Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
article191-Tiki-Releases-8-4 - http://archives.neohapsis.com/archives/bugtraq/2012-07/0020.html - http://info.tiki.org/article190-Tiki-Wiki-CMS-Groupware-Updates-Tiki-6-7-LTS - http://dev.tiki.org/item4109
CVE ID: CVE-2012-3997 State: PUBLISHED Published: 2012-07-12T21:00:00Z Last Updated: 2024-09-16T22:10:34.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Sticky Notes before 0.2.27052012.5 allow remote attackers to inject arbitrary web script or HTML via the (1) paste_user or (2) paste_lang parameter to (a) list.php or (b) show.php. Additional Analyst Notes: - CVE Program Container: References: - http://gitorious.org/sticky-notes/sticky-notes/commit/d97475f07520d61af3d20fbaeb2e9a974c190308 - https://bugzilla.redhat.com/show_bug.cgi?id=810928 - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083120.html
lla.redhat.com/show_bug.cgi?id=810928 - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083120.html - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083169.html
CVE ID: CVE-2012-3998 State: PUBLISHED Published: 2012-07-12T21:00:00Z Last Updated: 2024-09-16T17:54:42.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Sticky Notes before 0.2.27052012.5 allow remote attackers to execute arbitrary SQL commands via the (1) paste id in admin/modules/mod_pastes.php or (2) show.php, (3) user id to admin/modules/mod_users.php, (4) project to list.php, or (5) session id to show.php. Additional Analyst Notes: - CVE Program Container: References: - http://gitorious.org/sticky-notes/sticky-notes/commit/d97475f07520d61af3d20fbaeb2e9a974c190308 - https://bugzilla.redhat.com/show_bug.cgi?id=810928 - http://lists
otes/commit/d97475f07520d61af3d20fbaeb2e9a974c190308 - https://bugzilla.redhat.com/show_bug.cgi?id=810928 - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083120.html - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083169.html
CVE ID: CVE-2012-3999 State: PUBLISHED Published: 2012-07-12T21:00:00 Last Updated: 2024-08-06T20:21:04.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/login.php in Sticky Notes 0.3.09062012.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/77138 - https://gitorious.org/sticky-notes/sticky-notes/merge_requests/2
CVE ID: CVE-2012-4000 State: PUBLISHED Published: 2012-07-12T21:00:00 Last Updated: 2024-08-06T20:21:04.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the print_textinputs_var function in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor 2.6.7 and earlier allows remote attackers to inject arbitrary web script or HTML via textinputs array parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2012/dsa-2522 - http://secunia.com/advisories/49606 - http://disse.cting.org/blog/2012/06/22/fckeditor-reflected-xss-vulnerability/ - https://exchange.x
om/advisories/49606 - http://disse.cting.org/blog/2012/06/22/fckeditor-reflected-xss-vulnerability/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/76604 - http://www.securityfocus.com/bid/54188
CVE ID: CVE-2012-4001 State: PUBLISHED Published: 2012-09-15T10:00:00Z Last Updated: 2024-09-17T04:14:54.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mod_pagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers. Additional Analyst Notes: - CVE Program Container: References: - https://developers.google.com/speed/docs/mod_pagespeed/CVE-2012-4001 - https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6
CVE ID: CVE-2012-4002 State: PUBLISHED Published: 2012-10-09T23:00:00 Last Updated: 2024-08-06T20:21:04.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in GLPI-PROJECT GLPI before 0.83.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/07/13/1 - https://forge.indepnet.net/issues/3707 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:132 - https://forge.indepnet.net/issues/3704 - https://forge.indepnet.net/projects/glpi/versions/771
CVE ID: CVE-2012-4003 State: PUBLISHED Published: 2012-10-09T23:00:00 Last Updated: 2024-08-06T20:21:04.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in GLPI-PROJECT GLPI before 0.83.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://forge.indepnet.net/issues/3705 - http://www.openwall.com/lists/oss-security/2012/07/13/1 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:132 - https://forge.indepnet.net/projects/glpi/versions/771
