Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-4458 State: PUBLISHED Published: 2013-03-12T15:00:00Z Last Updated: 2024-09-17T02:57:32.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a connection.start-ok message. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=861234 - https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%20%220.21%22%20AND%20project%20%3D%20QPID - http://rhn.redhat.com/errata/RHSA-2013-0561.html - https://
fixVersion%20%3D%20%220.21%22%20AND%20project%20%3D%20QPID - http://rhn.redhat.com/errata/RHSA-2013-0561.html - https://issues.apache.org/jira/browse/QPID-4629 - http://rhn.redhat.com/errata/RHSA-2013-0562.html - http://svn.apache.org/viewvc?view=revision&revision=1453031 - http://secunia.com/advisories/52516
CVE ID: CVE-2012-4459 State: PUBLISHED Published: 2013-03-12T15:00:00Z Last Updated: 2024-09-16T17:27:46.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=861241 - https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%20%220.21%22%20AND%20project%20%3D%20QPID - http://rhn.redhat.com/errata/RHSA-2013-0561.html - https://issues.apache.org/jira/br
1%22%20AND%20project%20%3D%20QPID - http://rhn.redhat.com/errata/RHSA-2013-0561.html - https://issues.apache.org/jira/browse/QPID-4629 - http://rhn.redhat.com/errata/RHSA-2013-0562.html - http://svn.apache.org/viewvc?view=revision&revision=1453031 - http://secunia.com/advisories/52516
CVE ID: CVE-2012-4460 State: PUBLISHED Published: 2013-03-12T15:00:00Z Last Updated: 2024-08-06T20:35:09.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not trigger a crash. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=861242 - https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%20%220.21%22%20AND%20project%20%3D%20QPI
bug.cgi?id=861242 - https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%20%220.21%22%20AND%20project%20%3D%20QPID - https://issues.apache.org/jira/browse/QPID-4629 - http://svn.apache.org/viewvc?view=revision&revision=1453031
CVE ID: CVE-2012-4461 State: PUBLISHED Published: 2013-01-22T23:00:00 Last Updated: 2024-08-06T20:35:09.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without XSAVE, allows local users to cause a denial of service (kernel OOPS) by using the KVM_SET_SREGS ioctl to set the X86_CR4_OSXSAVE bit in the guest cr4 register, then calling the KVM_RUN ioctl. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-0223.html - http://www.securityfocus.com/bid/56414 - https://bugzilla.redhat.com/show_bug.cgi?id=862900 - http://rhn.redhat.com/er
- http://www.securityfocus.com/bid/56414 - https://bugzilla.redhat.com/show_bug.cgi?id=862900 - http://rhn.redhat.com/errata/RHSA-2013-0882.html - http://secunia.com/advisories/51160 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git%3Ba=commit%3Bh=6d1068b3a98519247d8ba4ec85cd40ac136dbdf9 - http://article.gmane.org/gmane.comp.emulators.kvm.devel/100742 - https://www.suse.com/support/update/announcement/2012/suse-su-20121679-1.html - http://www.openwall.com/lists/oss-security/2012/11/06/14 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.6.9 - http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
CVE ID: CVE-2012-4462 State: PUBLISHED Published: 2013-03-12T15:00:00Z Last Updated: 2024-08-06T20:35:09.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service (condor_schedd restart) via square brackets in the cproc option. Additional Analyst Notes: - CVE Program Container: References: - https://htcondor-git.cs.wisc.edu/?p=condor.git%3Ba=commitdiff%3Bh=8f9b304c4f6c0a98dafa61b2c0e4beb3b70e4c84 - http://rhn.redhat.com/errata/RHSA-2013-0564.html - http://rhn.redhat.com/errata/RHSA-2013-0565.html - https://bugzilla.redhat.com/show_bug.cgi?id=8
a/RHSA-2013-0564.html - http://rhn.redhat.com/errata/RHSA-2013-0565.html - https://bugzilla.redhat.com/show_bug.cgi?id=860850
CVE ID: CVE-2012-4463 State: PUBLISHED Published: 2012-10-10T18:00:00 Last Updated: 2024-08-06T20:35:09.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: Midnight Commander (mc) 4.8.5 does not properly handle the (1) MC_EXT_SELECTED or (2) MC_EXT_ONLYTAGGED environment variables when multiple files are selected, which allows user-assisted remote attackers to execute arbitrary commands via a crafted file name. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/03/5 - https://www.midnight-commander.org/ticket/2913 - https://bugs.gentoo.org/show_bug.cgi?id=436518#c7 - http://www.openwall.com/lists/oss-security/2012/1
