Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-5705 State: PUBLISHED Published: 2012-11-01T10:00:00Z Last Updated: 2024-09-17T00:37:08.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the settings page (admin/settings/hotblocks) in the Hotblocks module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with the "administer hotblocks" permission to inject arbitrary web script or HTML via the "block names." Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/6 - http://drupal.org/node/1732828 - http://www.madirish.net/543 - http://drupal.org/node/1732946 - http://www.openwall.com/li
tp://drupal.org/node/1732828 - http://www.madirish.net/543 - http://drupal.org/node/1732946 - http://www.openwall.com/lists/oss-security/2012/10/07/1
CVE ID: CVE-2012-5717 State: PUBLISHED Published: 2013-01-18T21:00:00 Last Updated: 2024-08-06T21:14:16.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Adaptive Security Appliances (ASA) devices with firmware 8.x through 8.4(1) do not properly manage SSH sessions, which allows remote authenticated users to cause a denial of service (device crash) by establishing multiple sessions, aka Bug ID CSCtc59462. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-5717
CVE ID: CVE-2012-5723 State: PUBLISHED Published: 2014-04-24T10:00:00 Last Updated: 2024-08-06T21:14:16.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948. Additional Analyst Notes: - CVE Program Container: References: - http://www.cisco.com/c/en/us/td/docs/routers/asr1000/release/notes/asr1k_rn_rel_notes/asr1k_caveats_38s.html
CVE ID: CVE-2012-5744 State: PUBLISHED Published: 2013-08-30T01:00:00Z Last Updated: 2024-09-17T00:01:14.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the guest portal in Cisco Identity Services Engine (ISE) Software allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs CSCud11139 and CSCug02904. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-5744
CVE ID: CVE-2012-5756 State: PUBLISHED Published: 2012-11-23T11:00:00 Last Updated: 2024-08-06T21:14:16.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different customers' installations, which allows remote attackers to spoof a container server by (1) sniffing the network to locate a cleartext transmission of this key or (2) leveraging knowledge of this key from another installation. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid
allation. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg24033740 - http://www-01.ibm.com/support/docview.wss?uid=swg1PM68926 - http://www.securityfocus.com/bid/56617 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79921 - http://www.securitytracker.com/id?1027798 - http://secunia.com/advisories/51319 - http://www-01.ibm.com/support/docview.wss?uid=swg21615783
CVE ID: CVE-2012-5757 State: PUBLISHED Published: 2013-03-21T20:00:00 Last Updated: 2024-08-06T21:14:16.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Web Client in IBM Rational ClearQuest 7.1.x before 7.1.2.10 and 8.x before 8.0.0.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg1PM77153 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80061 - http://www.ibm.com/support/docview.wss?uid=swg21619993
CVE ID: CVE-2012-5758 State: PUBLISHED Published: 2012-11-23T11:00:00 Last Updated: 2024-08-06T21:14:16.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2 does not require authentication for an unspecified interface, which allows remote attackers to cause a denial of service (process exit) via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg24033740 - http://www.securityfocus.com/bid/56617 - http://www.securitytracker.com/id?1027798 - http://secunia.com/advisories/51319 - https://exchange.xforce.ibmcloud
617 - http://www.securitytracker.com/id?1027798 - http://secunia.com/advisories/51319 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80063 - http://www-01.ibm.com/support/docview.wss?uid=swg1IC86908 - http://www-01.ibm.com/support/docview.wss?uid=swg21615783
CVE ID: CVE-2012-5759 State: PUBLISHED Published: 2012-11-23T11:00:00 Last Updated: 2024-08-06T21:14:16.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2 allows remote authenticated users to bypass intended administrative-role requirements and perform arbitrary JMX operations via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/87620 - http://www-01.ibm.com/support/docview.wss?uid=swg24033740 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80062 - http://www.securityfocus.com/bid/56617 - http://www-01.ibm.com/support/docview
orce.ibmcloud.com/vulnerabilities/80062 - http://www.securityfocus.com/bid/56617 - http://www-01.ibm.com/support/docview.wss?uid=swg1IC85748 - http://www.securitytracker.com/id?1027798 - http://secunia.com/advisories/51319 - http://www-01.ibm.com/support/docview.wss?uid=swg21615783
CVE ID: CVE-2012-5760 State: PUBLISHED Published: 2013-02-20T11:00:00 Last Updated: 2024-08-06T21:14:16.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/80137 - http://www-01.ibm.com/support/docview.wss?uid=swg21624568
CVE ID: CVE-2012-5761 State: PUBLISHED Published: 2013-02-20T11:00:00 Last Updated: 2024-08-06T21:14:16.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/80138 - http://www-01.ibm.com/support/docview.wss?uid=swg21624568