CVE ID: CVE-2012-4004 State: PUBLISHED Published: 2012-08-08T18:00:00Z Last Updated: 2024-09-16T23:35:27.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Sleipnir Mobile application 2.2.0 and earlier and Sleipnir Mobile Black Edition application 2.2.0 and earlier for Android allows remote attackers to inject arbitrary web script or HTML via a crafted application that interacts with an unspecified Sleipnir Mobile function. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=jp.co.fenrir.android.sleipnir_black - https://play.google.com/store/apps/details?id=jp.co.fenrir.and
ore/apps/details?id=jp.co.fenrir.android.sleipnir_black - https://play.google.com/store/apps/details?id=jp.co.fenrir.android.sleipnir - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000076 - http://jvn.jp/en/jp/JVN39519659/index.html
CVE ID: CVE-2012-4005 State: PUBLISHED Published: 2012-08-07T19:00:00Z Last Updated: 2024-09-16T18:19:44.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NHN Japan NAVER LINE application before 2.5.5 for Android does not properly handle implicit intents, which allows remote attackers to obtain sensitive message information via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://lineblog.naver.jp/archives/12893561.html - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000074 - http://jvn.jp/en/jp/JVN67435981/index.html
CVE ID: CVE-2012-4006 State: PUBLISHED Published: 2012-08-17T20:00:00Z Last Updated: 2024-09-16T17:43:44.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GREE application before 1.4.0, GREE Tanken Dorirando application before 1.0.7, GREE Tsurisuta application before 1.5.0, GREE Monpura application before 1.1.1, GREE Kaizokuoukoku Columbus application before 1.3.5, GREE haconiwa application before 1.1.0, GREE Seisen Cerberus application before 1.1.0, and KDDI&GREE GREE Market application before 2.1.2 for Android do not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application. Additional Analyst Notes: - CV
which allows remote attackers to obtain sensitive information via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000077 - http://jvn.jp/en/jp/JVN99192898/index.html
CVE ID: CVE-2012-4007 State: PUBLISHED Published: 2012-08-17T20:00:00Z Last Updated: 2024-09-17T02:31:26.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mixi application before 4.3.0 for Android allows remote attackers to read potentially sensitive information in friends' comments via a crafted application that leverages the storage of these comments on an SD card. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000078 - http://jvn.jp/en/jp/JVN92038939/index.html
CVE ID: CVE-2012-4008 State: PUBLISHED Published: 2012-08-31T14:00:00Z Last Updated: 2024-09-17T02:32:32.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - http://magazine.cybozulive.com/2012/08/291200.html - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000081 - http://jvn.jp/en/jp/JVN23009798/index.html
CVE ID: CVE-2012-4009 State: PUBLISHED Published: 2012-08-31T14:00:00Z Last Updated: 2024-09-17T00:46:35.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebView class in the Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN77393797/index.html - http://magazine.cybozulive.com/2012/08/291200.html - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000082
CVE ID: CVE-2012-4010 State: PUBLISHED Published: 2012-08-30T17:00:00Z Last Updated: 2024-09-17T00:51:11.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera before 11.60 allows remote attackers to spoof the address bar via unspecified homograph characters, a different vulnerability than CVE-2010-2660. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000080 - http://www.opera.com/docs/changelogs/windows/1160/ - http://jvn.jp/en/jp/JVN69880570/index.html
CVE ID: CVE-2012-4011 State: PUBLISHED Published: 2012-09-08T10:00:00Z Last Updated: 2024-09-16T22:55:42.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN23568423/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000083 - http://cs.cybozu.co.jp/information/20120910up01.php
CVE ID: CVE-2012-4012 State: PUBLISHED Published: 2012-09-08T10:00:00Z Last Updated: 2024-09-16T19:36:26.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebView class in the Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000084 - http://cs.cybozu.co.jp/information/20120910up02.php - http://jvn.jp/en/jp/JVN59652356/index.html
