Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-2309 State: PUBLISHED Published: 2012-07-25T21:00:00Z Last Updated: 2024-09-16T23:16:48.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Glossify Internal Links Auto SEO module for Drupal 6.x-2.5 and earlier allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1557874 - http://www.openwall.com/lists/oss-security/2012/05/03/2 - http://www.openwall.com/lists/oss-security/2012/05/03/1
CVE ID: CVE-2012-2310 State: PUBLISHED Published: 2012-07-25T21:00:00Z Last Updated: 2024-09-16T19:19:04.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the cctags module for Drupal 6.x-1.x before 6.x-1.10 and 7.x-1.x before 7.x-1.10 allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/1508098 - http://www.openwall.com/lists/oss-security/2012/05/03/2 - http://drupal.org/node/1508100 - http://secunia.com/advisories/49018 - http://www.openwall.com/lists/oss-security/2012/05/03/1 - http
.org/node/1508100 - http://secunia.com/advisories/49018 - http://www.openwall.com/lists/oss-security/2012/05/03/1 - http://drupal.org/node/1558248
CVE ID: CVE-2012-2311 State: PUBLISHED Published: 2012-05-11T10:00:00 Last Updated: 2024-08-06T19:26:09.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823. Additional Analyst Notes: - CVE Program Container: References:
y exists because of an incomplete fix for CVE-2012-1823. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=134012830914727&w=2 - http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html - http://www.securitytracker.com/id?1027022 - http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html - https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff-fix-check.patch&revision=1336093719&display=1 - http://secunia.com/advisories/49014 - http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html - https://bugs.php.net/bug.php?id=61910 - http://www.php.net/archive/2012.php#id2012-05-08-1 - http:
12-05/msg00007.html - https://bugs.php.net/bug.php?id=61910 - http://www.php.net/archive/2012.php#id2012-05-08-1 - http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html - http://support.apple.com/kb/HT5501 - https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862 - http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ - http://www.kb.cert.org/vuls/id/520827 - http://marc.info/?l=bugtraq&m=134012830914727&w=2 - http://www.debian.org/security/2012/dsa-2465 - http://secunia.com/advisories/49085 - https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862 - http://www.php.net/ChangeLog-5.php#5.4.3
CVE ID: CVE-2012-2312 State: PUBLISHED Published: 2019-12-18T17:47:01 Last Updated: 2024-08-06T19:26:09.332Z Vendors: JBoss AS 7 Products: JBoss Problem Types: UNKNOWN_TYPE Description: An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2012-2312 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2312 - https://access.redhat.com/s
bian.org/tracker/CVE-2012-2312 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2312 - https://access.redhat.com/security/cve/cve-2012-2312
CVE ID: CVE-2012-2313 State: PUBLISHED Published: 2012-06-13T10:00:00 Last Updated: 2024-08-06T19:26:09.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/05/04/8 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.7 - http://rhn.redhat.com/errata/RHSA-2012-1174.html - http://www.securityfocus.com/bid/53965 - https://github.com/torvalds/
http://rhn.redhat.com/errata/RHSA-2012-1174.html - http://www.securityfocus.com/bid/53965 - https://github.com/torvalds/linux/commit/1bb57e940e1958e40d51f2078f50c3a96a9b2d75 - http://rhn.redhat.com/errata/RHSA-2012-1541.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1bb57e940e1958e40d51f2078f50c3a96a9b2d75 - http://rhn.redhat.com/errata/RHSA-2012-1481.html - https://bugzilla.redhat.com/show_bug.cgi?id=818820 - http://rhn.redhat.com/errata/RHSA-2012-1589.html - http://marc.info/?l=bugtraq&m=139447903326211&w=2 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
CVE ID: CVE-2012-2314 State: PUBLISHED Published: 2012-07-03T00:00:00 Last Updated: 2024-08-06T19:26:09.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bootloader configuration module (pyanaconda/bootloader.py) in Anaconda uses 755 permissions for /etc/grub.d, which allows local users to obtain password hashes and conduct brute force password guessing attacks. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080188.html - http://git.fedorahosted.org/git/?p=anaconda.git%3Ba=commit%3Bh=03ef13b625cc06873a924e0610340f8489fd92df - http://www.openwall.com/lists/oss-security/2012/05/04/10 - https:
