Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2011-3577 State: PUBLISHED Published: 2011-09-20T10:00:00 Last Updated: 2024-08-06T23:37:48.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.3 does not properly implement Activity Token authentication for Web Services, which has unspecified impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/45999 - http://www.ibm.com/support/docview.wss?uid=swg24030908 - http://www.ibm.com/support/docview.wss?uid=swg1JR40420 - http://www.osvdb.org/75428 - http://www.securityfocus.com/bid/49643 - https://exchange.xforce.ibmcloud.com/vulnerabilities
tp://www.osvdb.org/75428 - http://www.securityfocus.com/bid/49643 - https://exchange.xforce.ibmcloud.com/vulnerabilities/69838
CVE ID: CVE-2011-3578 State: PUBLISHED Published: 2011-09-21T16:00:00 Last Updated: 2024-08-06T23:37:48.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bug_actiongroup_page.php, a different vulnerability than CVE-2011-3357. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/8392 - https://github.com/mantisbt/mantisbt/commit/6ede60d3db9e202044f135001589cce941ff6f0f - http://www.debian.org/security/2011/dsa-2308 - http://www.openw
ntisbt/commit/6ede60d3db9e202044f135001589cce941ff6f0f - http://www.debian.org/security/2011/dsa-2308 - http://www.openwall.com/lists/oss-security/2011/09/04/1 - http://security.gentoo.org/glsa/glsa-201211-01.xml - https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_mantisbt.html - http://www.openwall.com/lists/oss-security/2011/09/04/2 - http://secunia.com/advisories/45961 - https://github.com/mantisbt/mantisbt/commit/5b93161f3ece2f73410c296fed8522f6475d273d - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297 - https://bugzilla.redhat.com/show_bug.cgi?id=735514 - http://www.securityfocus.com/bid/49448 - http://www.mantisbt.org/bugs/view.php?id=13281 - http://secunia.com/advis
514 - http://www.securityfocus.com/bid/49448 - http://www.mantisbt.org/bugs/view.php?id=13281 - http://secunia.com/advisories/51199 - http://www.openwall.com/lists/oss-security/2011/09/09/9 - http://lists.debian.org/debian-security-tracker/2011/09/msg00012.html - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.html - http://www.securityfocus.com/archive/1/519547/100/0/threaded
CVE ID: CVE-2011-3579 State: PUBLISHED Published: 2011-09-30T17:00:00 Last Updated: 2024-08-06T23:37:48.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2011-09/0145.html - http://www.securityfocus.com/bid/49753 - https://www.trustwave.com/spiderlabs/advisor
chives/bugtraq/2011-09/0145.html - http://www.securityfocus.com/bid/49753 - https://www.trustwave.com/spiderlabs/advisories/TWSL2011-013.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/70025 - http://securityreason.com/securityalert/8404 - http://www.osvdb.org/75721 - http://securitytracker.com/id?1026093
CVE ID: CVE-2011-3580 State: PUBLISHED Published: 2011-09-30T17:00:00 Last Updated: 2024-08-06T23:37:48.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to obtain configuration information via a direct request to the /server URI, which triggers a call to the phpinfo function. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2011-09/0145.html - http://www.securityfocus.com/bid/49753 - http://www.osvdb.org/75722 - https://exchange.xforce.ibmcloud.com/vulnerabilities/70026 - https://www.trustwave.com/spiderlabs/advisories/TWSL2011-013.txt - h
xchange.xforce.ibmcloud.com/vulnerabilities/70026 - https://www.trustwave.com/spiderlabs/advisories/TWSL2011-013.txt - http://securityreason.com/securityalert/8404 - http://securitytracker.com/id?1026093
CVE ID: CVE-2011-3581 State: PUBLISHED Published: 2011-11-04T21:00:00 Last Updated: 2024-08-06T23:37:48.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the ldns_rr_new_frm_str_internal function in ldns before 1.6.11 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Resource Record (RR) with an unknown type containing input that is longer than a specified length. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/46476 - http://www.securityfocus.com/bid/49748 - http://seclists.org/oss-sec/2011/q3/542 - http://secunia.com/advisories/46470 - http://secli