CVE ID: CVE-2012-4013 State: PUBLISHED Published: 2012-09-14T23:00:00Z Last Updated: 2024-09-16T17:13:58.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebView class in the Cybozu KUNAI Browser for Remote Service application beta for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL. Additional Analyst Notes: - CVE Program Container: References: - http://products.cybozu.co.jp/remote/product/smartphone/ - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000085 - http://jvn.jp/en/jp/JVN03015214/index.html
CVE ID: CVE-2012-4014 State: PUBLISHED Published: 2012-09-25T10:00:00Z Last Updated: 2024-09-17T00:56:18.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in McAfee Email Anti-virus (formerly WebShield SMTP) allows remote attackers to cause a denial of service via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN50701493/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000086
CVE ID: CVE-2012-4015 State: PUBLISHED Published: 2012-09-25T10:00:00Z Last Updated: 2024-09-17T02:57:56.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the management screen in myLittleTools myLittleAdmin for SQL Server 2000 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted database entry. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN56373673/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000087
CVE ID: CVE-2012-4016 State: PUBLISHED Published: 2012-09-28T10:00:00 Last Updated: 2024-08-06T20:21:04.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ATOK application before 1.0.4 for Android allows remote attackers to read the learning information file, and obtain sensitive input-string information, via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/55728 - http://jvn.jp/en/jp/JVN93344001/index.html - http://osvdb.org/85808 - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000089
CVE ID: CVE-2012-4017 State: PUBLISHED Published: 2012-09-28T10:00:00 Last Updated: 2024-08-06T20:21:04.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: The jigbrowser+ application before 1.5.0 for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000091 - http://jvn.jp/en/jp/JVN86318665/index.html - http://osvdb.org/85819
CVE ID: CVE-2012-4018 State: PUBLISHED Published: 2012-10-05T10:00:00 Last Updated: 2024-08-06T20:21:04.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Final Beta Laboratory MyWebSearch before 1.23 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000092 - http://finalbeta.jp/library/perl/mwsearch.html - http://jvn.jp/en/jp/JVN58160713/index.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/79059
CVE ID: CVE-2012-4019 State: PUBLISHED Published: 2012-10-26T10:00:00 Last Updated: 2024-08-06T20:21:04.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in tokyo_bbs.cgi in Come on Girls Interface (CGI) Tokyo BBS allows remote attackers to inject arbitrary web script or HTML via vectors related to the error page. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN00322303/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000093 - http://osvdb.org/86722 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79633 - http://jvn.jp/en/jp/JVN00322303/995209/index.html
CVE ID: CVE-2012-4020 State: PUBLISHED Published: 2012-11-08T11:00:00 Last Updated: 2024-08-06T20:21:04.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: MosP kintai kanri before 4.1.0 does not enforce privilege requirements, which allows remote authenticated users to read other users' information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000096 - http://www.securityfocus.com/bid/56368 - http://jvn.jp/en/jp/JVN23465354/index.html - http://secunia.com/advisories/51110
CVE ID: CVE-2012-4021 State: PUBLISHED Published: 2012-11-08T11:00:00 Last Updated: 2024-08-06T20:21:04.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: MosP kintai kanri before 4.1.0 does not properly perform authentication, which allows remote authenticated users to impersonate arbitrary user accounts, and consequently obtain sensitive information or modify settings, via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/56369 - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000097 - http://jvn.jp/en/jp/JVN52264310/index.html - http://secunia.com/advisories/51110
CVE ID: CVE-2012-4022 State: PUBLISHED Published: 2012-11-08T11:00:00 Last Updated: 2024-08-06T20:21:04.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pebble before 2.6.4 allows remote attackers to trigger loss of blog-entry viewability via a crafted comment. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/51102 - http://jvn.jp/en/jp/JVN75492883/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000098
