Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-4348 State: PUBLISHED Published: 2012-12-18T20:00:00 Last Updated: 2024-08-06T20:35:09.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: The management console in Symantec Endpoint Protection (SEP) 11.0 before RU7-MP3 and 12.1 before RU2, and Symantec Endpoint Protection Small Business Edition 12.x before 12.1 RU2, does not properly validate input for PHP scripts, which allows remote authenticated users to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20121210_00 - htt
curity_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20121210_00 - http://www.securityfocus.com/bid/56846 - http://www.securitytracker.com/id?1027863
CVE ID: CVE-2012-4349 State: PUBLISHED Published: 2012-12-11T11:00:00 Last Updated: 2024-08-06T20:35:09.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unquoted Windows search path vulnerability in Symantec Network Access Control (SNAC) 12.1 before RU2 allows local users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20121210_00 - http://www.securitytracker.com/id?1027864 - http://www.securityfocus.com/bid/56847
CVE ID: CVE-2012-4350 State: PUBLISHED Published: 2012-12-18T20:00:00 Last Updated: 2024-08-06T20:35:09.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unquoted Windows search path vulnerabilities in the (1) Manager and (2) Agent components in Symantec Enterprise Security Manager (ESM) before 11.0 allow local users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1027874 - http://www.securityfocus.com/bid/56915 - http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20121213_00
CVE ID: CVE-2012-4351 State: PUBLISHED Published: 2013-02-18T11:00:00Z Last Updated: 2024-09-16T16:59:07.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in pgpwded.sys in Symantec PGP Desktop 10.x and Encryption Desktop 10.3.0 before MP1 allows local users to gain privileges via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/57170 - http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2013&suid=20130213_00
CVE ID: CVE-2012-4352 State: PUBLISHED Published: 2013-02-18T11:00:00Z Last Updated: 2024-09-16T17:02:46.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Stoneware webNetwork 6.1 before SP1 allow remote attackers to inject arbitrary web script or HTML via the blogName parameter to (1) community/blog.jsp or (2) community/blogSearch.jsp, the (3) calendarType or (4) monthNumber parameter to community/calendar.jsp, or the (5) flag parameter to swDashboard/ajax/setAppFlag.jsp. Additional Analyst Notes: - CVE Program Container: References: - http://stoneware-docs.s3.amazonaws.com/Bulletins/Security%20Bulletin%206_1_0.pdf - http:
rogram Container: References: - http://stoneware-docs.s3.amazonaws.com/Bulletins/Security%20Bulletin%206_1_0.pdf - http://infosec42.blogspot.com/2012/10/stoneware-webnetwork-61-reflective-xss.html
CVE ID: CVE-2012-4353 State: PUBLISHED Published: 2012-08-19T20:00:00Z Last Updated: 2024-09-17T00:21:14.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allows remote attackers to execute arbitrary code via a crafted port-46824 TCP packet that triggers an incorrect file-open attempt by the _TCPIPS_BinOpenFileFP function, a different vulnerability than CVE-2012-3815. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.org/adv/winlog_2-adv.txt - http://w
tion. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.org/adv/winlog_2-adv.txt - http://www.us-cert.gov/control_systems/pdf/ICSA-12-213-01.pdf - http://secunia.com/advisories/49395 - http://www.sielcosistemi.com/en/news/index.html?id=69
CVE ID: CVE-2012-4354 State: PUBLISHED Published: 2012-08-19T20:00:00Z Last Updated: 2024-09-16T21:08:53.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: TCPIPS_Story.dll in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allows remote attackers to execute arbitrary code via a port-46824 TCP packet with a crafted positive integer after the opcode, triggering incorrect function-pointer processing that can lead to a buffer overflow. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.org/adv/winlog_2-adv.txt - http://www.us-cert.gov/control_system
s: - CVE Program Container: References: - http://aluigi.org/adv/winlog_2-adv.txt - http://www.us-cert.gov/control_systems/pdf/ICSA-12-213-01.pdf - http://secunia.com/advisories/49395 - http://www.sielcosistemi.com/en/news/index.html?id=69