.org/ticket/2913 - https://bugs.gentoo.org/show_bug.cgi?id=436518#c7 - http://www.openwall.com/lists/oss-security/2012/10/03/4 - https://bugzilla.redhat.com/show_bug.cgi?id=862813 - http://www.securityfocus.com/bid/55777 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79033
CVE ID: CVE-2012-4464 State: PUBLISHED Published: 2013-04-25T23:00:00 Last Updated: 2024-08-06T20:35:09.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the (1) exc_to_s or (2) name_err_to_s API function, which marks the string as tainted, a different vulnerability than CVE-2012-4466. NOTE: this issue might exist because of a CVE-2011-1005 regression. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=862598 - http://www.openwall.com/lists/oss-security/2012
iner: References: - https://bugzilla.redhat.com/show_bug.cgi?id=862598 - http://www.openwall.com/lists/oss-security/2012/10/02/4 - http://www.openwall.com/lists/oss-security/2012/10/03/9 - http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089554.html - http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089887.html - http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/ - http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068
CVE ID: CVE-2012-4465 State: PUBLISHED Published: 2012-10-10T18:00:00 Last Updated: 2024-08-06T20:35:09.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the "Author" field in a commit. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/09/30/1 - http://git.zx2c4.com/cgit/commit/?id=7757d1b046ecb67b830151d20715c658867df1ec - http://hjemli.net/pipermail/cgit/2012-July/000652.html - https://bugzilla.
id=7757d1b046ecb67b830151d20715c658867df1ec - http://hjemli.net/pipermail/cgit/2012-July/000652.html - https://bugzilla.redhat.com/show_bug.cgi?id=820733 - http://secunia.com/advisories/50734 - http://www.securityfocus.com/bid/55724 - http://www.openwall.com/lists/oss-security/2012/10/03/7
CVE ID: CVE-2012-4466 State: PUBLISHED Published: 2013-04-25T23:00:00 Last Updated: 2024-08-06T20:35:09.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/02/4 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:124 - http://www.openwall.com/lis
ss-security/2012/10/02/4 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:124 - http://www.openwall.com/lists/oss-security/2012/10/03/9 - https://bugzilla.redhat.com/show_bug.cgi?id=862614 - http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089554.html - http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089887.html - http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/ - http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068 - https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0294
CVE ID: CVE-2012-4467 State: PUBLISHED Published: 2012-10-10T21:00:00 Last Updated: 2024-08-06T20:35:09.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) do_siocgstamp and (2) do_siocgstampns functions in net/socket.c in the Linux kernel before 3.5.4 use an incorrect argument order, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a crafted ioctl call. Additional Analyst Notes: - CVE Program Container: References: - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.4 - http://www.securityfocus.com/bid/55785 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=
ttp://www.securityfocus.com/bid/55785 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ed6fe9d614fc1bca95eb8c0ccd0e92db00ef9d5d - https://github.com/torvalds/linux/commit/ed6fe9d614fc1bca95eb8c0ccd0e92db00ef9d5d - http://www.openwall.com/lists/oss-security/2012/10/04/2
CVE ID: CVE-2012-4468 State: PUBLISHED Published: 2012-11-30T22:00:00 Last Updated: 2024-08-06T20:35:09.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Privatemsg module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a user name in a private message. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/3 - http://drupal.org/node/1649338 - http://www.securityfocus.com/bid/54110 - http://drupal.org/node/1649346
CVE ID: CVE-2012-4469 State: PUBLISHED Published: 2012-11-30T22:00:00Z Last Updated: 2024-09-16T23:55:58.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal, when "Log failed hashcash" is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid token, which is not properly handled when administrators use the Database logging module. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/3 - http://drupal.org/node/1650790 - http://drupal.org/node/1650784 - http://dr
enwall.com/lists/oss-security/2012/10/04/3 - http://drupal.org/node/1650790 - http://drupal.org/node/1650784 - http://drupal.org/node/1663306