=commit%3Bh=03ef13b625cc06873a924e0610340f8489fd92df - http://www.openwall.com/lists/oss-security/2012/05/04/10 - https://bugzilla.redhat.com/show_bug.cgi?id=819031 - http://www.securityfocus.com/bid/53486 - http://www.openwall.com/lists/oss-security/2012/05/04/12 - http://www.openwall.com/lists/oss-security/2024/01/15/3
CVE ID: CVE-2012-2315 State: PUBLISHED Published: 2012-09-09T21:00:00 Last Updated: 2024-08-06T19:26:09.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authenticated users to assign administrator privileges to arbitrary users via the userEdit action. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/03/23/6 - http://www.openwall.com/lists/oss-security/2012/05/04/2 - http://www.securityfocus.com/bid/51250 - http://archives.neohapsis.com/archives/bugtraq/2012-01/0007.html - h
/05/04/2 - http://www.securityfocus.com/bid/51250 - http://archives.neohapsis.com/archives/bugtraq/2012-01/0007.html - http://www.openwall.com/lists/oss-security/2012/03/23/8 - http://archives.neohapsis.com/archives/bugtraq/2012-01/0021.html - http://www.openwall.com/lists/oss-security/2012/05/04/13 - https://exchange.xforce.ibmcloud.com/vulnerabilities/72112 - http://www.openwall.com/lists/oss-security/2012/04/27/6 - http://secunia.com/advisories/47424 - http://osvdb.org/78105
CVE ID: CVE-2012-2316 State: PUBLISHED Published: 2012-09-09T21:00:00Z Last Updated: 2024-09-16T20:52:45.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7 and other versions before 5.1.8-2 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary code via the script parameter to admin/scripting.jsp. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/03/23/6 - http://www.openwall.com/lists/oss-security/2012/05/04/2 - http://openkm.svn.sourceforge.net/viewvc/openkm?view=revi
/6 - http://www.openwall.com/lists/oss-security/2012/05/04/2 - http://openkm.svn.sourceforge.net/viewvc/openkm?view=revision&revision=7406 - http://www.openwall.com/lists/oss-security/2012/03/23/8 - http://secunia.com/advisories/47420 - http://wiki.openkm.com/index.php/Changelog - http://archives.neohapsis.com/archives/bugtraq/2012-01/0008.html - http://www.osvdb.org/78106 - http://www.openwall.com/lists/oss-security/2012/05/04/13 - http://www.openwall.com/lists/oss-security/2012/04/27/6
CVE ID: CVE-2012-2317 State: PUBLISHED Published: 2012-08-07T19:00:00Z Last Updated: 2024-09-16T20:06:29.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Debian php_crypt_revamped.patch patch for PHP 5.3.x, as used in the php5 package before 5.3.3-7+squeeze4 in Debian GNU/Linux squeeze, the php5 package before 5.3.2-1ubuntu4.17 in Ubuntu 10.04 LTS, and the php5 package before 5.3.5-1ubuntu7.10 in Ubuntu 11.04, does not properly handle an empty salt string, which might allow remote attackers to bypass authentication by leveraging an application that relies on the PHP crypt function to choose a salt for password hashing. Additional Analyst Notes: - CVE Program Container: Ref
on the PHP crypt function to choose a salt for password hashing. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-1481-1 - http://www.openwall.com/lists/oss-security/2012/05/04/7 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=581170 - http://www.openwall.com/lists/oss-security/2012/05/05/2
CVE ID: CVE-2012-2318 State: PUBLISHED Published: 2012-07-03T19:00:00 Last Updated: 2024-08-06T19:26:08.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service (application crash) by placing these characters in a text/plain message. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53400 - http://hg.pidgin.im/pidgin/main/rev/4d6bcb4f4ea4 - http://pidgin.im/news/security/?id=63 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:082 - https://oval.cisecurity.
gin.im/news/security/?id=63 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:082 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17448 - http://secunia.com/advisories/50005 - https://hermes.opensuse.org/messages/15136503 - http://rhn.redhat.com/errata/RHSA-2012-1102.html