CVE ID: CVE-2012-5762 State: PUBLISHED Published: 2013-02-20T11:00:00 Last Updated: 2024-08-06T21:14:16.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote authenticated users to inject arbitrary web script or HTML via vectors involving the MHTML protocol. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/80204 - http://www-01.ibm.com/support/docview.wss?uid=swg21624568
CVE ID: CVE-2012-5763 State: PUBLISHED Published: 2013-02-20T11:00:00 Last Updated: 2024-08-06T21:14:16.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21624568 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80205
CVE ID: CVE-2012-5765 State: PUBLISHED Published: 2012-12-20T11:00:00 Last Updated: 2024-08-06T21:14:16.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a SQL error message. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21620048 - http://www-01.ibm.com/support/docview.wss?uid=swg1PM72905 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80211
CVE ID: CVE-2012-5766 State: PUBLISHED Published: 2013-07-03T10:00:00 Last Updated: 2024-08-06T21:14:16.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to execute arbitrary SQL commands via vectors involving the RNVisibility page and unspecified screens, a different vulnerability than CVE-2013-0560. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg1IC84082 - http://www-01.ibm.com/support/docview.wss?uid=swg21627982 - http://www-01.ibm.com/support/docview.wss?uid
=swg1IC84082 - http://www-01.ibm.com/support/docview.wss?uid=swg21627982 - http://www-01.ibm.com/support/docview.wss?uid=swg21640830 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80267
CVE ID: CVE-2012-5767 State: PUBLISHED Published: 2013-02-27T16:00:00 Last Updated: 2024-08-06T21:14:16.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the web interface on the IBM TS3500 Tape Library with firmware before C260 allows remote authenticated users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/80272 - http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004282
CVE ID: CVE-2012-5769 State: PUBLISHED Published: 2013-01-01T11:00:00 Last Updated: 2024-08-06T21:14:16.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM SPSS Modeler 14.0, 14.1, 14.2 through FP3, and 15.0 before FP2 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/80316 - http://www-01.ibm.com/support/docview.wss?uid=swg1PM79454 - http://www-01.ibm.com/support/docview.w
nerabilities/80316 - http://www-01.ibm.com/support/docview.wss?uid=swg1PM79454 - http://www-01.ibm.com/support/docview.wss?uid=swg21620758 - http://www-01.ibm.com/support/docview.wss?uid=swg24034122
CVE ID: CVE-2012-5770 State: PUBLISHED Published: 2013-03-06T11:00:00 Last Updated: 2024-08-06T21:14:16.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SSL configuration in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.x before 7.2.1.4 supports the MD5 hash algorithm, which makes it easier for man-in-the-middle attackers to spoof servers and decrypt network traffic via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/80354 - http://www-01.ibm.com/support/docview.wss?uid=swg1IV32391 - http://www-01.ibm.com/support/docview.wss?uid=swg21626029
CVE ID: CVE-2012-5771 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-5772 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-5773 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-5774 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-5775 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-5776 State: PUBLISHED Published: 2020-01-29T14:47:17 Last Updated: 2024-08-06T21:14:16.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dokeos 2.1.1 has multiple XSS issues involving "extra_" parameters in main/auth/profile.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/11/02/10 - https://cxsecurity.com/issue/WLB-2012110007
CVE ID: CVE-2012-5777 State: PUBLISHED Published: 2012-11-16T00:00:00 Last Updated: 2024-08-06T21:14:16.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS 6.6 allows user-assisted remote attackers to execute arbitrary PHP code via a crafted template. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/files/117902/EmpireCMS-6.6-PHP-Code-Execution.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/79779 - http://www.securityfocus.com/bid/56406 - http://archives.neohapsis.com/archives/bugtraq/2012-11/0027.html
ities/79779 - http://www.securityfocus.com/bid/56406 - http://archives.neohapsis.com/archives/bugtraq/2012-11/0027.html - http://packetstormsecurity.com/files/117902/EmpireCMS-6.6-PHP-Code-Execution.html
CVE ID: CVE-2012-5780 State: PUBLISHED Published: 2012-11-04T22:00:00 Last Updated: 2024-08-06T21:14:16.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Amazon merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/51196 - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE ID: CVE-2012-5781 State: PUBLISHED Published: 2012-11-04T22:00:00Z Last Updated: 2024-09-17T00:31:26.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amazon Elastic Load Balancing API Tools does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to overriding the default JDK X509TrustManager. Additional Analyst Notes: - CVE Program Container: References: - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE ID: CVE-2012-5782 State: PUBLISHED Published: 2012-11-04T22:00:00 Last Updated: 2024-08-06T21:14:16.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amazon Flexible Payments Service (FPS) PHP Library does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to misinterpretation of a certain "true" value. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/79985 - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE ID: CVE-2012-5783 State: PUBLISHED Published: 2012-11-04T22:00:00 Last Updated: 2024-08-06T21:14:16.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-0681.html - https://issues.apache.org/jira/browse/HTTPCLIENT-126
