Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-3442 State: PUBLISHED Published: 2012-07-31T17:00:00 Last Updated: 2024-08-06T20:05:12.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/07/31/1 - https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/ - http://www.mandriva.com/security/advisor
- https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/ - http://www.mandriva.com/security/advisories?name=MDVSA-2012:143 - http://www.ubuntu.com/usn/USN-1560-1 - http://www.openwall.com/lists/oss-security/2012/07/31/2 - http://www.debian.org/security/2012/dsa-2529
CVE ID: CVE-2012-3443 State: PUBLISHED Published: 2012-07-31T17:00:00 Last Updated: 2024-08-06T20:05:12.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/07/31/1 - https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/ - http://www.mandriva.com/security/advisories?name=MDVSA-2012:143 -
ect.com/weblog/2012/jul/30/security-releases-issued/ - http://www.mandriva.com/security/advisories?name=MDVSA-2012:143 - http://www.ubuntu.com/usn/USN-1560-1 - http://www.openwall.com/lists/oss-security/2012/07/31/2 - http://www.debian.org/security/2012/dsa-2529
CVE ID: CVE-2012-3444 State: PUBLISHED Published: 2012-07-31T17:00:00 Last Updated: 2024-08-06T20:05:12.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/07/31/1 - https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/ - http://www.mandriva.com/security/
07/31/1 - https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/ - http://www.mandriva.com/security/advisories?name=MDVSA-2012:143 - http://www.ubuntu.com/usn/USN-1560-1 - http://www.openwall.com/lists/oss-security/2012/07/31/2 - http://www.debian.org/security/2012/dsa-2529
CVE ID: CVE-2012-3445 State: PUBLISHED Published: 2012-08-07T21:00:00 Last Updated: 2024-08-06T20:05:12.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: The virTypedParameterArrayClear function in libvirt 0.9.13 does not properly handle virDomain* API calls with typed parameters, which might allow remote authenticated users to cause a denial of service (libvirtd crash) via an RPC command with nparams set to zero, which triggers an out-of-bounds read or a free of an invalid pointer. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/50118 - http://www.securityfocus.com/bid/54748 - https://www.redhat.com/archives/libvir-list/2012-July/
a.com/advisories/50118 - http://www.securityfocus.com/bid/54748 - https://www.redhat.com/archives/libvir-list/2012-July/msg01650.html - http://www.openwall.com/lists/oss-security/2012/07/31/4 - https://bugzilla.redhat.com/show_bug.cgi?id=844734 - http://rhn.redhat.com/errata/RHSA-2012-1202.html - http://secunia.com/advisories/50299 - http://secunia.com/advisories/50372 - http://www.openwall.com/lists/oss-security/2012/07/31/7 - http://lists.opensuse.org/opensuse-updates/2012-08/msg00023.html
CVE ID: CVE-2012-3446 State: PUBLISHED Published: 2012-11-04T22:00:00Z Last Updated: 2024-08-06T20:05:12.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://svn.apache.org/repos/asf/libcloud/trunk/CHANGES - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE ID: CVE-2012-3447 State: PUBLISHED Published: 2012-08-20T18:00:00 Last Updated: 2024-08-06T20:05:12.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openstack/nova/commit/ce4b2e27be45a85b310237615c47eb53f37bb5f3 - http://www.openwall.com/lists/oss-security/2012/0
b.com/openstack/nova/commit/ce4b2e27be45a85b310237615c47eb53f37bb5f3 - http://www.openwall.com/lists/oss-security/2012/08/07/1 - http://www.securityfocus.com/bid/54869 - https://exchange.xforce.ibmcloud.com/vulnerabilities/77539 - https://review.openstack.org/#/c/10953/ - https://bugs.launchpad.net/nova/+bug/1031311 - https://github.com/openstack/nova/commit/d9577ce9f266166a297488445b5b0c93c1ddb368 - https://bugzilla.redhat.com/show_bug.cgi?id=845106
CVE ID: CVE-2012-3448 State: PUBLISHED Published: 2012-08-06T18:00:00 Last Updated: 2024-08-06T20:05:12.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Ganglia Web before 3.5.1 allows remote attackers to execute arbitrary PHP code via unknown attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/54699 - http://lists.fedoraproject.org/pipermail/package-announce/2012-July/084196.html - https://www.exploit-db.com/exploits/38030/ - http://lists.fedoraproject.org/pipermail/package-announce/2012-July/084202.html - http://www.openwall.com/lists/oss-security/2012/08/02/1 - https://bugzilla.redhat