CVE ID: CVE-2012-2319 State: PUBLISHED Published: 2012-05-17T10:00:00 Last Updated: 2024-08-06T19:26:08.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in the hfsplus filesystem implementation in the Linux kernel before 3.3.5 allow local users to gain privileges via a crafted HFS plus filesystem, a related issue to CVE-2009-4020. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/50811 - http://www.openwall.com/lists/oss-security/2012/05/07/11 - http://rhn.redhat.com/errata/RHSA-2012-1323.html - http://rhn.redhat.com/errata/RHSA-2012-1347.html - https://bugzilla.redhat.com/show_bug.cgi?id=819471 - http://ww
html - http://rhn.redhat.com/errata/RHSA-2012-1347.html - https://bugzilla.redhat.com/show_bug.cgi?id=819471 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.5 - https://github.com/torvalds/linux/commit/6f24f892871acc47b40dd594c63606a17c714f77 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6f24f892871acc47b40dd594c63606a17c714f77
CVE ID: CVE-2012-2320 State: PUBLISHED Published: 2012-05-18T22:00:00 Last Updated: 2024-08-06T19:26:09.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: ConnMan before 0.85 does not ensure that netlink messages originate from the kernel, which allows remote attackers to bypass intended access restrictions and cause a denial of service via a crafted netlink message. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75465 - http://git.kernel.org/?p=network/connman/connman.git%3Ba=commit%3Bh=b0ec6eb4466acc57a9ea8be52c17b674b6ea0618 - http://www.osvdb.org/81704 - http://www.openwall.com/lists/oss-security/2012/05/
c6eb4466acc57a9ea8be52c17b674b6ea0618 - http://www.osvdb.org/81704 - http://www.openwall.com/lists/oss-security/2012/05/07/6 - http://security.gentoo.org/glsa/glsa-201205-02.xml - http://git.kernel.org/?p=network/connman/connman.git%3Ba=commit%3Bh=c1b968984212b46bea1330f5ae029507b9bfded9 - http://www.openwall.com/lists/oss-security/2012/05/07/2 - http://www.securityfocus.com/bid/53406 - http://www.openwall.com/lists/oss-security/2012/05/07/10 - http://secunia.com/advisories/49033 - https://bugzilla.novell.com/show_bug.cgi?id=715172 - http://secunia.com/advisories/49186
CVE ID: CVE-2012-2321 State: PUBLISHED Published: 2012-05-18T22:00:00 Last Updated: 2024-08-06T19:26:08.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: The loopback plug-in in ConnMan before 0.85 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) host name or (2) domain name in a DHCP reply. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53408 - http://git.kernel.org/?p=network/connman/connman.git%3Ba=commit%3Bh=26ace5c59f790bce0f1988b88874c6f2c480fd5a - http://www.osvdb.org/81705 - http://git.kernel.org/?p=network/connman/connman.git%3Ba=commit%3Bh=a5f540db7354b76bcabd0a05d8eb8ba2bff4e9
b.org/81705 - http://git.kernel.org/?p=network/connman/connman.git%3Ba=commit%3Bh=a5f540db7354b76bcabd0a05d8eb8ba2bff4e911 - http://www.openwall.com/lists/oss-security/2012/05/07/6 - http://security.gentoo.org/glsa/glsa-201205-02.xml - http://www.openwall.com/lists/oss-security/2012/05/07/2 - http://www.openwall.com/lists/oss-security/2012/05/07/10 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75466 - http://secunia.com/advisories/49033 - https://bugzilla.novell.com/show_bug.cgi?id=715172 - http://secunia.com/advisories/49186
CVE ID: CVE-2012-2322 State: PUBLISHED Published: 2012-05-18T22:00:00 Last Updated: 2024-08-06T19:26:08.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the dhcpv6_get_option function in gdhcp/client.c in ConnMan before 0.85 allows remote attackers to cause a denial of service (infinite loop and crash) via an invalid length value in a DHCP packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53410 - http://www.osvdb.org/81706 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75420 - http://www.openwall.com/lists/oss-security/2012/05/07/6 - http://security.gentoo.org/glsa/glsa-201205-02.xml - http://w
http://www.openwall.com/lists/oss-security/2012/05/07/6 - http://security.gentoo.org/glsa/glsa-201205-02.xml - http://www.openwall.com/lists/oss-security/2012/05/07/2 - http://git.kernel.org/?p=network/connman/connman.git%3Ba=commitdiff%3Bh=1d1a22fe586a455935483708fbe8eaeada79df7f - http://www.openwall.com/lists/oss-security/2012/05/07/10 - http://secunia.com/advisories/49033 - https://bugzilla.novell.com/show_bug.cgi?id=715172 - http://secunia.com/advisories/49186
CVE ID: CVE-2012-2323 State: REJECTED Published: 2017-07-21T19:00:00 Last Updated: 2017-07-21T18:57:01 Description: No description available.