CVE ID: CVE-2012-4355 State: PUBLISHED Published: 2012-08-19T20:00:00Z Last Updated: 2024-09-16T20:21:45.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: TCPIPS_Story.dll in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attackers to execute arbitrary code via a port-46824 TCP packet with a crafted negative integer after the opcode, triggering incorrect function-pointer processing that can lead to a buffer overflow. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4354. Additional Analyst Notes: - CVE Program Container: References:
y exists because of an incomplete fix for CVE-2012-4354. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.org/adv/winlog_2-adv.txt - http://www.us-cert.gov/control_systems/pdf/ICSA-12-213-01.pdf - http://secunia.com/advisories/49395 - http://www.sielcosistemi.com/en/news/index.html?id=70
CVE ID: CVE-2012-4356 State: PUBLISHED Published: 2012-08-19T20:00:00Z Last Updated: 2024-09-16T18:19:09.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allow remote attackers to read arbitrary files via port-46824 TCP packets specifying a file-open operation with opcode 0x78 and a .. (dot dot) in a pathname, followed by a file-read operation with opcode (1) 0x96, (2) 0x97, or (3) 0x98. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.org/adv/winlog_2-adv.txt - http://www.us-cert.gov/control_systems/pdf/ICSA-12-213-0
ntainer: References: - http://aluigi.org/adv/winlog_2-adv.txt - http://www.us-cert.gov/control_systems/pdf/ICSA-12-213-01.pdf - http://secunia.com/advisories/49395 - http://www.sielcosistemi.com/en/news/index.html?id=69
CVE ID: CVE-2012-4357 State: PUBLISHED Published: 2012-08-19T20:00:00Z Last Updated: 2024-09-17T03:48:07.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: Array index error in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 might allow remote attackers to execute arbitrary code by referencing, within a port-46824 TCP packet, an invalid file-pointer index that leads to execution of an EnterCriticalSection code block. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.org/adv/winlog_2-adv.txt - http://www.us-cert.gov/control_systems/pdf/ICSA-12-213-01.pdf - http://secunia.com/advisories/49395 - http://www.sielcosiste
://www.us-cert.gov/control_systems/pdf/ICSA-12-213-01.pdf - http://secunia.com/advisories/49395 - http://www.sielcosistemi.com/en/news/index.html?id=69
CVE ID: CVE-2012-4358 State: PUBLISHED Published: 2012-08-19T20:00:00Z Last Updated: 2024-09-16T17:43:02.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 do not validate the return value of the realloc function, which allows remote attackers to cause a denial of service (invalid 0x00 write operation and daemon crash) or possibly have unspecified other impact via a port-46824 TCP packet with a crafted positive integer after the opcode. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.org/adv/winlog_2-adv.txt - http://www.us-cert.gov/control_systems/pdf/ICSA-12-213-0
CVE ID: CVE-2012-4359 State: PUBLISHED Published: 2012-08-19T20:00:00Z Last Updated: 2024-09-16T19:00:45.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 do not validate the return value of the realloc function, which allows remote attackers to cause a denial of service (invalid 0x00 write operation and daemon crash) or possibly have unspecified other impact via a port-46824 TCP packet with a crafted negative integer after the opcode. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4358. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.org
an incomplete fix for CVE-2012-4358. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.org/adv/winlog_2-adv.txt - http://www.us-cert.gov/control_systems/pdf/ICSA-12-213-01.pdf - http://secunia.com/advisories/49395 - http://www.sielcosistemi.com/en/news/index.html?id=70
CVE ID: CVE-2012-4360 State: PUBLISHED Published: 2012-09-15T10:00:00 Last Updated: 2024-08-06T20:35:08.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/85430 - https://developers.google.com/speed/docs/mod_pagespeed/CVE-2012-4360 - https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6 - https://exchange.xforce.ibmcloud.com/vulnerabilities/78563
CVE ID: CVE-2012-4361 State: PUBLISHED Published: 2012-08-20T22:00:00Z Last Updated: 2024-09-17T01:36:37.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/18901/ - http://www.kb.cert.org/vuls/id/441363 - http://www.exploit-db.com/exploits/18893/