ckage-announce/2012-July/084202.html - http://www.openwall.com/lists/oss-security/2012/08/02/1 - https://bugzilla.redhat.com/show_bug.cgi?id=845124 - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00136.html - http://www.debian.org/security/2013/dsa-2610 - http://secunia.com/advisories/50047 - https://bugs.gentoo.org/show_bug.cgi?id=428776 - http://ganglia.info/?p=549
CVE ID: CVE-2012-3449 State: PUBLISHED Published: 2012-08-07T20:00:00 Last Updated: 2024-08-06T20:05:12.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open vSwitch 1.4.2 uses world writable permissions for (1) /var/lib/openvswitch/pki/controllerca/incoming/ and (2) /var/lib/openvswitch/pki/switchca/incoming/, which allows local users to delete and overwrite arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/54789 - https://bugzilla.redhat.com/show_bug.cgi?id=845350 - http://www.securityfocus.com/bid/54794 - http://www.openwall.com/lists/oss-security/2012/08/03/6 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug
m/bid/54794 - http://www.openwall.com/lists/oss-security/2012/08/03/6 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683665 - https://exchange.xforce.ibmcloud.com/vulnerabilities/77417 - http://www.openwall.com/lists/oss-security/2012/08/02/6
CVE ID: CVE-2012-3450 State: PUBLISHED Published: 2012-08-06T16:00:00 Last Updated: 2024-08-06T20:05:12.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/02/7 - http://www.debian.org/security/2012/dsa-2527 - http://www.php.net/ChangeLog-5.php - http://www.ope
curity/2012/08/02/7 - http://www.debian.org/security/2012/dsa-2527 - http://www.php.net/ChangeLog-5.php - http://www.openwall.com/lists/oss-security/2012/08/02/3 - https://bugs.php.net/bug.php?id=61755 - http://seclists.org/bugtraq/2012/Jun/60 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:108 - http://www.ubuntu.com/usn/USN-1569-1 - https://bugzilla.novell.com/show_bug.cgi?id=769785 - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00021.html
CVE ID: CVE-2012-3451 State: PUBLISHED Published: 2012-09-24T17:00:00 Last Updated: 2024-08-06T20:05:12.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=851896 - http://rhn.redhat.com/errata/RHSA-2013-0256.html - http://svn.apache.org/viewvc?view=revision&revision=1368559 - http://rhn.redhat.com/errata/RHSA-2012-1594.html - http://rhn.redhat.com/e
e.org/viewvc?view=revision&revision=1368559 - http://rhn.redhat.com/errata/RHSA-2012-1594.html - http://rhn.redhat.com/errata/RHSA-2013-0257.html - http://secunia.com/advisories/51607 - http://rhn.redhat.com/errata/RHSA-2013-0258.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/78734 - http://rhn.redhat.com/errata/RHSA-2012-1592.html - http://secunia.com/advisories/52183 - http://rhn.redhat.com/errata/RHSA-2013-0743.html - http://rhn.redhat.com/errata/RHSA-2012-1591.html - http://rhn.redhat.com/errata/RHSA-2013-0259.html - http://cxf.apache.org/cve-2012-3451.html - http://rhn.redhat.com/errata/RHSA-2013-0726.html - https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78
- http://rhn.redhat.com/errata/RHSA-2013-0726.html - https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https:
apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
CVE ID: CVE-2012-3452 State: PUBLISHED Published: 2012-08-07T20:00:00Z Last Updated: 2024-08-06T20:05:12.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: gnome-screensaver 3.4.x before 3.4.4 and 3.5.x before 3.5.4, when multiple screens are used, only locks the screen with the active focus, which allows physically proximate attackers to bypass screen locking and access an unattended workstation. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/03/3 - https://bugzilla.gnome.org/show_bug.cgi?id=679441 - http://www.openwall.com/lists/oss-security/2012/08/03/5
CVE ID: CVE-2012-3453 State: PUBLISHED Published: 2012-08-07T20:00:00Z Last Updated: 2024-09-17T01:31:14.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: logol 1.5.0 uses world writable permissions for the /var/lib/logol/results directory, which allows local users to delete or overwrite arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/54802 - http://www.openwall.com/lists/oss-security/2012/08/03/8 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683647
CVE ID: CVE-2012-3454 State: PUBLISHED Published: 2012-08-07T20:00:00Z Last Updated: 2024-09-17T03:18:04.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: eXtplorer 2.1.0b6 uses world writable permissions for the /var/lib/extplorer/ftp_tmp directory, which allows local users to delete or overwrite arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/54801 - http://www.openwall.com/lists/oss-security/2012/08/03/7