CVE ID: CVE-2012-4470 State: PUBLISHED Published: 2012-11-30T22:00:00 Last Updated: 2024-08-06T20:35:09.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Listhandler module 6.x-1.x before 6.x-1.1 for Drupal does not properly check permissions when importing emails, which allows remote comment authors to bypass access restrictions and possibly have other unspecified impact. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/54376 - http://www.openwall.com/lists/oss-security/2012/10/04/3 - http://drupal.org/node/1819780 - http://drupal.org/node/1679412
CVE ID: CVE-2012-4471 State: PUBLISHED Published: 2012-11-30T22:00:00 Last Updated: 2024-08-06T20:35:10.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Search Autocomplete module 7.x-2.x before 7.x-2.4 for Drupal does not properly restrict access to the module admin page, which allows remote attackers to disable an autocompletion or change the priority order via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/3 - http://drupal.org/node/1679422 - http://drupal.org/node/1649442 - http://www.securityfocus.com/bid/54379
CVE ID: CVE-2012-4472 State: PUBLISHED Published: 2012-11-30T22:00:00 Last Updated: 2024-08-06T20:35:09.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in upload.php in the Drag & Drop Gallery module 6.x-1.5 and earlier for Drupal allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the directory specified by the filedir parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.opensyscom.fr/Actualites/drupal-modules-drag-a-drop-gallery-arbitrary-file-upload-vulnerability.html - http://www
://www.opensyscom.fr/Actualites/drupal-modules-drag-a-drop-gallery-arbitrary-file-upload-vulnerability.html - http://www.securityfocus.com/bid/54380 - http://www.openwall.com/lists/oss-security/2012/10/04/5 - http://secunia.com/advisories/49698 - http://drupal.org/node/1679442
CVE ID: CVE-2012-4473 State: PUBLISHED Published: 2012-11-30T22:00:00 Last Updated: 2024-08-06T20:35:09.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "view any node page" or "view any node {type} page" permission to access unpublished nodes via a direct request. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/3 - http://drupal.org/node/1679466 - http://www.securityfocus.com/bid/54407 - http://drupal.org/node/1662724
CVE ID: CVE-2012-4474 State: PUBLISHED Published: 2012-11-30T22:00:00 Last Updated: 2024-08-06T20:35:09.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Colorbox Node module 7.x-2.x before 7.x-2.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1679486 - http://drupal.org/node/1679410 - http://www.openwall.com/lists/oss-security/2012/10/04/3 - http://www.securityfocus.com/bid/54406
CVE ID: CVE-2012-4475 State: PUBLISHED Published: 2012-11-30T22:00:00Z Last Updated: 2024-09-16T19:01:35.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Security Questions module for Drupal 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1 does not properly restrict access, which allows remote attackers to edit an arbitrary user's questions and answers via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1648204 - http://drupal.org/node/1679532 - http://www.openwall.com/lists/oss-security/2012/10/04/3 - http://drupal.org/node/1648200
CVE ID: CVE-2012-4476 State: PUBLISHED Published: 2012-11-30T22:00:00Z Last Updated: 2024-09-16T20:31:52.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/5 - http://drupal.org/node/1679442
CVE ID: CVE-2012-4477 State: PUBLISHED Published: 2012-11-30T22:00:00Z Last Updated: 2024-09-17T00:40:38.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to bypass access restrictions via unknown attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/5 - http://drupal.org/node/1679442
CVE ID: CVE-2012-4478 State: PUBLISHED Published: 2012-11-30T22:00:00Z Last Updated: 2024-09-16T17:32:59.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/5 - http://drupal.org/node/1679442
CVE ID: CVE-2012-4479 State: PUBLISHED Published: 2012-11-30T22:00:00Z Last Updated: 2024-09-16T19:19:25.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/5 - http://drupal.org/node/1679442
CVE ID: CVE-2012-4480 State: PUBLISHED Published: 2019-12-02T17:44:10 Last Updated: 2024-08-06T20:35:09.800Z Vendors: mom Products: mom Problem Types: creates world-writable pid file Description: mom creates world-writable pid files in /var/run Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4480 - https://access.redhat.com/security/cve/cve-2012-4480 - http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090188.html - http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089658.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/79190