CVE ID: CVE-2012-4362 State: PUBLISHED Published: 2012-08-20T22:00:00Z Last Updated: 2024-09-16T18:33:27.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance has a hardcoded password of L0CAlu53R for the global$agent account, which allows remote attackers to obtain access to a management service via a login: request to TCP port 13838. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/18901/ - http://www.kb.cert.org/vuls/id/441363 - http://www.exploit-db.com/exploits/18893/
CVE ID: CVE-2012-4363 State: PUBLISHED Published: 2012-08-21T10:00:00 Last Updated: 2024-08-06T20:35:09.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Adobe Reader through 10.1.4 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document, related to "sixteen more crashes affecting Windows, OS X, or both systems." Additional Analyst Notes: - CVE Program Container: References: - http://vexillium.org/dl.php?ar_callstack.txt - http://gynvael.coldwind.pl/?id=483 - http://j00ru.vexillium.org/?p=1175 - https://exchange.xforce.ibmcloud.com/vulnerabilities/78587 - http:/
nd.pl/?id=483 - http://j00ru.vexillium.org/?p=1175 - https://exchange.xforce.ibmcloud.com/vulnerabilities/78587 - http://security.gentoo.org/glsa/glsa-201308-03.xml
CVE ID: CVE-2012-4366 State: PUBLISHED Published: 2012-11-20T00:00:00 Last Updated: 2024-08-06T20:35:09.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Belkin wireless routers Surf N150 Model F7D1301v1, N900 Model F9K1104v1, N450 Model F9K1105V2, and N300 Model F7D2301v1 generate a predictable default WPA2-PSK passphrase based on eight digits of the WAN MAC address, which allows remote attackers to access the network by sniffing the beacon frames. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2012-11/0070.html - http://www.securityfocus.com/bid/56591 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80157
2012-11/0070.html - http://www.securityfocus.com/bid/56591 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80157 - http://www.jakoblell.com/blog/2012/11/19/cve-2012-4366-insecure-default-wpa2-passphrase-in-multiple-belkin-wireless-routers/
CVE ID: CVE-2012-4377 State: PUBLISHED Published: 2017-10-26T20:00:00 Last Updated: 2024-08-06T20:35:09.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a nonexistent image. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=853409 - http://www.openwall.com/lists/oss-security/2012/08/31/6 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html - https://phabricator.wikimedia.org/T41700 - https://bugs.debian.org/cgi-bin/b
ediawiki-announce/2012-August/000119.html - https://phabricator.wikimedia.org/T41700 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330 - http://www.openwall.com/lists/oss-security/2012/08/31/10
CVE ID: CVE-2012-4378 State: PUBLISHED Published: 2017-10-26T20:00:00 Last Updated: 2024-08-06T20:35:08.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/31/6 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html - https://bugzilla.redhat.com/show_bug.cgi?id=853417 - https://phabricat
mail/mediawiki-announce/2012-August/000119.html - https://bugzilla.redhat.com/show_bug.cgi?id=853417 - https://phabricator.wikimedia.org/T39587 - http://www.openwall.com/lists/oss-security/2012/08/31/10 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330
CVE ID: CVE-2012-4379 State: PUBLISHED Published: 2017-10-19T21:00:00 Last Updated: 2024-08-06T20:35:09.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an embedded API response in an IFRAME element. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T41180 - http://www.openwall.com/lists/oss-security/2012/08/31/6 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html - https://bugzilla.redhat.com/show_bug.cgi?id=853426 - http://www
g/pipermail/mediawiki-announce/2012-August/000119.html - https://bugzilla.redhat.com/show_bug.cgi?id=853426 - http://www.openwall.com/lists/oss-security/2012/08/31/10 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330
CVE ID: CVE-2012-4380 State: PUBLISHED Published: 2017-10-19T21:00:00 Last Updated: 2024-08-06T20:35:08.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/31/6 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html - http://www.openwall.com/lists/oss-security/2012/08/31/10 - https://bugzilla.redhat.com/show_bug.cgi?id=853440 - https://bugs.debian.org/cgi-bin/bugrep
oss-security/2012/08/31/10 - https://bugzilla.redhat.com/show_bug.cgi?id=853440 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330 - https://phabricator.wikimedia.org/T41824
CVE ID: CVE-2012-4381 State: PUBLISHED Published: 2020-02-08T17:50:40 Last Updated: 2024-08-06T20:35:09.098Z Vendors: n/a Products: MediaWiki Problem Types: Password Description: MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/b
unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html - http://www.openwall.com/lists/oss-security/2012/08/31/6 - http://www.openwall.com/lists/oss-security/2012/08/31/10 - https://bugzilla.redhat.com/show_bug.cgi?id=853442 - https://phabricator.wikimedia.org/T41184 - http://osvdb.org/show/osvdb/85106
CVE ID: CVE-2012-4382 State: PUBLISHED Published: 2017-10-19T21:00:00 Last Updated: 2024-08-06T20:35:08.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote administrators to read a user block reason via a reblock attempt. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/31/6 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html - https://phabricator.wikimedia.org/T41823 - http://www.openwall.com/lists/oss-security/2012/08/31/10 - https://bugs.debian.org/cgi-bin/bugreport
imedia.org/T41823 - http://www.openwall.com/lists/oss-security/2012/08/31/10 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330
CVE ID: CVE-2012-4383 State: PUBLISHED Published: 2020-01-29T14:42:06 Last Updated: 2024-08-06T20:35:09.474Z Vendors: contao Products: contao Problem Types: SQL injection Description: contao prior to 2.11.4 has a sql injection vulnerability Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/31/14
CVE ID: CVE-2012-4384 State: PUBLISHED Published: 2019-11-13T15:52:28 Last Updated: 2024-08-06T20:35:08.661Z Vendors: letodms Products: letodms Problem Types: XSS Description: letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in Calendar Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/31/19 - https://security-tracker.debian.org/tracker/CVE-2012-4384
CVE ID: CVE-2012-4385 State: PUBLISHED Published: 2019-11-13T16:02:19 Last Updated: 2024-08-06T20:35:09.131Z Vendors: letodms Products: letodms Problem Types: CSRF Description: letodms 3.3.6 has CSRF via change password Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/31/19 - https://security-tracker.debian.org/tracker/CVE-2012-4385 - https://vulmon.com/exploitdetails?qidtp=EDB&qid=20759
CVE ID: CVE-2012-4386 State: PUBLISHED Published: 2012-09-05T23:00:00 Last Updated: 2024-08-06T20:35:09.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/WW-3858 - https://exchange.xforce.ibmcloud.com/vulnerabilities/78182 - http://www.openwall.com/lists/oss-security/2012/09/01/5 - http://secuni
ange.xforce.ibmcloud.com/vulnerabilities/78182 - http://www.openwall.com/lists/oss-security/2012/09/01/5 - http://secunia.com/advisories/50420 - http://www.securityfocus.com/bid/55346 - http://struts.apache.org/2.x/docs/s2-010.html - http://www.openwall.com/lists/oss-security/2012/09/01/4
CVE ID: CVE-2012-4387 State: PUBLISHED Published: 2012-09-05T23:00:00 Last Updated: 2024-08-06T20:35:09.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/78183 - http://struts.apache.org/2.x/docs/s2-011.html - http://www.openwall.com/lists/oss-security/2012/09/01/5 - http://secunia.com/advisories/50420 - http://www.securityfocus.com/bid/55346 - https://issues.apache.org/jira/browse/WW-3860 -
/secunia.com/advisories/50420 - http://www.securityfocus.com/bid/55346 - https://issues.apache.org/jira/browse/WW-3860 - http://www.openwall.com/lists/oss-security/2012/09/01/4
CVE ID: CVE-2012-4388 State: PUBLISHED Published: 2012-09-07T22:00:00 Last Updated: 2024-08-06T20:35:09.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sapi_header_op function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1398. Additional Analyst Notes: -
oogle Chrome. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1398. Additional Analyst Notes: - CVE Program Container: References: - http://security-tracker.debian.org/tracker/CVE-2012-4388 - http://openwall.com/lists/oss-security/2012/09/05/15 - http://www.securitytracker.com/id?1027463 - http://openwall.com/lists/oss-security/2012/09/07/3 - http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/SAPI.c?r1=323986&r2=323985&pathrev=323986 - https://bugs.php.net/bug.php?id=60227 - http://openwall.com/lists/oss-security/2012/08/29/5 - http://openwall.com/lists/oss-security/2012/09/02/1 - http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.html - h
all.com/lists/oss-security/2012/09/02/1 - http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.html - http://article.gmane.org/gmane.comp.php.devel/70584 - http://www.ubuntu.com/usn/USN-1569-1