Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-2415 State: PUBLISHED Published: 2012-04-30T20:00:00 Last Updated: 2024-08-06T19:34:24.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows remote authenticated users to cause a denial of service or possibly have unspecified other impact via a series of KEYPAD_BUTTON_MESSAGE events. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/81455 - http://www.debian.org/security/2012/dsa-2460 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75102 - http://secunia.
p://www.debian.org/security/2012/dsa-2460 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75102 - http://secunia.com/advisories/48941 - http://www.securitytracker.com/id?1026962 - http://www.securityfocus.com/bid/53210 - http://downloads.asterisk.org/pub/security/AST-2012-005.html - http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079759.html - http://secunia.com/advisories/48891
CVE ID: CVE-2012-2416 State: PUBLISHED Published: 2012-04-30T20:00:00 Last Updated: 2024-08-06T19:34:25.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4, when the trustrpid option is enabled, allows remote authenticated users to cause a denial of service (daemon crash) by sending a SIP UPDATE message that triggers a connected-line update attempt without an associated channel. Additional Analyst Notes: - CVE Program Container: References: - https://issues.asterisk.org/jira/browse/ASTERISK-19770 - http://www.securitytracker.
VE Program Container: References: - https://issues.asterisk.org/jira/browse/ASTERISK-19770 - http://www.securitytracker.com/id?1026963 - http://osvdb.org/81456 - http://www.securityfocus.com/bid/53205 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75101 - http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079759.html - http://secunia.com/advisories/48891 - http://downloads.asterisk.org/pub/security/AST-2012-006.html
CVE ID: CVE-2012-2417 State: PUBLISHED Published: 2012-06-17T01:00:00 Last Updated: 2024-08-06T19:34:25.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2012/dsa-2502 - http://www.osvdb.org/82279 - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081789.html - https://github.com/Legrandin/pycrypto/commit/9f912f1
edoraproject.org/pipermail/package-announce/2012-June/081789.html - https://github.com/Legrandin/pycrypto/commit/9f912f13df99ad3421eff360d6a62d7dbec755c2 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:117 - http://www.securityfocus.com/bid/53687 - https://bugs.launchpad.net/pycrypto/+bug/985164 - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081713.html - http://secunia.com/advisories/49263 - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081759.html - http://www.openwall.com/lists/oss-security/2012/05/25/1 - https://hermes.opensuse.org/messages/15083589 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75871 - https://github.com
/hermes.opensuse.org/messages/15083589 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75871 - https://github.com/dlitz/pycrypto/blob/373ea760f21701b162e8c4912a66928ee30d401a/ChangeLog
CVE ID: CVE-2012-2418 State: PUBLISHED Published: 2012-04-25T20:00:00 Last Updated: 2024-08-06T19:34:25.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a URI with a % (percent) character as its (1) last or (2) second-to-last character. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75170
tional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75170 - http://osvdb.org/80820 - http://www.securityfocus.com/archive/1/522138 - http://www.kb.cert.org/vuls/id/232979
CVE ID: CVE-2012-2419 State: PUBLISHED Published: 2012-04-25T20:00:00 Last Updated: 2024-08-06T19:34:25.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allows remote attackers to cause a denial of service (memory consumption) via a URI with multiple references to the same name-value pair. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75171 - http://www.securityfocus.com/archive/1/522138 - http://www.kb.cert.org/
ange.xforce.ibmcloud.com/vulnerabilities/75171 - http://www.securityfocus.com/archive/1/522138 - http://www.kb.cert.org/vuls/id/232979
CVE ID: CVE-2012-2420 State: PUBLISHED Published: 2012-04-25T20:00:00 Last Updated: 2024-08-06T19:34:25.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to obtain sensitive information via a URI with a % (percent) character as its (1) last or (2) second-to-last character, in situations where a certain "post-URL data" buffer contains a 0x0000 character but a buffer overflow does not occur. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/