CVE ID: CVE-2012-4023 State: PUBLISHED Published: 2012-11-08T11:00:00 Last Updated: 2024-08-06T20:21:04.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in Pebble before 2.6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN39563771/index.html - http://secunia.com/advisories/51102 - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000099
CVE ID: CVE-2012-4024 State: PUBLISHED Published: 2012-07-19T19:00:00 Last Updated: 2024-08-06T20:21:04.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.co
from an untrusted remote source. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/07/19/6 - http://www.osvdb.org/83898 - https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001 - http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel - http://www.securityfocus.com/bid/54610 - https://security.gentoo.org/glsa/201612-40 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:128 - https://exchange.xforce.ibmcloud.com/vulnerabilities/77106
CVE ID: CVE-2012-4025 State: PUBLISHED Published: 2012-07-19T19:00:00 Last Updated: 2024-08-06T20:21:04.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/07/19/6 - http://www.osvdb.org/83899 - https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001 - http://sourceforge.net/mailarchive/forum.php?thread_name=C
tps://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001 - http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel - http://www.securityfocus.com/bid/54610 - https://security.gentoo.org/glsa/201612-40 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:128
CVE ID: CVE-2012-4026 State: PUBLISHED Published: 2012-07-16T17:00:00Z Last Updated: 2024-09-17T01:51:08.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Johnson Controls Pegasys P2000 server with software before 3.11 allows remote attackers to trigger false alerts via crafted packets to TCP port 41013 (aka the upload port), a different vulnerability than CVE-2012-2607. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/MORO-8UYN8P - http://www.kb.cert.org/vuls/id/977312
CVE ID: CVE-2012-4027 State: PUBLISHED Published: 2012-07-16T19:00:00Z Last Updated: 2024-09-16T20:52:31.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file. Additional Analyst Notes: - CVE Program Container: References: - http://www.washingtonpost.com/investigations/tridiums-niagara-framework-marvel-of-connectivity-illustrates-new-cyber-risks/2012/07/11/gJQARJL6dW_story.html - https://www.tridium.com/galleries/briefings/NiagaraAX_Framework_Sof
s-new-cyber-risks/2012/07/11/gJQARJL6dW_story.html - https://www.tridium.com/galleries/briefings/NiagaraAX_Framework_Software_Security_Alert.pdf
CVE ID: CVE-2012-4028 State: PUBLISHED Published: 2012-07-16T19:00:00Z Last Updated: 2024-09-17T03:23:05.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restrictions by using the stored information for authentication. Additional Analyst Notes: - CVE Program Container: References: - http://www.washingtonpost.com/investigations/tridiums-niagara-framework-marvel-of-connectivity-illustrates-new-cyber-risks/2012/07/11/gJQARJL6dW_story.html - https://www.tridium.com/galleries/briefings/NiagaraAX_Framework_Software_Security_Alert.pdf
CVE ID: CVE-2012-4029 State: PUBLISHED Published: 2020-02-08T17:44:19 Last Updated: 2024-08-06T20:21:04.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the category_name parameter in an addsentcategory action. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/115927/Chamilo-1.8.8.4-XSS-File-Deletion.html - http://support.chamilo.org/attachments/download/2863/chamilo-1.8.8.4-to-1.8.8.6.patch - https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Is
download/2863/chamilo-1.8.8.4-to-1.8.8.6.patch - https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-7-2012-07-16-Moderate-risk-Several-moderate-security-flaws
CVE ID: CVE-2012-4030 State: PUBLISHED Published: 2020-01-10T16:58:55 Last Updated: 2024-08-06T20:21:04.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/78054
CVE ID: CVE-2012-4031 State: PUBLISHED Published: 2012-07-17T21:00:00 Last Updated: 2024-08-06T20:21:04.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in src/acloglogin.php in Wangkongbao CNS-1000 and 1100 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) lang or (2) langid cookie to port 85. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/76682 - http://osvdb.org/83636 - http://www.exploit-db.com/exploits/19526 - http://www.securityfocus.com/bid/54267 - http://secunia.com/advisories/49776