curityfocus.com/bid/49748 - http://seclists.org/oss-sec/2011/q3/542 - http://secunia.com/advisories/46470 - http://seclists.org/oss-sec/2011/q3/503 - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068239.html - http://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=403 - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068201.html - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068091.html - http://nlnetlabs.nl/svn/ldns/tags/release-1.6.11/Changelog - http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00008.html
CVE ID: CVE-2011-3582 State: PUBLISHED Published: 2020-01-22T15:00:18 Last Updated: 2024-08-06T23:37:48.320Z Vendors: Electron Inc. Products: Advanced Electron Forums (AEF) Problem Types: CSRF Description: A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for sensitive transactions in the administrator functions. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2011/09/30/3
CVE ID: CVE-2011-3583 State: PUBLISHED Published: 2019-11-25T23:21:26 Last Updated: 2024-08-06T23:37:48.367Z Vendors: TYPO3 Core Products: TYPO3 Core Problem Types: SQL Injection Description: It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2011-3583 - https://access.redhat.com/security/cve/cve-2011-3583 - https://typo3.org/security/a
r.debian.org/tracker/CVE-2011-3583 - https://access.redhat.com/security/cve/cve-2011-3583 - https://typo3.org/security/advisory/typo3-core-sa-2011-002/ - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=641682
CVE ID: CVE-2011-3584 State: PUBLISHED Published: 2019-11-25T23:31:31 Last Updated: 2024-08-06T23:37:48.318Z Vendors: TYPO3 Core Products: wec_discussion Problem Types: SQL Injection Description: The TYPO3 Core wec_discussion extension before 2.1.1 is vulnerable to SQL Injection due to improper sanitation of user-supplied input. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2011-3584 - https://access.redhat.com/security/cve/cve-2011-3584 - https://typo3.org/security/advisory/typo3-sa-2011-003/
CVE ID: CVE-2011-3585 State: PUBLISHED Published: 2019-12-31T19:47:07 Last Updated: 2024-08-06T23:37:48.666Z Vendors: Samba Products: Samba Problem Types: General Race Condition Description: Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal during a time window when the /etc/mtab~ file exists. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.samba.org/show_bug.cgi?id=7179 - https://bugzilla.redhat.com/show_bug.cgi?id=742907 - https://www.openwall.com/lists/oss-security/2011/09/27/1 - https://www.openwall.com/lists/oss-security/2011/09/3
42907 - https://www.openwall.com/lists/oss-security/2011/09/27/1 - https://www.openwall.com/lists/oss-security/2011/09/30/5 - https://git.samba.org/?p=cifs-utils.git%3Ba=commitdiff%3Bh=810f7e4e0f2dbcbee0294d9b371071cb08268200
CVE ID: CVE-2011-3586 State: REJECTED Published: 2019-11-13T17:14:40 Last Updated: 2019-11-13T17:14:40 Description: No description available.
CVE ID: CVE-2011-3587 State: PUBLISHED Published: 2011-10-10T10:00:00 Last Updated: 2024-08-06T23:37:48.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=742297 - http://secunia.com/advisories/46221 - http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0 - http://secunia.com/advisories/46323 - http://plone.org/pr
http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0 - http://secunia.com/advisories/46323 - http://plone.org/products/plone/security/advisories/20110928 - http://zope2.zope.org/news/security-vulnerability-announcement-cve-2011-3587 - http://plone.org/products/plone-hotfix/releases/20110928 - http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zip
CVE ID: CVE-2011-3588 State: PUBLISHED Published: 2014-02-15T11:00:00 Last Updated: 2024-08-06T23:37:48.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, disables the StrictHostKeyChecking option, which allows man-in-the-middle attackers to spoof kdump servers, and obtain sensitive core information, by using an arbitrary SSH key. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=716439 - http://rhn.redhat.com/errata/RHSA-2011-1532.h
tainer: References: - https://bugzilla.redhat.com/show_bug.cgi?id=716439 - http://rhn.redhat.com/errata/RHSA-2011-1532.html - http://rhn.redhat.com/errata/RHSA-2012-0152.html
CVE ID: CVE-2011-3589 State: PUBLISHED Published: 2014-02-15T11:00:00 Last Updated: 2024-08-06T23:37:48.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, uses world-readable permissions for vmcore files, which allows local users to obtain sensitive information by inspecting the file content, as demonstrated by a search for a root SSH key. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=716439 - http://rhn.redhat.com/errata/RHSA-2011-1532.html - http://rhn