but a buffer overflow does not occur. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/80820 - http://www.securityfocus.com/archive/1/522138 - http://www.kb.cert.org/vuls/id/232979 - https://exchange.xforce.ibmcloud.com/vulnerabilities/74548
CVE ID: CVE-2012-2421 State: PUBLISHED Published: 2012-04-25T20:00:00 Last Updated: 2024-08-06T19:34:25.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to read arbitrary files in ZIP archives via a full pathname in the URI. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75172 - http://www.securityfocus.com/archive/1/522139 - http://www.kb.cert.org/vuls/id/232
.ibmcloud.com/vulnerabilities/75172 - http://www.securityfocus.com/archive/1/522139 - http://www.kb.cert.org/vuls/id/232979
CVE ID: CVE-2012-2422 State: PUBLISHED Published: 2012-04-25T20:00:00 Last Updated: 2024-08-06T19:34:25.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intuit QuickBooks 2009 through 2012 might allow remote attackers to obtain pathname information via the qbwc://docontrol/GetCompanyFile functionality. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/522139 - http://www.kb.cert.org/vuls/id/232979 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75173
CVE ID: CVE-2012-2423 State: PUBLISHED Published: 2012-04-25T20:00:00 Last Updated: 2024-08-06T19:34:25.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, provide different responses to remote requests depending on whether a ZIP pathname is valid, which allows remote attackers to obtain potentially sensitive information about the installation path and product version via a series of requests involving the Msxml2.XMLHTTP object. Additional Analyst Notes: - CVE Program Container: References: - https://
requests involving the Msxml2.XMLHTTP object. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75174 - http://www.securityfocus.com/archive/1/522139 - http://www.kb.cert.org/vuls/id/232979
CVE ID: CVE-2012-2424 State: PUBLISHED Published: 2012-04-25T20:00:00 Last Updated: 2024-08-06T19:34:25.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a URI that lacks a required delimiter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/522139 - http://www.securityfocus.com/archive/1/522138 - https://exchange.xforce.ibmcloud.com/vulnerab
cus.com/archive/1/522139 - http://www.securityfocus.com/archive/1/522138 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75175 - http://www.kb.cert.org/vuls/id/232979
CVE ID: CVE-2012-2425 State: PUBLISHED Published: 2012-04-25T20:00:00 Last Updated: 2024-08-06T19:34:25.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allow remote attackers to cause a denial of service (application crash) via a long URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/522139 - http://www.securityfocus.com/archive/1/522138 - http://packetstormsecurity.org/files/111403/Intuit-Help-System-Protocol-File-Retrieval.html - http://
archive/1/522138 - http://packetstormsecurity.org/files/111403/Intuit-Help-System-Protocol-File-Retrieval.html - http://www.kb.cert.org/vuls/id/232979 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75176
CVE ID: CVE-2012-2426 State: PUBLISHED Published: 2012-05-25T19:00:00Z Last Updated: 2024-09-16T19:47:20.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server in xArrow before 3.4.1 does not properly allocate memory, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/control_systems/pdf/ICSA-12-145-02.pdf
CVE ID: CVE-2012-2427 State: PUBLISHED Published: 2012-05-25T19:00:00Z Last Updated: 2024-09-16T20:43:25.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the server in xArrow before 3.4.1 allows remote attackers to execute arbitrary code via packets that trigger an invalid free operation. Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/control_systems/pdf/ICSA-12-145-02.pdf
CVE ID: CVE-2012-2428 State: PUBLISHED Published: 2012-05-25T19:00:00Z Last Updated: 2024-09-16T16:54:14.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the server in xArrow before 3.4.1 allows remote attackers to execute arbitrary code via a crafted packet that triggers an out-of-bounds read operation. Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/control_systems/pdf/ICSA-12-145-02.pdf
CVE ID: CVE-2012-2429 State: PUBLISHED Published: 2012-05-25T19:00:00Z Last Updated: 2024-09-17T02:58:22.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server in xArrow before 3.4.1 performs an invalid read operation, which allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/control_systems/pdf/ICSA-12-145-02.pdf
