Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2011-1886 State: PUBLISHED Published: 2011-07-13T23:00:00 Last Updated: 2024-08-06T22:46:00.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3 does not properly validate the arguments to functions, which allows local users to read arbitrary data from kernel memory via a crafted application that triggers a NULL pointer dereference, aka "Win32k Incorrect Parameter Validation Allows Information Disclosure Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-054 - http://www.securityfocus.com/bid/48607
tps://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-054 - http://www.securityfocus.com/bid/48607 - http://support.avaya.com/css/P8/documents/100144947 - http://osvdb.org/73791 - http://www.us-cert.gov/cas/techalerts/TA11-193A.html - http://secunia.com/advisories/45186 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12778 - http://www.securitytracker.com/id?1025761
CVE ID: CVE-2011-1887 State: PUBLISHED Published: 2011-07-13T23:00:00 Last Updated: 2025-01-21T18:05:17.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Null Pointer De-reference Vulnerability." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/48601 - http://osvdb.org/73789 - ht
m Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/48601 - http://osvdb.org/73789 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-054 - http://support.avaya.com/css/P8/documents/100144947 - http://www.us-cert.gov/cas/techalerts/TA11-193A.html - http://secunia.com/advisories/45186 - http://www.securitytracker.com/id?1025761 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12711
CVE ID: CVE-2011-1888 State: PUBLISHED Published: 2011-07-13T23:00:00 Last Updated: 2024-08-06T22:46:00.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, a different vulnerability than other CVEs listed in MS11-054, aka "Win32k Null Pointer De-reference Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/73790 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/
m Container: References: - http://osvdb.org/73790 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-054 - http://support.avaya.com/css/P8/documents/100144947 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12898 - http://www.us-cert.gov/cas/techalerts/TA11-193A.html - http://secunia.com/advisories/45186 - http://www.securitytracker.com/id?1025761
CVE ID: CVE-2011-1889 State: PUBLISHED Published: 2011-06-16T20:21:00.000Z Last Updated: 2025-10-22T00:05:49.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka "TMG Firewall Client Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id?1025637 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-040 - https://exchange.xforce.ibmcloud.com/vulnerabili
.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-040 - https://exchange.xforce.ibmcloud.com/vulnerabilities/67736 - http://www.securityfocus.com/bid/48181 - http://secunia.com/advisories/44857 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12642
CVE ID: CVE-2011-1890 State: PUBLISHED Published: 2011-09-15T10:00:00 Last Updated: 2024-08-06T22:45:59.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in EditForm.aspx in Microsoft Office SharePoint Server 2010 and SharePoint Foundation 2010 allows remote attackers to inject arbitrary web script or HTML via a post, aka "Editform Script Injection Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12788 - http://www.us-cert.gov/cas/techale
val.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12788 - http://www.us-cert.gov/cas/techalerts/TA11-256A.html
CVE ID: CVE-2011-1891 State: PUBLISHED Published: 2011-09-15T10:00:00 Last Updated: 2024-08-06T22:45:59.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in a request to a script, aka "Contact Details Reflected XSS Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12864 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2
h/definition/oval%3Aorg.mitre.oval%3Adef%3A12864 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074 - http://www.us-cert.gov/cas/techalerts/TA11-256A.html
CVE ID: CVE-2011-1892 State: PUBLISHED Published: 2011-09-15T10:00:00 Last Updated: 2024-08-06T22:46:00.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, and Office Web Apps 2010 Gold and SP1 do not properly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users t
roperly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users to read arbitrary files via a crafted XML and XSL file, aka "SharePoint Remote File Disclosure Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074 - http://securityreason.com/securityalert/8386 - http://www.us-cert.gov/cas/techalerts/TA11-256A.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12907
CVE ID: CVE-2011-1893 State: PUBLISHED Published: 2011-09-15T10:00:00 Last Updated: 2024-08-06T22:46:00.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2010, Windows SharePoint Services 2.0 and 3.0 SP2, and SharePoint Foundation 2010 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "SharePoint XSS Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-074 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12676 - http://www.us-c
s11-074 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12676 - http://www.us-cert.gov/cas/techalerts/TA11-256A.html
CVE ID: CVE-2011-1894 State: PUBLISHED Published: 2011-06-16T20:21:00 Last Updated: 2024-08-06T22:46:00.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for embedded content in an HTML document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted EMBED element in a web page that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability." Additional Analyst Notes: - CVE Program Co