es: - https://bugzilla.redhat.com/show_bug.cgi?id=716439 - http://rhn.redhat.com/errata/RHSA-2011-1532.html - http://rhn.redhat.com/errata/RHSA-2012-0152.html
CVE ID: CVE-2011-3590 State: PUBLISHED Published: 2014-02-15T11:00:00 Last Updated: 2024-08-06T23:37:48.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, includes all of root's SSH private keys within a vmcore file, which allows context-dependent attackers to obtain sensitive information by inspecting the file content. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=716439 - http://rhn.redhat.com/errata/RHSA-2011-1532.html - http://rhn.redhat.com/errata/R
la.redhat.com/show_bug.cgi?id=716439 - http://rhn.redhat.com/errata/RHSA-2011-1532.html - http://rhn.redhat.com/errata/RHSA-2012-0152.html
CVE ID: CVE-2011-3591 State: PUBLISHED Published: 2014-12-26T02:00:00 Last Updated: 2024-08-06T23:37:48.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpmyadmin/phpmyadmin/commit/bda213c58aec44925be661acb0e76c19483ea170 - http://www.openwall.com/lists/oss-secu
ithub.com/phpmyadmin/phpmyadmin/commit/bda213c58aec44925be661acb0e76c19483ea170 - http://www.openwall.com/lists/oss-security/2011/09/30/8 - http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php - https://bugzilla.redhat.com/show_bug.cgi?id=738681
CVE ID: CVE-2011-3592 State: PUBLISHED Published: 2014-12-26T02:00:00 Last Updated: 2024-08-06T23:37:48.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpmyadmin/phpmyadmin/commit/2f28ce9c800274190418da0945ce3647d36e1db6 - http://www.openwall.com/lists/oss-security/201
m/phpmyadmin/phpmyadmin/commit/2f28ce9c800274190418da0945ce3647d36e1db6 - http://www.openwall.com/lists/oss-security/2011/09/30/8 - http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php - https://bugzilla.redhat.com/show_bug.cgi?id=738681
CVE ID: CVE-2011-3593 State: PUBLISHED Published: 2013-06-08T10:00:00Z Last Updated: 2024-08-06T23:37:48.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: A certain Red Hat patch to the vlan_hwaccel_do_receive function in net/8021q/vlan_core.c in the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 allows remote attackers to cause a denial of service (system crash) via priority-tagged VLAN frames. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=742846 - http://www.openwall.com/lists/oss-security/2012/03/05/3 - https://oss.oracle.com/git/?p=redpatch.git%3Ba=commit%3Bh=fadca7bdc43b02f518585d9547019966415cadfd -
ity/2012/03/05/3 - https://oss.oracle.com/git/?p=redpatch.git%3Ba=commit%3Bh=fadca7bdc43b02f518585d9547019966415cadfd - https://oss.oracle.com/git/?p=redpatch.git%3Ba=commit%3Bh=0e48f8daac293335e16e007663b9f4d248f89f0c
CVE ID: CVE-2011-3594 State: PUBLISHED Published: 2011-11-04T21:00:00 Last Updated: 2024-08-06T23:37:48.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2. Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18034 - http://developer.pid
s: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18034 - http://developer.pidgin.im/viewmtn/revision/diff/be5e66abad2af29604bc794cc4c6600ab12751f3/with/7eb1f6d56cc58bbb5b56b7df53955d36b9b419b8 - https://bugzilla.redhat.com/show_bug.cgi?id=743481 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:183 - http://secunia.com/advisories/46376 - http://developer.pidgin.im/ticket/14636 - http://www.redhat.com/support/errata/RHSA-2011-1371.html - http://pidgin.im/news/security/?id=56
CVE ID: CVE-2011-3595 State: PUBLISHED Published: 2020-01-22T15:20:54 Last Updated: 2024-08-06T23:37:48.372Z Vendors: Joomla! Products: Joomla! Problem Types: XSS Description: Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2011/10/04/7 - https://www.rapid7.com/db/vulnerabilities/joomla-20110902-core-xss-vulnerability - http://yehg.net/lab/pr0js/advisories/joomla/core/%5Bjoomla_1.7.0-stable%5D_cross_site_scripting%28XSS%29
CVE ID: CVE-2011-3596 State: PUBLISHED Published: 2019-11-25T23:53:10 Last Updated: 2024-08-06T23:37:48.494Z Vendors: polipo Products: polipo Problem Types: Other Description: Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2011-3596 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3596 - https://access.redhat.com/security/cve/cve-2011-3596 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=644289