CVE ID: CVE-2012-3455 State: PUBLISHED Published: 2012-08-20T19:00:00 Last Updated: 2024-08-06T20:05:12.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the read function in filters/words/msword-odf/wv2/src/styles.cpp in the Microsoft import filter in KOffice 2.3.3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted ODF style in an ODF document. NOTE: this is the same vulnerability as CVE-2012-3456, but it was SPLIT by the CNA even though Calligra and KOffice share the same codebase. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com
and KOffice share the same codebase. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/50199 - http://www.openwall.com/lists/oss-security/2012/08/10/1 - http://www.openwall.com/lists/oss-security/2012/08/06/6 - http://www.openwall.com/lists/oss-security/2012/08/06/1 - http://www.openwall.com/lists/oss-security/2012/08/04/5 - https://exchange.xforce.ibmcloud.com/vulnerabilities/77483 - http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf - http://www.openwall.com/lists/oss-security/2012/08/04/1 - http://www.ubuntu.com/usn/USN-1526-1 - http://www.kde.org/info/security/advisory-20120810-1.txt - http://www.se
8/04/1 - http://www.ubuntu.com/usn/USN-1526-1 - http://www.kde.org/info/security/advisory-20120810-1.txt - http://www.securityfocus.com/bid/54816 - http://lists.opensuse.org/opensuse-updates/2012-08/msg00040.html
CVE ID: CVE-2012-3456 State: PUBLISHED Published: 2012-08-20T18:00:00 Last Updated: 2024-08-06T20:05:12.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the read function in filters/words/msword-odf/wv2/src/styles.cpp in the Microsoft import filter in Calligra 2.4.3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted ODF style in an ODF document. NOTE: this is the same vulnerability as CVE-2012-3455, but it was SPLIT by the CNA even though Calligra and KOffice share the same codebase. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.
and KOffice share the same codebase. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/77482 - http://www.openwall.com/lists/oss-security/2012/08/10/1 - http://www.openwall.com/lists/oss-security/2012/08/06/6 - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00026.html - http://www.openwall.com/lists/oss-security/2012/08/06/1 - http://www.openwall.com/lists/oss-security/2012/08/04/5 - http://marc.info/?l=bugtraq&m=136733075705494&w=2 - http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf - http://www.openwall.com/lists/oss-security/2012/08/04/1 - http://www.ubuntu.c
H_US_12_Miller_NFC_attack_surface_WP.pdf - http://www.openwall.com/lists/oss-security/2012/08/04/1 - http://www.ubuntu.com/usn/USN-1525-1 - http://www.kde.org/info/security/advisory-20120810-1.txt - http://secunia.com/advisories/50050 - http://marc.info/?l=bugtraq&m=136733075705494&w=2 - http://www.securityfocus.com/bid/54816
CVE ID: CVE-2012-3457 State: PUBLISHED Published: 2012-08-12T00:00:00 Last Updated: 2024-08-06T20:05:12.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: PNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process_perfdata.cfg, which allows local users to obtain the Gearman shared secret by reading the file. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683879 - http://www.securityfocus.com/bid/54863 - http://www.openwall.com/lists/oss-security/2012/08/06/8 - http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086387.html - http://www.openwall.com/lists/oss-security/2012/08/06
roject.org/pipermail/package-announce/2012-September/086387.html - http://www.openwall.com/lists/oss-security/2012/08/06/7 - http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086161.html
CVE ID: CVE-2012-3458 State: PUBLISHED Published: 2012-09-15T17:00:00Z Last Updated: 2024-08-06T20:05:12.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bbangert/beaker/commit/91becae76101cf87ce8cbfabe3af2622fc328fe5 - http://secunia.com/advisories/50226 - http://secunia.com/advisories/50520 - http://www.openwall.com/lists/oss-security/2012/08/13/10 - http://www.debian.org/security/2012/dsa-2541 - htt
es/50520 - http://www.openwall.com/lists/oss-security/2012/08/13/10 - http://www.debian.org/security/2012/dsa-2541 - https://bugzilla.redhat.com/show_bug.cgi?id=809267