CVE ID: CVE-2012-2324 State: PUBLISHED Published: 2012-08-13T18:00:00Z Last Updated: 2024-09-16T18:18:14.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.7 allow remote administrators to execute arbitrary SQL commands via unspecified vectors in the (1) user search or (2) Mail Log in the Admin Control Panel (ACP). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53417 - http://www.openwall.com/lists/oss-security/2012/05/07/13 - http://blog.mybb.com/2012/04/01/mybb-1-6-7-update-1-8-development/ - http://www.openwall.com/lists/oss-security/2012/05/07/14
CVE ID: CVE-2012-2325 State: PUBLISHED Published: 2012-08-13T18:00:00Z Last Updated: 2024-09-16T23:55:43.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the User Inline Moderation feature in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6.7 allows remote administrators to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53417 - http://www.openwall.com/lists/oss-security/2012/05/07/13 - http://blog.mybb.com/2012/04/01/mybb-1-6-7-update-1-8-development/ - http://www.openwall.com/lists/oss-security/2012/05/07/14
CVE ID: CVE-2012-2326 State: PUBLISHED Published: 2012-08-13T18:00:00Z Last Updated: 2024-09-16T16:37:30.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6.7 allows remote administrators to inject arbitrary web script or HTML via a malformed file name in an orphaned attachment. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53417 - http://www.openwall.com/lists/oss-security/2012/05/07/13 - http://blog.mybb.com/2012/04/01/mybb-1-6-7-update-1-8-development/ - http://www.openwall.com/lists/oss-security/2012/05/07/14
CVE ID: CVE-2012-2327 State: PUBLISHED Published: 2012-08-13T18:00:00Z Last Updated: 2024-09-17T02:58:18.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyBB (aka MyBulletinBoard) before 1.6.7 allows remote attackers to obtain sensitive information via a malformed forumread cookie, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53417 - http://www.openwall.com/lists/oss-security/2012/05/07/13 - http://blog.mybb.com/2012/04/01/mybb-1-6-7-update-1-8-development/ - http://www.openwall.com/lists/oss-security/2012/05/07/14
CVE ID: CVE-2012-2328 State: PUBLISHED Published: 2014-02-10T17:00:00 Last Updated: 2024-08-06T19:34:24.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: internal/cimxml/sax/NodeFactory.java in Standards-Based Linux Instrumentation for Manageability (SBLIM) Common Information Model (CIM) Client (aka sblim-cim-client2) before 2.1.12 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML file. Additional Analyst Notes: - CVE Program Container: References: - http://sblim.cvs.sourceforge.net/viewvc/sblim/jsr48-client/src/org/sblim/cimclient
CVE Program Container: References: - http://sblim.cvs.sourceforge.net/viewvc/sblim/jsr48-client/src/org/sblim/cimclient/internal/cimxml/sax/NodeFactory.java?view=log#rev1.7 - http://sourceforge.net/p/sblim/bugs/2381/ - http://rhn.redhat.com/errata/RHSA-2012-0987.html - http://lists.opensuse.org/opensuse-updates/2012-12/msg00015.html - http://lists.opensuse.org/opensuse-updates/2013-01/msg00038.html
CVE ID: CVE-2012-2329 State: PUBLISHED Published: 2012-05-11T10:00:00 Last Updated: 2024-08-06T19:34:23.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in the header of an HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/bug.php?id=61807 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75545 - http://secunia.com/advisories/49014 - https://bugzilla.redhat.com/show_bug.cgi?id=820000 - http://www.php.net/archive/2012.php#id2012-05-
m/advisories/49014 - https://bugzilla.redhat.com/show_bug.cgi?id=820000 - http://www.php.net/archive/2012.php#id2012-05-08-1 - http://www.securityfocus.com/bid/53455 - https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862 - https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862 - http://www.php.net/ChangeLog-5.php#5.4.3
CVE ID: CVE-2012-2330 State: PUBLISHED Published: 2012-08-13T23:00:00 Last Updated: 2024-08-06T19:34:23.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/joyent/node/commit/c9a231d - http://blog.nodejs.org/2012/05/04/version-0-6-17-stable/ - http://secunia.com/advisories/49066 - https://github.com/joyent/node/commit
dejs.org/2012/05/04/version-0-6-17-stable/ - http://secunia.com/advisories/49066 - https://github.com/joyent/node/commit/7b3fb22 - http://www.openwall.com/lists/oss-security/2012/05/08/4 - http://www.openwall.com/lists/oss-security/2012/05/08/8 - https://support.f5.com/csp/article/K99038439?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2012-2331 State: PUBLISHED Published: 2012-08-13T23:00:00Z Last Updated: 2024-09-16T22:55:59.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the serendipity[textarea] parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF). Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/05/08/6 - http://www.rul3z.de/index.php?/214-KORAMISADV2012-001-Serendipity-1.6-Backend-Cross-Site-Scripting-and-SQL-
12/05/08/6 - http://www.rul3z.de/index.php?/214-KORAMISADV2012-001-Serendipity-1.6-Backend-Cross-Site-Scripting-and-SQL-Injection-vulnerability.html - https://github.com/s9y/Serendipity/commit/264bf55719baacc069ff9d3cc35f0c349cde11e3 - http://www.securityfocus.com/bid/53418 - http://secunia.com/advisories/49009 - http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-001.txt - http://www.openwall.com/lists/oss-security/2012/05/09/2 - http://blog.s9y.org/archives/240-Serendipity-1.6.1-released.html - http://archives.neohapsis.com/archives/bugtraq/2012-05/0037.html
CVE ID: CVE-2012-2332 State: PUBLISHED Published: 2012-08-13T23:00:00Z Last Updated: 2024-09-17T02:52:09.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the serendipity[plugin_to_conf] parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF). Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/05/08/6 - http://www.rul3z.de/index.php?/214-KORAMISADV2012-001-Serendipity-1.6-Backend-Cross-Site-Scripting-and-SQL-Injection-vulnerability.htm