CVE ID: CVE-2012-4481 State: PUBLISHED Published: 2013-05-02T14:00:00 Last Updated: 2024-08-06T20:35:09.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects. NOTE: this issue is due to an incomplete fix for CVE-2011-1005. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-0612.html - http://www.openwall.com/lists/oss-security/2012/10/05/4 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:124 - http://rhn.redhat.com/errata/RHSA-2013-0129.html - https://bugzilla.redhat.c
m/security/advisories?name=MDVSA-2013:124 - http://rhn.redhat.com/errata/RHSA-2013-0129.html - https://bugzilla.redhat.com/show_bug.cgi?id=863484 - https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0294
CVE ID: CVE-2012-4482 State: PUBLISHED Published: 2012-10-31T16:00:00Z Last Updated: 2024-09-16T20:42:44.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ubercart SecureTrading Payment Method module 6.x for Drupal does not properly verify payment notification information, which allows remote attackers to purchase an item without paying via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/6 - http://drupal.org/node/1679820 - http://www.openwall.com/lists/oss-security/2012/10/07/1
CVE ID: CVE-2012-4483 State: PUBLISHED Published: 2012-10-31T16:00:00Z Last Updated: 2024-09-17T04:05:03.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: The commons_discussion_views_default_views function in modules/features/commons_discussion/commons_discussion.views_default.inc in the Drupal Commons module 6.x-2.x before 6.x-2.8 for Drupal does not properly enforce intended node access restrictions, which might allow remote attackers to obtain sensitive information via the recent comments listing. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/6 - http://drupalcode.org/project/commons.git/commitdiff/8ef
es: - http://www.openwall.com/lists/oss-security/2012/10/04/6 - http://drupalcode.org/project/commons.git/commitdiff/8ef688b - http://drupal.org/node/1679820 - http://drupal.org/node/1679908 - http://www.openwall.com/lists/oss-security/2012/10/07/1
CVE ID: CVE-2012-4484 State: PUBLISHED Published: 2012-10-31T16:00:00 Last Updated: 2024-08-06T20:35:09.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the administrative interface in the Campaign Monitor module before 6.x-2.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this refers to an issue in an independently developed Drupal module, and NOT an issue in the Campaign Monitor software itself (described on the campaignmonitor.com web site). Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/6 - http://www
alyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/6 - http://www.openwall.com/lists/oss-security/2012/10/07/1 - http://drupal.org/node/1689790 - http://drupal.org/node/1691446
CVE ID: CVE-2012-4485 State: PUBLISHED Published: 2012-10-31T16:00:00 Last Updated: 2024-08-06T20:35:09.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the galleryformatter_field_formatter_view functiuon in galleryformatter.tpl.php the Gallery formatter module before 7.x-1.2 for Drupal allow remote authenticated users with permissions to create a node or entity to inject arbitrary web script or HTML via the (1) title or (2) alt parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/6 - http://drupalcode.org/project/galleryformatter.git/commitdiff/b
ttp://www.openwall.com/lists/oss-security/2012/10/04/6 - http://drupalcode.org/project/galleryformatter.git/commitdiff/b0392a1 - http://drupal.org/node/1699744 - http://drupal.org/node/1700578 - http://www.securityfocus.com/bid/54674 - http://www.openwall.com/lists/oss-security/2012/10/07/1
CVE ID: CVE-2012-4486 State: PUBLISHED Published: 2012-11-02T15:00:00Z Last Updated: 2024-09-17T02:22:01.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Subuser module before 6.x-1.8 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that switch the user to a subuser via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/6 - http://drupal.org/node/1700584 - http://drupal.org/node/1700550 - http://www.openwall.com/lists/oss-security/2012/10/07/1
CVE ID: CVE-2012-4487 State: PUBLISHED Published: 2012-11-02T15:00:00Z Last Updated: 2024-09-16T22:40:31.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/10/04/6 - http://drupal.org/node/1700584 - http://drupal.org/node/1700550 - http://www.openwall.com/lists/oss-security/2012/10/07/1