CVE ID: CVE-2012-3459 State: PUBLISHED Published: 2012-09-28T17:00:00 Last Updated: 2024-08-06T20:05:12.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to modify Condor attributes and possibly gain privileges via crafted additional parameters in an HTTP POST request, which triggers a job attribute change request to Condor. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/55632 - http://rhn.redhat.com/errata/RHSA-2012-1278.html - http://rhn.redhat.com/errata/RHSA-2012-1281.html - http://secunia.com/advi
//rhn.redhat.com/errata/RHSA-2012-1278.html - http://rhn.redhat.com/errata/RHSA-2012-1281.html - http://secunia.com/advisories/50660 - http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=846501 - http://secunia.com/advisories/50666
CVE ID: CVE-2012-3460 State: PUBLISHED Published: 2019-11-21T14:03:17 Last Updated: 2024-08-06T20:05:12.578Z Vendors: cumin Products: cumin Problem Types: postgresql database user created without password Description: cumin: At installation postgresql database user created without password Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-3460 - https://access.redhat.com/security/cve/cve-2012-3460
CVE ID: CVE-2012-3461 State: PUBLISHED Published: 2012-08-20T19:00:00 Last Updated: 2024-08-06T20:05:12.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) otrl_base64_otr_decode function in src/b64.c; (2) otrl_proto_data_read_flags and (3) otrl_proto_accept_data functions in src/proto.c; and (4) decode function in toolkit/parse.c in libotr before 3.2.1 allocates a zero-length buffer when decoding a base64 string, which allows remote attackers to cause a denial of service (application crash) via a message with the value "?OTR:===.", which triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/
-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2012/dsa-2526 - http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00019.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/77528 - https://bugzilla.redhat.com/show_bug.cgi?id=846377 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:097 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:131 - http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr%3Ba=commitdiff%3Bh=b17232f86f8e60d0d22caf9a2400494d3c77da58 - http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html - http://lists.cypherpunks.ca/pipermail/otr-dev/2012
http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html - http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001348.html - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684121 - http://www.ubuntu.com/usn/USN-1541-1 - http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00016.html - http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr%3Ba=commitdiff%3Bh=1902baee5d4b056850274ed0fa8c2409f1187435 - http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00019.html - http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr%3Ba=commitdiff%3Bh=6d4ca89cf1d3c9a8aff696c3a846ac5a51f762c1 - http://www.securityfocus.com/bid/54907
CVE ID: CVE-2012-3462 State: PUBLISHED Published: 2019-12-26T20:14:37 Last Updated: 2024-08-06T20:05:12.697Z Vendors: sssd Products: sssd Problem Types: Other Description: A flaw was found in SSSD version 1.9.0. The SSSD's access-provider logic causes the result of the HBAC rule processing to be ignored in the event that the access-provider is also handling the setup of the user's SELinux user context. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-3462 - https://access.redhat.com/security/cve/cve-2012-3462 - https://pagure.io/SSSD/sssd/issue/1470
CVE ID: CVE-2012-3463 State: PUBLISHED Published: 2012-08-10T10:00:00 Last Updated: 2024-08-06T20:05:12.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper. Additional Analyst Notes: - CVE Program Container: References: - http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/ - https://groups.google.com/group/rubyonrails-security/msg/961e18e514527078?dmode=source&output=gplain - h
een-released/ - https://groups.google.com/group/rubyonrails-security/msg/961e18e514527078?dmode=source&output=gplain - http://rhn.redhat.com/errata/RHSA-2013-0154.html
CVE ID: CVE-2012-3464 State: PUBLISHED Published: 2012-08-10T10:00:00 Last Updated: 2024-08-06T20:05:12.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character. Additional Analyst Notes: - CVE Program Container: References: - http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/ - http://secunia.com/advisories/50694 - http://rhn.redhat.com/errata/RHSA-2013-0154.html - http
3-2-8-has-been-released/ - http://secunia.com/advisories/50694 - http://rhn.redhat.com/errata/RHSA-2013-0154.html - https://groups.google.com/group/rubyonrails-security/msg/8f1bbe1cef8c6caf?dmode=source&output=gplain