r: References: - http://rhn.redhat.com/errata/RHSA-2013-0681.html - https://issues.apache.org/jira/browse/HTTPCLIENT-1265 - http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html - http://rhn.redhat.com/errata/RHSA-2013-0680.html - https://access.redhat.com/errata/RHSA-2017:0868 - http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html - http://www.securityfocus.com/bid/58073 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79984 - http://rhn.redhat.com/errata/RHSA-2013-0270.html - http://rhn.redhat.com/errata/RHSA-2013-0682.html - http://lists.opensuse.org/opensuse-updates/2013-04/msg00053.html - http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html - htt
suse.org/opensuse-updates/2013-04/msg00053.html - http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html - http://rhn.redhat.com/errata/RHSA-2013-1853.html - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf - http://rhn.redhat.com/errata/RHSA-2013-0679.html - http://rhn.redhat.com/errata/RHSA-2013-1147.html - http://www.ubuntu.com/usn/USN-2769-1 - http://rhn.redhat.com/errata/RHSA-2014-0224.html
CVE ID: CVE-2012-5784 State: PUBLISHED Published: 2012-11-04T22:00:00 Last Updated: 2024-08-06T21:14:16.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/err
arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-0269.html - http://rhn.redhat.com/errata/RHSA-2014-0037.html - http://secunia.com/advisories/51219 - http://rhn.redhat.com/errata/RHSA-2013-0683.html - http://www.securityfocus.com/bid/56408 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79829 - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf - https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3E - https://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3E - http
.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html - https://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3E - https://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3E - https://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3E
CVE ID: CVE-2012-5785 State: PUBLISHED Published: 2012-11-04T22:00:00 Last Updated: 2024-08-06T21:14:16.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/51219 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79830 - http://www.securityfocus.com/bid/56408 - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pd
loud.com/vulnerabilities/79830 - http://www.securityfocus.com/bid/56408 - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE ID: CVE-2012-5786 State: PUBLISHED Published: 2012-11-04T22:00:00 Last Updated: 2024-08-06T21:14:16.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF before 2.7.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. NOTE: The vendor states that the sample had specifically used a flag to bypass the DN check Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Co
had specifically used a flag to bypass the DN check Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/79983 - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE ID: CVE-2012-5787 State: PUBLISHED Published: 2012-11-04T22:00:00 Last Updated: 2024-08-06T21:14:16.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PayPal merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/56445 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79913 - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf - http://secunia.com/advisories/51184 - https://
vulnerabilities/79913 - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf - http://secunia.com/advisories/51184 - https://github.com/paypal/SDKs/commit/5f2d6dd77fb4211dcde34e36f1864234526c5d64
CVE ID: CVE-2012-5788 State: PUBLISHED Published: 2012-11-04T22:00:00 Last Updated: 2024-08-06T21:14:16.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PayPal IPN utility does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP fsockopen function. Additional Analyst Notes: - CVE Program Container: References: - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf - https://exchange.xforce.ibmcloud.com/vulnerabilities/79982
CVE ID: CVE-2012-5789 State: PUBLISHED Published: 2012-11-04T22:00:00 Last Updated: 2024-08-06T21:14:16.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: PayPal Payments Standard PHP Library before 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to intentional disabling of certificate-validation checks through a "FALSE" value. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/79912 - http://www.cs.ute
s: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/79912 - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf