Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-5526 State: PUBLISHED Published: 2012-11-21T23:00:00 Last Updated: 2024-08-06T21:05:47.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/80098 - http://secunia.com/advisories/55314 - http://www.securityfocus.com/bid/56562 - http://cpansearch.perl.
abilities/80098 - http://secunia.com/advisories/55314 - http://www.securityfocus.com/bid/56562 - http://cpansearch.perl.org/src/MARKSTOS/CGI.pm-3.63/Changes - http://www.ubuntu.com/usn/USN-1643-1 - http://www.securitytracker.com/id?1027780 - http://www.debian.org/security/2012/dsa-2586 - http://rhn.redhat.com/errata/RHSA-2013-0685.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 - https://github.com/markstos/CGI.pm/pull/23 - http://www.openwall.com/lists/oss-security/2012/11/15/6 - http://secunia.com/advisories/51457 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
CVE ID: CVE-2012-5527 State: PUBLISHED Published: 2019-11-25T13:22:37 Last Updated: 2024-08-06T21:05:47.440Z Vendors: Claws Mail Products: Claws Mail vCalendar plugin Problem Types: UNKNOWN_TYPE Description: Claws Mail vCalendar plugin: credentials exposed on interface Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2012-5527 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5527 - http://www.openwall.com/lists/oss-security/2012/11/28/10 - http://www.openwall.com/lists/oss-security/2012/11/28/8 - http://www.openwall.com/lists/oss-security/2012/11/28/9
CVE ID: CVE-2012-5528 State: REJECTED Published: 2020-11-05T22:03:49 Last Updated: 2020-11-05T22:03:49 Description: No description available.
CVE ID: CVE-2012-5529 State: PUBLISHED Published: 2012-11-20T00:00:00 Last Updated: 2024-08-06T21:05:47.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: TraceManager in Firebird 2.5.0 and 2.5.1, when trace is enabled, allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by preparing an empty dynamic SQL query. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1027769 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80073 - http://www.securityfocus.com/bid/56521 - http://www.openwall.com/lists/oss-security/2012/11/14/6 - http://tracker.firebirdsql.org/browse/CORE-3884 - http://
21 - http://www.openwall.com/lists/oss-security/2012/11/14/6 - http://tracker.firebirdsql.org/browse/CORE-3884 - http://www.debian.org/security/2013/dsa-2648 - http://www.openwall.com/lists/oss-security/2012/11/14/8
CVE ID: CVE-2012-5530 State: PUBLISHED Published: 2012-11-29T11:00:00 Last Updated: 2024-08-06T21:05:47.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) pcmd and (2) pmlogger init scripts in Performance Co-Pilot (PCP) before 3.6.10 allow local users to overwrite arbitrary files via a symlink attack on a /var/tmp/##### temporary file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/56656 - https://bugzilla.redhat.com/show_bug.cgi?id=875842 - http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00024.html - https://bugzilla.novell.com/show_bug.cgi?id=782967
CVE ID: CVE-2012-5531 State: PUBLISHED Published: 2013-01-18T11:00:00Z Last Updated: 2024-08-06T21:05:47.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal in JBoss Enterprise Portal Platform 5.2.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/51775 - http://rhn.redhat.com/errata/RHSA-2013-0141.html
CVE ID: CVE-2012-5532 State: PUBLISHED Published: 2012-12-27T11:00:00 Last Updated: 2024-08-06T21:05:47.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.8-rc1, allows local users to cause a denial of service (daemon exit) via a crafted application that sends a Netlink message. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2669. Additional Analyst Notes: - CVE Program Container: References: - http://www.kernel.org/pub/linux/kernel/v3.x/testing/patch-3.8-rc1.bz2 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=95a69a
/v3.x/testing/patch-3.8-rc1.bz2 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=95a69adab9acfc3981c504737a2b6578e4d846ef - http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 - https://bugzilla.novell.com/show_bug.cgi?id=761200 - http://www.openwall.com/lists/oss-security/2012/11/27/12 - https://bugzilla.redhat.com/show_bug.cgi?id=877572 - http://www.kernel.org/pub/linux/kernel/v3.x/testing/ - https://github.com/torvalds/linux/commit/95a69adab9acfc3981c504737a2b6578e4d846ef - http://rhn.redhat.com/errata/RHSA-2013-0807.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/80337 - http://www.securityfocus.com/bid/56710
CVE ID: CVE-2012-5533 State: PUBLISHED Published: 2012-11-24T20:00:00 Last Updated: 2024-08-06T21:05:47.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite loop) via a request with a header containing an empty token, as demonstrated using the "Connection: TE,,Keep-Alive" header. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/11/21/1 - http://lists.opensuse.org/opensuse-updates/2012-11/msg00044.html - http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2012_01.txt - http:
/opensuse-updates/2012-11/msg00044.html - http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2012_01.txt - http://www.exploit-db.com/exploits/22902 - http://www.securitytracker.com/id?1027802 - http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.31_fix_connection_header_dos.patch - http://packetstormsecurity.org/files/118282/Simple-Lighttpd-1.4.31-Denial-Of-Service.html - http://secunia.com/advisories/51268 - https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0345 - http://osvdb.org/87623 - http://marc.info/?l=bugtraq&m=141576815022399&w=2 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:100 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80213 - htt
.mandriva.com/security/advisories?name=MDVSA-2013:100 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80213 - http://secunia.com/advisories/51298 - http://lists.opensuse.org/opensuse-updates/2014-01/msg00051.html - http://www.securityfocus.com/bid/56619
CVE ID: CVE-2012-5534 State: PUBLISHED Published: 2012-12-03T21:00:00 Last Updated: 2024-08-06T21:05:47.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion." Additional Analyst Notes: - CVE Program Container: References: - http://git.savannah.gnu.org/gitweb/?p=weechat.git%3Ba=commitdiff_plain%3Bh=efb795c74fe954b9544074aafcebb1be4452b03a - http://secunia.com/advisories/51294 - http://secunia.com/advisories/51377 - http://lists.opensuse.org/opensuse-security-announce/2013-