CVE ID: CVE-2012-2435 State: PUBLISHED Published: 2012-05-27T20:00:00Z Last Updated: 2024-09-16T16:53:29.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the captcha parameter to module.php, as demonstrated by cross-site request forgery (CSRF) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23089 - http://pligg.svn.sourceforge.net/viewvc/pligg?view=revision&revision=2440 - http://forums.pligg.com/downloads.php?do=file&id=15
CVE ID: CVE-2012-2436 State: PUBLISHED Published: 2012-05-27T20:00:00 Last Updated: 2024-08-06T19:34:25.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter in a move or (2) minimize action to admin/admin_index.php; (3) the karma_username parameter to module.php in the karma module; (4) q_1_low, (5) q_1_high, (6) q_2_low, or (7) q_2_high parameter in a configure action to module.php in the captcha module; or (8) the edit parameter to module.php in the admin_language module. Additional Analyst Notes: - CVE Program
ha module; or (8) the edit parameter to module.php in the admin_language module. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53662 - http://secunia.com/advisories/49257 - http://pligg.svn.sourceforge.net/viewvc/pligg?view=revision&revision=2441 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75834 - https://www.htbridge.com/advisory/HTB23089 - http://secunia.com/secunia_research/2012-18/ - http://pligg.svn.sourceforge.net/viewvc/pligg?view=revision&revision=2440 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75764 - http://secunia.com/advisories/45431 - http://pligg.svn.sourceforge.net/viewvc/pligg?view=revision&revision=24
es/75764 - http://secunia.com/advisories/45431 - http://pligg.svn.sourceforge.net/viewvc/pligg?view=revision&revision=2452 - http://www.securityfocus.com/bid/53625 - http://forums.pligg.com/downloads.php?do=file&id=15 - http://pligg.svn.sourceforge.net/viewvc/pligg/trunk/modules/admin_language/admin_language_main.php?r1=2442&r2=2441&pathrev=2442
CVE ID: CVE-2012-2437 State: PUBLISHED Published: 2012-11-26T11:00:00 Last Updated: 2024-08-06T19:34:25.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: cookie_gen.php in ar web content manager (AWCM) 2.2 does not require authentication, which allows remote attackers to generate arbitrary cookies via the name parameter in conjunction with the content parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/79926 - http://packetstormsecurity.org/files/117975/AWCM-2.2-Access-Bypass.html - http://archives.neohapsis.com/archives/bugtraq/2012-11/0039.html
CVE ID: CVE-2012-2438 State: PUBLISHED Published: 2012-11-26T11:00:00 Last Updated: 2024-08-06T19:34:25.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: ar web content manager (AWCM) 2.2 does not restrict the number of comment records that can be submitted through HTTP requests, which allows remote attackers to cause a denial of service (disk consumption) via the coment parameter to (1) show_video.php or (2) topic.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/files/117975/AWCM-2.2-Access-Bypass.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/79927 - http://archives.neohapsis.com/archives/bugtraq/2012-11/0039.ht
ps://exchange.xforce.ibmcloud.com/vulnerabilities/79927 - http://archives.neohapsis.com/archives/bugtraq/2012-11/0039.html
CVE ID: CVE-2012-2439 State: PUBLISHED Published: 2012-04-28T00:00:00Z Last Updated: 2024-09-17T03:44:04.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of the NETGEAR ProSafe FVS318N firewall enables web-based administration on the WAN interface, which allows remote attackers to establish an HTTP connection and possibly have unspecified other impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/928795
CVE ID: CVE-2012-2440 State: PUBLISHED Published: 2012-04-28T00:00:00 Last Updated: 2024-08-06T19:34:25.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of the TP-Link 8840T router enables web-based administration on the WAN interface, which allows remote attackers to establish an HTTP connection and possibly have unspecified other impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/834723 - https://exchange.xforce.ibmcloud.com/vulnerabilities/74624
