support/docview.wss?crawler=1&uid=swg1IO14060
CVE ID: CVE-2011-2759 State: PUBLISHED Published: 2011-07-17T20:00:00 Last Updated: 2024-08-06T23:08:23.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: The login page of IDSWebApp in the Web Administration Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.3-TIV-ITDS-IF0004 does not have an off autocomplete attribute for authentication fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg1IO14165 - http://www.ibm.com/support/docview.wss?uid=swg24030320 - https://exchange.xforce.ibmcloud.com/vulnerabiliti
wg1IO14165 - http://www.ibm.com/support/docview.wss?uid=swg24030320 - https://exchange.xforce.ibmcloud.com/vulnerabilities/68585 - http://www.ibm.com/support/docview.wss?crawler=1&uid=swg1IO14165
CVE ID: CVE-2011-2760 State: PUBLISHED Published: 2011-07-17T20:00:00 Last Updated: 2024-08-06T23:08:23.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: Brocade BigIron RX switches allow remote attackers to bypass ACL rules by using 179 as the source port of a packet. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/68535 - http://osvdb.org/73869 - http://secunia.com/advisories/45217 - http://www.securityfocus.com/bid/48663 - http://www.kb.cert.org/vuls/id/853246
CVE ID: CVE-2011-2761 State: PUBLISHED Published: 2011-07-18T22:00:00 Last Updated: 2024-08-06T23:15:30.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome 14.0.794.0 does not properly handle a reload of a page generated in response to a POST, which allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web site, related to GetWidget methods. Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13889 - http://code.google.com/p/chromium/issues/detail?id=86119 - http://src.chromium.org/viewvc/chrome?view=rev&revision=89409 -
p://code.google.com/p/chromium/issues/detail?id=86119 - http://src.chromium.org/viewvc/chrome?view=rev&revision=89409 - https://exchange.xforce.ibmcloud.com/vulnerabilities/68857 - http://codereview.chromium.org/7189019 - http://googlechromereleases.blogspot.com/2011/06/dev-channel-update_16.html
CVE ID: CVE-2011-2762 State: PUBLISHED Published: 2011-09-02T16:00:00 Last Updated: 2024-08-06T23:15:30.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) allows remote attackers to bypass authentication via unspecified data associated with a "true" authentication status, related to AMF data and the LSRoom_Remoting.authenticate function in gateway.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/49330 - https://exchange.xforce.ibmcloud.com/vulnerabilities/69445 - http://www.securityfocus.com/archive/1/519463/100/0/threaded - http://www.kb.cert.org/vuls/id/2134
lnerabilities/69445 - http://www.securityfocus.com/archive/1/519463/100/0/threaded - http://www.kb.cert.org/vuls/id/213486 - http://securityreason.com/securityalert/8364 - http://www.securestate.com/Documents/LifeSize_Room_Advisory.txt
CVE ID: CVE-2011-2763 State: PUBLISHED Published: 2011-09-02T16:00:00 Last Updated: 2024-08-06T23:15:30.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) and 4.7.18 allows remote attackers to execute arbitrary commands via a modified request to the LSRoom_Remoting.doCommand function in gateway.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/69444 - http://www.exploit-db.com/exploits/17743 - http://securityreason.com/securityalert/8527 - http://www.securityfocus.com/bid/49330 - http://www.securityfocus.com/archive/1/519463/100/0/threaded -
rityalert/8527 - http://www.securityfocus.com/bid/49330 - http://www.securityfocus.com/archive/1/519463/100/0/threaded - http://www.kb.cert.org/vuls/id/213486 - http://www.securestate.com/Documents/LifeSize_Room_Advisory.txt - http://securityreason.com/securityalert/8363
CVE ID: CVE-2011-2764 State: PUBLISHED Published: 2011-08-04T01:00:00 Last Updated: 2024-08-06T23:15:30.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.html - http://svn.icculus.org/q
tainer: References: - http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.html - http://svn.icculus.org/quake3?view=rev&revision=2098 - http://secunia.com/advisories/45540 - https://exchange.xforce.ibmcloud.com/vulnerabilities/68870 - http://secunia.com/advisories/45539 - https://bugzilla.redhat.com/show_bug.cgi?id=725951 - http://thilo.tjps.eu/download/patches/ioq3-svn-r2098.diff - http://www.securityfocus.com/bid/48915 - http://www.securityfocus.com/archive/1/519051/100/0/threaded - http://securityreason.com/securityalert/8324 - https://security.gentoo.org/glsa/201706-23 - http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063460.html
CVE ID: CVE-2011-2765 State: PUBLISHED Published: 2018-08-20T13:00:00Z Last Updated: 2024-09-16T19:00:40.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/irmen/Pyro3/commit/554e095a62c4412c91f981e72fd34a936ac2bf1e - https://pythonhosted.org/Pyro/12-changes.html - https://bugs.debian.org/631912
CVE ID: CVE-2011-2766 State: PUBLISHED Published: 2011-09-23T10:00:00 Last Updated: 2024-08-06T23:15:30.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2011/09/08/2 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479 - http://www.openwall.com/lists/oss-security/2011/09/08/1 - https://exchange.xforce.ibmcloud.com/vulner
t.cgi?bug=607479 - http://www.openwall.com/lists/oss-security/2011/09/08/1 - https://exchange.xforce.ibmcloud.com/vulnerabilities/69709 - https://bugzilla.redhat.com/show_bug.cgi?id=736604 - https://hermes.opensuse.org/messages/13155253 - https://rt.cpan.org/Public/Bug/Display.html?id=68380 - http://www.securityfocus.com/bid/49549 - https://hermes.opensuse.org/messages/13154637 - http://www.debian.org/security/2011/dsa-2327 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:001
CVE ID: CVE-2011-2767 State: PUBLISHED Published: 2018-08-26T16:00:00 Last Updated: 2024-08-06T23:15:30.814Z Vendors: n/a Products: mod_perl 2.0 through 2.0.10 Problem Types: code execution Description: mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian
runs Apache HTTP Server processes. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00018.html - http://www.securityfocus.com/bid/105195 - https://usn.ubuntu.com/3825-1/ - https://bugs.debian.org/644169 - https://access.redhat.com/errata/RHSA-2018:2826 - https://mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/raw/%3C20111004084343.GA21290%40ktnx.net%3E - https://access.redhat.com/errata/RHSA-2018:2825 - https://access.redhat.com/errata/RHSA-2018:2737 - https://usn.ubuntu.com/3825-2/ - https://lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d%40%3Cmodperl-cvs.perl.apache.org%
/lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d%40%3Cmodperl-cvs.perl.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.html
CVE ID: CVE-2011-2768 State: PUBLISHED Published: 2011-12-23T02:00:00 Last Updated: 2024-08-06T23:15:30.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had selected. Additional Analyst Notes: - CVE Program Container: References: - https://blog.torproject.org/blog/tor-02234-released-security-patches - http://www.debian.org/security/2011/dsa-2331