.com/advisories/51294 - http://secunia.com/advisories/51377 - http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00018.html - https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0347 - http://lists.opensuse.org/opensuse-updates/2012-11/msg00087.html - http://www.securityfocus.com/bid/56584 - http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093516.html - http://weechat.org/security/ - http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093495.html - http://www.openwall.com/lists/oss-security/2012/11/19/4 - https://savannah.nongnu.org/bugs/?37764 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:136 - http://lists.fedorap
savannah.nongnu.org/bugs/?37764 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:136 - http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093260.html
CVE ID: CVE-2012-5535 State: PUBLISHED Published: 2019-11-25T13:11:27 Last Updated: 2024-08-06T21:05:47.349Z Vendors: gnome-system-log Products: gnome-system-log Problem Types: polkit policy too lax, allows reading arbitrary files on the system Description: gnome-system-log polkit policy allows arbitrary files on the system to be read Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2012-5535 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5535 - https://access.redhat.com/security/cve/cve-2012-5535 - http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094059.html - http://lists.fedoraproject.org/piperm
p://lists.fedoraproject.org/pipermail/package-announce/2012-December/094059.html - http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094181.html
CVE ID: CVE-2012-5536 State: PUBLISHED Published: 2013-02-22T00:00:00 Last Updated: 2024-08-06T21:05:47.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: A certain Red Hat build of the pam_ssh_agent_auth module on Red Hat Enterprise Linux (RHEL) 6 and Fedora Rawhide calls the glibc error function instead of the error function in the OpenSSH codebase, which allows local users to obtain sensitive information from process memory or possibly gain privileges via crafted use of an application that relies on this module, as demonstrated by su and sudo. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-0519.html - http://pkgs.fedora
lyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-0519.html - http://pkgs.fedoraproject.org/cgit/openssh.git/commit/?id=4f4687ce8045418f678c323bb22c837f35d7b9fa - https://bugzilla.redhat.com/show_bug.cgi?id=834618
CVE ID: CVE-2012-5537 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-17T01:51:42.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1789284 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://drupal.org/node/1789274
CVE ID: CVE-2012-5538 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-16T17:37:40.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has "Reference existing" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1789300 - http://drupal.org/node/1789306 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://drupal.org/node/1789302
CVE ID: CVE-2012-5539 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-16T17:09:10.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Organic Groups (OG) module 7.x-1.x before 7.x-1.5 for Drupal does not properly maintain pending group memberships, which allows remote authenticated users to post to arbitrary groups by modifying their own account while a pending membership is waiting to be approved. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1795906 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://drupal.org/node/1796036
CVE ID: CVE-2012-5540 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-16T20:11:53.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Hostip module 6.x-2.x before 6.x-2.2 and 7.x-2.x before 7.x-2.2 for Drupal allow remote attackers with control of hostip.info to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1802048 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://drupal.org/node/1802218 - http://drupal.org/node/1802046
CVE ID: CVE-2012-5541 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-16T17:48:10.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Twitter Pull module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.0-rc3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "data coming from Twitter." Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1802230 - http://drupal.org/node/1801442 - http://drupal.org/node/1801444 - http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE ID: CVE-2012-5542 State: PUBLISHED Published: 2012-12-03T21:00:00 Last Updated: 2024-08-06T21:05:47.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Commerce Extra Panes module 7.x-1.x before 7.x-1.1 in Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable a Commerce extra panes pane via unspecified vectors related to "the link to reorder items." Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1802192 - http://secunia.com/advisories/50802 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79025 - http://drupal.org/no
http://secunia.com/advisories/50802 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79025 - http://drupal.org/node/1802258 - http://www.securityfocus.com/bid/55776 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://osvdb.org/85892
CVE ID: CVE-2012-5543 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-17T00:11:08.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Feeds module 7.x-2.x before 7.x-2.0-alpha6 for Drupal, when a field is mapped to the node's author, does not properly check permissions, which allows remote attackers to create arbitrary nodes via a crafted source feed. Additional Analyst Notes: - CVE Program Container: References: - http://drupalcode.org/project/feeds.git/commitdiff/a538c20 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://drupal.org/node/1808832
CVE ID: CVE-2012-5544 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-16T23:45:50.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Mandrill module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users to obtain password reset links by reading the logs in the Mandrill dashboard. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1808846 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://drupal.org/node/1807894
CVE ID: CVE-2012-5545 State: PUBLISHED Published: 2012-12-03T21:00:00 Last Updated: 2024-08-06T21:14:14.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the ShareThis module 7.x-2.x before 7.x-2.5 for Drupal allow remote authenticated users with the "administer sharethis" permission to inject arbitrary web script or HTML via unspecified vectors related to "JavaScript settings." Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1808760 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://drupal.org/node/1808856 - http://www.securityfocus.com/bid/55870
CVE ID: CVE-2012-5546 State: REJECTED Published: 2014-02-10T23:00:00 Last Updated: 2014-02-10T23:57:00 Description: No description available.