CVE ID: CVE-2012-2441 State: PUBLISHED Published: 2012-04-28T00:00:00 Last Updated: 2024-08-06T19:34:25.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: RuggedCom Rugged Operating System (ROS) before 3.3 has a factory account with a password derived from the MAC Address field in a banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing a (1) SSH or (2) HTTPS session, a different vulnerability than CVE-2012-1803. Additional Analyst Notes: - CVE Program Container: References: - http://www.wired.com/threatlevel/2012/04/ruggedcom-backdoor/ - http://www.kb.cert.org/vuls/id/889195 - http://www.rugge
http://www.wired.com/threatlevel/2012/04/ruggedcom-backdoor/ - http://www.kb.cert.org/vuls/id/889195 - http://www.ruggedcom.com/productbulletin/ros-security-page/ - http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-116-01A.pdf - https://exchange.xforce.ibmcloud.com/vulnerabilities/75244 - http://seclists.org/fulldisclosure/2012/Apr/277 - http://arstechnica.com/business/news/2012/04/backdoor-in-mission-critical-hardware-threatens-power-traffic-control-systems.ars
CVE ID: CVE-2012-2442 State: PUBLISHED Published: 2012-07-25T21:00:00 Last Updated: 2024-08-06T19:34:25.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the Video Manager in Nokia PC Suite 7.1.180.64 and earlier allows remote attackers to cause a denial of service via a crafted mp4 file. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/81498 - http://www.exploit-db.com/exploits/18795 - http://packetstormsecurity.org/files/112295/Nokia-CP-Suite-Video-Manager-7.1.180.64-Denial-Of-Service.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/75235 - http://www.securityfocus.com/bid/53290
CVE ID: CVE-2012-2446 State: PUBLISHED Published: 2012-07-09T18:00:00Z Last Updated: 2024-09-16T16:48:03.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in tools/local_lookup.php in the WebAdmin Portal in Netsweeper allows remote attackers to inject arbitrary web script or HTML via the group parameter in a lookup action. Additional Analyst Notes: - CVE Program Container: References: - http://infosec42.blogspot.com/2012/07/cve-2012-2446-cve-2012-2447-cve-2012.html - http://www.kb.cert.org/vuls/id/763795
CVE ID: CVE-2012-2447 State: PUBLISHED Published: 2012-07-09T18:00:00Z Last Updated: 2024-09-17T01:26:35.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in accountmgr/adminupdate.php in the WebAdmin Portal in Netsweeper allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via an add action. Additional Analyst Notes: - CVE Program Container: References: - http://infosec42.blogspot.com/2012/07/cve-2012-2446-cve-2012-2447-cve-2012.html - http://www.kb.cert.org/vuls/id/763795
CVE ID: CVE-2012-2448 State: PUBLISHED Published: 2012-05-04T16:00:00 Last Updated: 2024-08-06T19:34:25.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: VMware ESXi 3.5 through 5.0 and ESX 3.5 through 4.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory overwrite) via NFS traffic. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/81693 - http://www.vmware.com/security/advisories/VMSA-2012-0009.html - http://www.securitytracker.com/id?1027018 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75375 - http://www.securityfocus.com/bid/53371
CVE ID: CVE-2012-2449 State: PUBLISHED Published: 2012-05-04T16:00:00 Last Updated: 2024-08-06T19:34:25.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/81694 - http://ww
ges on the guest OS. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/81694 - http://www.vmware.com/security/advisories/VMSA-2012-0009.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16863 - http://secunia.com/advisories/49032 - http://www.securityfocus.com/bid/53369 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75376 - http://www.securitytracker.com/id?1027019
CVE ID: CVE-2012-2450 State: PUBLISHED Published: 2012-05-04T16:00:00 Last Updated: 2024-08-06T19:34:25.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly register SCSI devices, which allows guest OS users to cause a denial of service (invalid write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75
Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75377 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16852 - http://www.vmware.com/security/advisories/VMSA-2012-0009.html - http://secunia.com/advisories/49032 - http://www.securityfocus.com/bid/53369 - http://osvdb.org/81695 - http://www.securitytracker.com/id?1027019
CVE ID: CVE-2012-2451 State: PUBLISHED Published: 2012-06-27T21:00:00 Last Updated: 2024-08-06T19:34:25.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack. NOTE: some of these details are obtained from third party information. NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_b