CVE ID: CVE-2011-3597 State: PUBLISHED Published: 2012-01-13T18:00:00 Last Updated: 2024-08-06T23:37:48.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor. Additional Analyst Notes: - CVE Program Container: References: - http://www.redhat.com/support/errata/RHSA-2011-1797.html - https://bugzilla.redhat.com/show_bug.cgi?id=743010 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:009 - http://aix.software.ibm.com/aix/efixes/security/perl_advisory2.asc - http://www.ubuntu.com/usn/USN-1643-1 - https://oval.cisecur
ix.software.ibm.com/aix/efixes/security/perl_advisory2.asc - http://www.ubuntu.com/usn/USN-1643-1 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19446 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:008 - http://www.redhat.com/support/errata/RHSA-2011-1424.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 - http://secunia.com/advisories/46279 - http://secunia.com/advisories/51457 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735 - http://cpansearch.perl.org/src/GAAS/Digest-1.17/Changes - http://www.securityfocus.com/bid/49911
CVE ID: CVE-2011-3598 State: PUBLISHED Published: 2011-10-08T01:00:00 Last Updated: 2024-08-06T23:37:48.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in phpPgAdmin before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) a web page title, related to classes/Misc.php; or the (2) return_url or (3) return_desc parameter to display.php. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/067843.html - http://secunia.com/advisories/46426 - http://sourceforge.net/mailarchive/forum.php?thread_name=4E897F6C.90905%40free.fr
http://secunia.com/advisories/46426 - http://sourceforge.net/mailarchive/forum.php?thread_name=4E897F6C.90905%40free.fr&forum_name=phppgadmin-news - http://lists.opensuse.org/opensuse-updates/2012-04/msg00033.html - https://github.com/phppgadmin/phppgadmin/commit/1df248203de055f97e092b50b1dd9643ccb73842 - https://bugs.gentoo.org/show_bug.cgi?id=385505 - http://secunia.com/advisories/46248 - http://osvdb.org/75998 - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/067846.html - http://www.openwall.com/lists/oss-security/2011/10/04/10 - http://freshmeat.net/projects/phppgadmin/releases/336969 - http://www.openwall.com/lists/oss-security/2011/10/04/1 - http://www.security
.net/projects/phppgadmin/releases/336969 - http://www.openwall.com/lists/oss-security/2011/10/04/1 - http://www.securityfocus.com/bid/49914 - https://bugzilla.redhat.com/show_bug.cgi?id=743205 - http://osvdb.org/75997 - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068009.html
CVE ID: CVE-2011-3599 State: PUBLISHED Published: 2011-10-10T10:00:00 Last Updated: 2024-08-06T23:37:48.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/49928 - http://www.openwall.com/lists/oss-security/2011/10/05/9 - http://osvdb.org/76025 - https://rt.cpan.org/Public/Bug/Display.html?id=71421 - https://bugzilla.redhat.
/2011/10/05/9 - http://osvdb.org/76025 - https://rt.cpan.org/Public/Bug/Display.html?id=71421 - https://bugzilla.redhat.com/show_bug.cgi?id=743567 - http://www.openwall.com/lists/oss-security/2011/10/05/5 - http://secunia.com/advisories/46275
CVE ID: CVE-2011-3600 State: PUBLISHED Published: 2019-11-26T00:07:23 Last Updated: 2024-08-06T23:37:48.424Z Vendors: OFBiz Products: OFBiz Problem Types: Other Description: The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2011-3600
itional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2011-3600 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3600 - https://access.redhat.com/security/cve/cve-2011-3600 - https://lists.apache.org/thread.html/7793319ae80ec350f7b82a8763460944f120ebe447f14a12155d0550%40%3Ccommits.ofbiz.apache.org%3E - http://mail-archives.apache.org/mod_mbox/ofbiz-user/201810.mbox/%3Cfad45546-af86-0293-9ea7-014553474b30%40apache.org%3E
CVE ID: CVE-2011-3601 State: PUBLISHED Published: 2014-02-17T16:00:00 Last Updated: 2024-08-06T23:37:48.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative value in a label_len value. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2011/10/06/3 - http://www.litech.org/radvd/CHANGES - http://www.ubuntu.com/usn/USN-1257-1
CVE ID: CVE-2011-3602 State: PUBLISHED Published: 2014-04-27T21:00:00 Last Updated: 2024-08-06T23:37:48.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name. NOTE: this can be leveraged with a symlink to overwrite arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2011/10/06/3 - http://www.debian.org/security/2011/dsa-2323 - https://github.com/reubenhwk/radvd/commit/