sited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/48205 - http://www.securitytracker.com/id?1025655 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12494 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-037
CVE ID: CVE-2011-1895 State: PUBLISHED Published: 2011-10-12T01:00:00 Last Updated: 2024-08-06T22:46:00.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting (XSS) attacks, via unspecified vectors, aka "ExcelTable Response Splitting XSS Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/49979 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-079 -
//www.securityfocus.com/bid/49979 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-079 - http://osvdb.org/76235 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13064
CVE ID: CVE-2011-1896 State: PUBLISHED Published: 2011-10-12T01:00:00 Last Updated: 2024-08-06T22:46:00.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "ExcelTable Reflected XSS Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12197 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-079 - http://osvdb.org/76233
CVE ID: CVE-2011-1897 State: PUBLISHED Published: 2011-10-12T01:00:00 Last Updated: 2024-08-06T22:45:59.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Default Reflected XSS Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13039 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-079
CVE ID: CVE-2011-1898 State: PUBLISHED Published: 2011-08-12T18:00:00 Last Updated: 2024-08-06T22:46:00.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges by "using DMA to generate MSI interrupts by writing to the interrupt injection registers." Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00018.html - http://xen.org/download/index_4.0.2.html - http://xen.1045712.n5.nabble.com/Xen-security-advisory-CVE-2011-1898-VT-d-PC
http://xen.org/download/index_4.0.2.html - http://xen.1045712.n5.nabble.com/Xen-security-advisory-CVE-2011-1898-VT-d-PCI-passthrough-MSI-td4390298.html - http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062139.html - http://www.invisiblethingslab.com/resources/2011/Software%20Attacks%20on%20Intel%20VT-d.pdf - http://theinvisiblethings.blogspot.com/2011/05/following-white-rabbit-software-attacks.html - http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00017.html - http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062112.html
CVE ID: CVE-2011-1899 State: PUBLISHED Published: 2011-05-16T17:00:00 Last Updated: 2024-08-06T22:46:00.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in CA eHealth 6.0.x, 6.1.x, 6.2.1, and 6.2.2 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/44482 - http://securitytracker.com/id?1025518 - http://securityreason.com/securityalert/8252 - http://www.securityfocus.com/archive/1/517956/100/0/threaded - http://www.securityfocus.com/bid/47795 - https://exchange.xforce.ibmcloud.com/vulnerabilitie
e/1/517956/100/0/threaded - http://www.securityfocus.com/bid/47795 - https://exchange.xforce.ibmcloud.com/vulnerabilities/67389 - https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B5662845D-4CD7-4CE6-8829-4F07A4C67366%7D
CVE ID: CVE-2011-1900 State: PUBLISHED Published: 2011-05-04T22:00:00Z Last Updated: 2024-09-17T01:02:03.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 6.1 and 7.x before 7.0+Patch 1 allows remote attackers to execute arbitrary code via an invalid request. Additional Analyst Notes: - CVE Program Container: References: - http://www.indusoft.com/hotfixes/hotfixes.php
CVE ID: CVE-2011-1901 State: PUBLISHED Published: 2011-05-05T14:00:00Z Last Updated: 2024-09-17T01:01:08.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mail-filter web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers to bypass authentication via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://support.proofpoint.com/article.cgi?article_id=338413 - http://www.kb.cert.org/vuls/id/790980 - http://www.clearskies.net/documents/css-advisory-css1105-proofpoint.php
CVE ID: CVE-2011-1902 State: PUBLISHED Published: 2011-05-05T14:00:00Z Last Updated: 2024-09-16T23:31:32.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://support.proofpoint.com/article.cgi?article_id=338413 - http://www.kb.cert.org/vuls/id/790980 - http://www.clearskies.net/documents/css-advisory-css1105-proofpoint.php
CVE ID: CVE-2011-1903 State: PUBLISHED Published: 2011-05-05T14:00:00Z Last Updated: 2024-09-16T16:53:55.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in an unspecified function in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://support.proofpoint.com/article.cgi?article_id=338413 - http://www.kb.cert.org/vuls/id/790980 - http://www.clearskies.net/documents/css-advisory-css1105-proofpoint.php
CVE ID: CVE-2011-1904 State: PUBLISHED Published: 2011-05-05T14:00:00Z Last Updated: 2024-09-16T18:29:12.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unspecified function in the web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers to execute arbitrary commands via unknown vectors, related to a "command injection" issue. Additional Analyst Notes: - CVE Program Container: References: - https://support.proofpoint.com/article.cgi?article_id=338413 - http://www.kb.cert.org/vuls/id/790980 - http://www.clearskies.net/documents/css-advisory-css1
le.cgi?article_id=338413 - http://www.kb.cert.org/vuls/id/790980 - http://www.clearskies.net/documents/css-advisory-css1105-proofpoint.php