CVE ID: CVE-2012-5547 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-17T03:14:06.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable a server via a server action or (2) enable a search index via an enable index action. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1815770 - http://drupal.org/node/1815124 - http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE ID: CVE-2012-5548 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-16T16:53:51.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1822066 - http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE ID: CVE-2012-5549 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-16T16:53:49.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1822066 - http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE ID: CVE-2012-5550 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-16T19:41:31.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1822066 - http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE ID: CVE-2012-5551 State: PUBLISHED Published: 2012-12-03T21:00:00 Last Updated: 2024-08-06T21:14:15.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the MailChimp module 7.x-2.x before 7.x-2.7 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) a predictable "webhook URL key" and (2) improper sanitization of "Webhook variables from POST requests." Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1821330 - http://www.securityfocus.com/bid/56234 - http://drupal.org/node/1822166 - http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE ID: CVE-2012-5552 State: PUBLISHED Published: 2012-12-03T21:00:00 Last Updated: 2024-08-06T21:14:15.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Password policy module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to obtain password hashes by sniffing the network, related to "client-side password history checks." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/56350 - http://drupal.org/node/1828130 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://drupal.org/node/1828340 - http://drupal.org/node/1828142
CVE ID: CVE-2012-5553 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-16T23:16:50.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the OM Maximenu module 6.x-1.x before 6.x-1.44 and 7.x-1.x before 7.x-1.44 for Drupal allow remote authenticated users with the "administer OM Maximenu" permission to inject arbitrary web script or HTML via the (1) Menu Title (2) Link Title, (3) Path Query, (4) Anchor, or (5) vocabulary names. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1834048 - http://drupal.org/node/1834866 - http://www.openwall.com/lists/oss-security/2012/11
: - http://drupal.org/node/1834048 - http://drupal.org/node/1834866 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://www.madirish.net/551 - http://drupal.org/node/1834046
CVE ID: CVE-2012-5554 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-16T17:49:20.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1834868 - http://drupal.org/node/1774252 - http://drupal.org/node/1768632 - http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE ID: CVE-2012-5555 State: REJECTED Published: 2020-11-05T22:04:17 Last Updated: 2020-11-05T22:04:17 Description: No description available.
CVE ID: CVE-2012-5556 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-16T23:21:47.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the RESTful Web Services (RESTWS) module 7.x-1.x before 7.x-1.1 and 7.x-2.x before 7.x-2.0-alpha3 for Drupal allow remote attackers to hijack the authentication of arbitrary users via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1840740 - http://drupal.org/node/1840722 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://drupal.org/node/1840728
CVE ID: CVE-2012-5557 State: PUBLISHED Published: 2012-12-03T21:00:00Z Last Updated: 2024-09-16T16:28:57.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: The User Read-Only module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, does not properly assign roles when there are more than three roles on the site and certain unspecified configurations, which might allow remote authenticated users to gain privileges by performing certain operations, as demonstrated by changing a password. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1840054 - http://drupal.org/node/1840038 - http://www.openwall.com/lists/oss-security/2012/11/20/
http://drupal.org/node/1840054 - http://drupal.org/node/1840038 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://drupal.org/node/1840886
CVE ID: CVE-2012-5558 State: PUBLISHED Published: 2020-01-09T20:35:02 Last Updated: 2024-08-06T21:14:15.762Z Vendors: Smiley;Smileys Products: Smiley, Smileys Problem Types: Cross-Site Scripting Description: Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to 6.x-1.1 for Drupal allows remote authenticated users with the "administer smiley" permission to inject arbitrary web script or HTML via a smiley acronym. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1840892 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://drupal.org/node/1840954 - http://d
l.org/node/1840892 - http://www.openwall.com/lists/oss-security/2012/11/20/4 - http://drupal.org/node/1840954 - http://drupal.org/node/1840956