Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-2692 State: PUBLISHED Published: 2012-06-17T01:00:00 Last Updated: 2024-08-06T19:42:32.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html - http://www.securityfocus.com/bid/53921 - http://www.mantisbt.org/bugs/view.php?id=14016 - http://security.gentoo.org/
- http://www.securityfocus.com/bid/53921 - http://www.mantisbt.org/bugs/view.php?id=14016 - http://security.gentoo.org/glsa/glsa-201211-01.xml - http://www.openwall.com/lists/oss-security/2012/06/11/6 - http://www.mantisbt.org/bugs/changelog_page.php?version_id=148 - http://secunia.com/advisories/51199 - http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html - http://www.openwall.com/lists/oss-security/2012/06/09/1 - http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html - https://github.com/mantisbt/mantisbt/commit/ceafe6f0c679411b81368052633a63dd3ca06d9c
CVE ID: CVE-2012-2693 State: PUBLISHED Published: 2012-06-17T01:00:00 Last Updated: 2024-08-06T19:42:31.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple devices have the same vendor and product ID, which might cause the wrong device to be associated with a guest and might allow local users to access unintended USB devices. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/06/11/3 - http://rhn.redhat.com/errata/RHSA-2013-0127.html - https://www.redhat.com/archives/libvir-list/2012-April/msg01494.html - http://rhn.
dhat.com/errata/RHSA-2013-0127.html - https://www.redhat.com/archives/libvir-list/2012-April/msg01494.html - http://rhn.redhat.com/errata/RHSA-2012-0748.html - http://www.openwall.com/lists/oss-security/2012/06/11/2
CVE ID: CVE-2012-2694 State: PUBLISHED Published: 2012-06-22T14:00:00 Last Updated: 2024-08-06T19:42:31.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "['xyz', nil]" values, a related issue to CVE-2012-2660. Additional Analyst Notes: - CVE Program Container: References: - http://lists.ope
ues, a related issue to CVE-2012-2660. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html - http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html - https://groups.google.com/group/rubyonrails-security/msg/e2d3a87f2c211def?dmode=source&output=gplain - http://rhn.redhat.com/errata/RHSA-2013-0154.html
CVE ID: CVE-2012-2695 State: PUBLISHED Published: 2012-06-22T14:00:00 Last Updated: 2024-08-06T19:42:31.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html - http
- CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html - http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html - http://rhn.redhat.com/errata/RHSA-2013-0154.html - https://groups.google.com/group/rubyonrails-security/msg/aee3413fb038bf56?dmode=source&output=gplain
CVE ID: CVE-2012-2696 State: PUBLISHED Published: 2013-01-04T22:00:00 Last Updated: 2024-08-06T19:42:31.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: The backend in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a (1) SOAP or (2) GWT request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/56825 - http://rhn.redhat.com/errata/RHSA-2012-1506.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/80545 - http://www.securitytracker.com/id?1027838
CVE ID: CVE-2012-2697 State: PUBLISHED Published: 2013-02-24T21:00:00 Last Updated: 2024-08-06T19:42:31.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in autofs, as used in Red Hat Enterprise Linux (RHEL) 5, allows local users to cause a denial of service (autofs crash and delayed mounts) or prevent "mount expiration" via unspecified vectors related to "using an LDAP-based automount map." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/57183 - http://www.osvdb.org/89878 - http://rhn.redhat.com/errata/RHSA-2013-0132.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 - https://bugzi
.redhat.com/errata/RHSA-2013-0132.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 - https://bugzilla.redhat.com/show_bug.cgi?id=831772
CVE ID: CVE-2012-2698 State: PUBLISHED Published: 2012-06-29T19:00:00 Last Updated: 2024-08-06T19:42:31.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page. Additional Analyst Notes: - CVE Program Container: References: - http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-June/000116.html - https://www.mediawiki.org/wiki/Release_notes/1.18 - http://www.osvdb.org/82983 - http://lists.wikimedi
une/000116.html - https://www.mediawiki.org/wiki/Release_notes/1.18 - http://www.osvdb.org/82983 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-June/000117.html - http://secunia.com/advisories/49484 - https://bugzilla.wikimedia.org/show_bug.cgi?id=36938 - http://securitytracker.com/id?1027179 - https://www.mediawiki.org/wiki/Release_notes/1.19 - https://exchange.xforce.ibmcloud.com/vulnerabilities/76311 - https://www.mediawiki.org/wiki/Release_notes/1.17 - https://gerrit.wikimedia.org/r/#/c/7979/1/includes/SkinTemplate.php - http://www.openwall.com/lists/oss-security/2012/06/14/2 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-June/000118.html
CVE ID: CVE-2012-2699 State: REJECTED Published: 2012-06-27T00:00:00Z Last Updated: 2024-09-16T21:07:18.802Z Description: No description available.