CVE ID: CVE-2011-1905 State: PUBLISHED Published: 2011-05-05T14:00:00Z Last Updated: 2024-09-16T23:05:32.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified administrative modules in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allow remote attackers to hijack the authentication of administrators via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://support.proofpoint.com/article.cgi?article_id=338413 - http://www.kb.cert.org/vuls/id/790980 - http://www.clearskies.net
support.proofpoint.com/article.cgi?article_id=338413 - http://www.kb.cert.org/vuls/id/790980 - http://www.clearskies.net/documents/css-advisory-css1105-proofpoint.php
CVE ID: CVE-2011-1906 State: PUBLISHED Published: 2011-05-05T14:00:00Z Last Updated: 2024-09-16T17:48:45.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trustwave WebDefend Enterprise before 5.0 7.01.903-1.4 stores specific user-account credentials in a MySQL database, which makes it easier for remote attackers to read the event collection table via requests to the management port, a different vulnerability than CVE-2011-0756. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/spiderlabs/advisories/TWSL2011-001.txt - http://securitytracker.com/id?1025447
CVE ID: CVE-2011-1907 State: PUBLISHED Published: 2011-05-09T22:00:00 Last Updated: 2024-08-06T22:46:00.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: ISC BIND 9.8.x before 9.8.0-P1, when Response Policy Zones (RPZ) RRset replacement is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an RRSIG query. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1025503 - http://www.vupen.com/english/advisories/2011/1183 - http://secunia.com/advisories/44416 - http://www.securityfocus.com/bid/47734 - https://www.isc.org/CVE-2011-1907 - http://www.securityfocus.com/archive/1/517900/100/0/
w.securityfocus.com/bid/47734 - https://www.isc.org/CVE-2011-1907 - http://www.securityfocus.com/archive/1/517900/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/67297
CVE ID: CVE-2011-1908 State: PUBLISHED Published: 2011-06-24T20:00:00 Last Updated: 2024-08-06T22:46:00.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the Type 1 font decoder in the FreeType engine in Foxit Reader before 4.0.0.0619 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font in a PDF document. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/48359 - http://www.microsoft.com/technet/security/advisory/msvr11-005.mspx - https://exchange.xforce.ibmcloud.com/vulnerabilities/68145 - http://www.foxitsoftware.com/products/reader/security_bull
https://exchange.xforce.ibmcloud.com/vulnerabilities/68145 - http://www.foxitsoftware.com/products/reader/security_bulletins.php#freetype
CVE ID: CVE-2011-1910 State: PUBLISHED Published: 2011-05-31T20:00:00 Last Updated: 2024-08-06T22:46:00.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before 9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R4-P1 allows remote DNS servers to cause a denial of service (assertion failure and daemon exit) via a negative response containing large RRSIG RRsets. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/795694 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:104 - https://bugzilla.redhat.com/show_bug.cgi?id=708301 - http://secunia.co
iva.com/security/advisories?name=MDVSA-2011:104 - https://bugzilla.redhat.com/show_bug.cgi?id=708301 - http://secunia.com/advisories/44677 - http://www.securityfocus.com/bid/48007 - http://marc.info/?l=bugtraq&m=142180687100892&w=2 - http://secunia.com/advisories/44929 - http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.685026 - https://hermes.opensuse.org/messages/8699912 - http://secunia.com/advisories/44783 - http://secunia.com/advisories/44719 - http://www.debian.org/security/2011/dsa-2244 - http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061405.html - http://osvdb.org/72540 - http://secunia.com/advisories/44741 - http://lists.a
l/package-announce/2011-June/061405.html - http://osvdb.org/72540 - http://secunia.com/advisories/44741 - http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html - http://security.freebsd.org/advisories/FreeBSD-SA-11:02.bind.asc - http://www.redhat.com/support/errata/RHSA-2011-0845.html - http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061401.html - http://secunia.com/advisories/44744 - https://www.isc.org/software/bind/advisories/cve-2011-1910 - http://support.apple.com/kb/HT5002 - http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061082.html - http://marc.info/?l=bugtraq&m=142180687100892&w=2 - http://secunia.com/advisories/44762 - ht
nce/2011-June/061082.html - http://marc.info/?l=bugtraq&m=142180687100892&w=2 - http://secunia.com/advisories/44762 - http://secunia.com/advisories/44758 - http://www.securitytracker.com/id?1025572
CVE ID: CVE-2011-1911 State: PUBLISHED Published: 2011-09-20T10:00:00 Last Updated: 2024-08-06T22:45:59.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach. Additional Analyst Notes: - CVE Program Container: References: - http://www.csirtcv.gva.es/sites/all/files/images/content/%5BCSIRT-cv%5D%20JasperServer%203.7.0%20CE%20CSRF%20Advisory.pdf - http://www.csirtcv.gva.es/es/alertas/vulnerabilidad-en-jasperserver.html - https://exchange.xforce.i
RF%20Advisory.pdf - http://www.csirtcv.gva.es/es/alertas/vulnerabilidad-en-jasperserver.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/69849 - http://www.kb.cert.org/vuls/id/519588 - http://www.kb.cert.org/vuls/id/MAPG-8ELLJC - http://www.securityfocus.com/bid/49649