CVE ID: CVE-2012-2700 State: REJECTED Published: 2012-06-27T00:00:00Z Last Updated: 2024-09-16T17:28:10.388Z Description: No description available.
CVE ID: CVE-2012-2701 State: REJECTED Published: 2012-06-27T00:00:00Z Last Updated: 2024-09-16T21:04:24.905Z Description: No description available.
CVE ID: CVE-2012-2702 State: PUBLISHED Published: 2012-06-27T00:00:00 Last Updated: 2024-08-06T19:42:31.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ubercart Product Keys module 6.x-1.x before 6.x-1.1 for Drupal does not properly check access for product keys, which allows remote attackers to read all unassigned product keys via certain conditions related to the uid. Additional Analyst Notes: - CVE Program Container: References: - http://drupalcode.org/project/uc_product_keys.git/commitdiff/19fa261 - http://drupal.org/node/1585532 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75720 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://secunia.com/
force.ibmcloud.com/vulnerabilities/75720 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://secunia.com/advisories/49169 - http://osvdb.org/82005 - http://drupal.org/node/1580752
CVE ID: CVE-2012-2703 State: PUBLISHED Published: 2012-06-27T00:00:00 Last Updated: 2024-08-06T19:42:32.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Advertisement module 6.x-2.x before 6.x-2.3 for Drupal, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to the "$conf variable in settings.php." Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1585544 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - https://drupal.org/node/1580376 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75718 - http://drupalcode.org/pro
https://drupal.org/node/1580376 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75718 - http://drupalcode.org/project/ad.git/commitdiff/4337f34
CVE ID: CVE-2012-2704 State: PUBLISHED Published: 2012-08-31T20:00:00 Last Updated: 2024-08-06T19:42:31.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Advertisement module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access to debug information, which allows remote attackers to obtain sensitive site configuration information that is specified by the $conf variable in settings.php. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1585544 - http://drupalcode.org/project/ad.git/commitdiff/c2ffab2 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75719 - http
p://www.openwall.com/lists/oss-security/2012/06/14/3 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75719 - https://drupal.org/node/1580376
CVE ID: CVE-2012-2705 State: PUBLISHED Published: 2012-06-27T00:00:00 Last Updated: 2024-08-06T19:42:31.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: The filter_titles function in the Smart Breadcrumb module 6.x-1.x before 6.x-1.3 for Drupal does not properly convert a title to plain-text, which allows remote authenticated users with create or edit node permissions to conduct cross-site scripting (XSS) attacks via the title parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/82006 - http://www.securityfocus.com/bid/53592 - http://drupal.org/node/1568216 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75713 - http://www.ope
bid/53592 - http://drupal.org/node/1568216 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75713 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://secunia.com/advisories/49163 - http://drupal.org/node/1585564 - http://drupalcode.org/project/smart_breadcrumb.git/commitdiff/834f75a
CVE ID: CVE-2012-2706 State: PUBLISHED Published: 2012-06-27T00:00:00 Last Updated: 2024-08-06T19:42:31.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to user registration. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53589 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75716 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://drupal.org/node/1585648
CVE ID: CVE-2012-2707 State: PUBLISHED Published: 2012-06-27T00:00:00 Last Updated: 2024-08-06T19:42:32.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal does not properly exit when users do not have access to package/task nodes, which allows remote attackers to bypass intended access restrictions and edit unauthorized nodes. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75715 - http://drupal.org/node/1585678 - http://drupal.org/node/1585658 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://community.aegirproject.org/1.9 - http
rg/node/1585658 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://community.aegirproject.org/1.9 - http://drupalcode.org/project/hostmaster.git/commitdiff/8a61101 - http://www.securityfocus.com/bid/53588
CVE ID: CVE-2012-2708 State: PUBLISHED Published: 2012-06-27T00:00:00 Last Updated: 2024-08-06T19:42:31.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules/hosting/task/hosting_task.module in the Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a Drush log message in a provision task log. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1585678 - http://drupal.org/node/1585658 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http
rupal.org/node/1585678 - http://drupal.org/node/1585658 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://community.aegirproject.org/1.9 - http://www.securityfocus.com/bid/53588 - http://drupalcode.org/project/hostmaster.git/commitdiff/9476561 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75714
CVE ID: CVE-2012-2709 State: REJECTED Published: 2012-06-29T19:00:00Z Last Updated: 2024-09-16T17:33:02.796Z Description: No description available.
CVE ID: CVE-2012-2710 State: PUBLISHED Published: 2012-06-27T00:00:00 Last Updated: 2024-08-06T19:42:32.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal, when "Append the content title to the end of the breadcrumb" is enabled, allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/628480 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://www.securityfocus.com/bid/53573 - http://drupal.org/node/1585960 - https://exchange.xforce.ibmcloud.c
2/06/14/3 - http://www.securityfocus.com/bid/53573 - http://drupal.org/node/1585960 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75711
CVE ID: CVE-2012-2711 State: PUBLISHED Published: 2012-06-27T00:00:00 Last Updated: 2024-08-06T19:42:31.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy List module 6.x-1.x before 6.x-1.4 for Drupal allow remote authenticated users with create or edit taxonomy terms permissions to inject arbitrary web script or HTML via vectors related to taxonomy information. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/82164 - http://drupal.org/node/1597262 - http://drupalcode.org/project/taxonomy_list.git/commitdiff/7dd21a0 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75867
drupalcode.org/project/taxonomy_list.git/commitdiff/7dd21a0 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75867 - http://www.securityfocus.com/bid/53671 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://drupal.org/node/1595396 - http://secunia.com/advisories/49238
CVE ID: CVE-2012-2712 State: PUBLISHED Published: 2012-06-27T00:00:00 Last Updated: 2024-08-06T19:42:31.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.1 for Drupal, when supporting manual entry of field identifiers, allow remote attackers to inject arbitrary web script or HTML via vectors related to thrown exceptions and logging errors. Additional Analyst Notes: - CVE Program Container: References: - http://drupalcode.org/project/search_api.git/commitdiff/5a18c8c - http://drupal.org/node/1597364 - http://secunia.com/advisories/49236 - http://www.openwall.com/lists/oss-security/2
8c - http://drupal.org/node/1597364 - http://secunia.com/advisories/49236 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75868 - http://www.osvdb.org/82230 - http://drupal.org/node/1596524 - http://www.securityfocus.com/bid/53672
CVE ID: CVE-2012-2713 State: PUBLISHED Published: 2012-06-27T00:00:00 Last Updated: 2024-08-06T19:42:32.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that login a user to another web site. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75869 - http://secunia.com/advisories/49227 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://www.securityfocus.com/bid/53673 - http://drupalcode.org
http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://www.securityfocus.com/bid/53673 - http://drupalcode.org/project/browserid.git/commitdiff/5e5cdcd - http://www.osvdb.org/82466 - https://drupal.org/node/1596464 - http://drupal.org/node/1597414
CVE ID: CVE-2012-2714 State: PUBLISHED Published: 2020-01-09T19:56:31 Last Updated: 2024-08-06T19:42:31.740Z Vendors: BrowserID Products: BrowserID Problem Types: Other Description: The BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users via the audience identifier. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1597414 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - https://drupal.org/node/1596464 - http://www.securityfocus.com/bid/53673
CVE ID: CVE-2012-2715 State: PUBLISHED Published: 2012-06-27T00:00:00 Last Updated: 2024-08-06T19:42:31.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the themes_links function in template.php in the Amadou theme module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to class attributes in a list of links. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1608730 - http://www.securityfocus.com/bid/53732 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://drupal.org/node/1608780 - http://www.osvdb.org/82433 - htt
p://www.openwall.com/lists/oss-security/2012/06/14/3 - http://drupal.org/node/1608780 - http://www.osvdb.org/82433 - http://drupalcode.org/project/amadou.git/commitdiff/071ea83 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75997 - http://secunia.com/advisories/49328
CVE ID: CVE-2012-2716 State: PUBLISHED Published: 2012-06-21T15:00:00 Last Updated: 2024-08-06T19:42:31.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Comment Moderation module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to hijack the authentication of administrators for requests that publish comments. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1608822 - http://drupal.org/node/1538768 - http://secunia.com/advisories/49326 - http://osvdb.org/82434 - http://www.securityfocus.com/bid/53738 - http://drupalcode.org/project/comment_moderation.git/commitdiff/f18c3de - h
4 - http://www.securityfocus.com/bid/53738 - http://drupalcode.org/project/comment_moderation.git/commitdiff/f18c3de - https://exchange.xforce.ibmcloud.com/vulnerabilities/75998
CVE ID: CVE-2012-2717 State: PUBLISHED Published: 2012-06-27T21:00:00 Last Updated: 2024-08-06T19:42:32.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Mobile Tools module 6.x-2.x before 6.x-2.3 for Drupal allow remote attackers to inject arbitrary web script or HTML via the (1) Mobile URL field or (2) Desktop URL field to the General configuration page, or the (3) message to the Mobile Tools block message options. Additional Analyst Notes: - CVE Program Container: References: - http://drupalcode.org/project/mobile_tools.git/commitdiff/614b0fc - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://www.secu
/project/mobile_tools.git/commitdiff/614b0fc - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://www.securityfocus.com/bid/53734 - http://osvdb.org/82410 - http://drupal.org/node/1169008 - http://drupal.org/node/1608828 - https://exchange.xforce.ibmcloud.com/vulnerabilities/76002 - http://secunia.com/advisories/49318 - http://www.madirish.net/content/drupal-mobile-tools-6x-23-xss
CVE ID: CVE-2012-2718 State: PUBLISHED Published: 2012-06-21T15:00:00 Last Updated: 2024-08-06T19:42:32.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Counter module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "recording visits." Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/76004 - http://osvdb.org/82527 - http://drupal.org/node/1608854 - http://www.securityfocus.com/bid/53736
CVE ID: CVE-2012-2719 State: PUBLISHED Published: 2012-06-27T00:00:00Z Last Updated: 2024-09-17T04:29:05.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: The filedepot module 6.x-1.x before 6.x-1.3 for Drupal, when accessed using multiple different browsers from the same IP address, causes Internet Explorer sessions to "switch users" when uploading a file, which has unspecified impact possibly involving file uploads to the wrong user directory, aka "Session Management Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/06/14/3 - http://www.osvdb.org/82575 - http://drupal.org/node/1608864 - http://drup
openwall.com/lists/oss-security/2012/06/14/3 - http://www.osvdb.org/82575 - http://drupal.org/node/1608864 - http://drupal.org/node/1598782 - http://secunia.com/advisories/49316
CVE ID: CVE-2012-2720 State: PUBLISHED Published: 2012-06-27T00:00:00 Last Updated: 2024-08-06T19:42:32.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remote attackers to perform requests with extra privileges. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/49400 - http://drupal.org/node/1618476 - http://www.osvdb.org/82727 - http://www.securityfocus.com/bid/53840 - http://www.openwall.com/lists/oss-security/2012/06/14/3 - https://exchange.xforce.ibmcloud.com/vulnerabilities/76141 - http://drup
.openwall.com/lists/oss-security/2012/06/14/3 - https://exchange.xforce.ibmcloud.com/vulnerabilities/76141 - http://drupal.org/node/1619808