Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-2649 State: PUBLISHED Published: 2012-08-08T18:00:00Z Last Updated: 2024-09-16T17:38:51.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Sleipnir Mobile application 2.2.0 and earlier and Sleipnir Mobile Black Edition application 2.2.0 and earlier for Android allow remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=jp.co.fenrir.android.sleipnir_black - https://play.google.com/store/apps/details?id=jp.co.fenrir.android.sleipnir - http://jvn.jp/en/jp/JVN99730704/
r_black - https://play.google.com/store/apps/details?id=jp.co.fenrir.android.sleipnir - http://jvn.jp/en/jp/JVN99730704/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2012-000075
CVE ID: CVE-2012-2652 State: PUBLISHED Published: 2012-08-07T20:00:00 Last Updated: 2024-08-06T19:42:31.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/50132 - http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log - http://secunia.com/advisories/50689 - http://www.securityfocus.com/bid/53725 - http://lists.opensuse.org/opensuse-security-announce/2012-0
/advisories/50689 - http://www.securityfocus.com/bid/53725 - http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00024.html - http://www.ubuntu.com/usn/USN-1522-1 - http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=eba25057b9a5e19d10ace2bc7716667a31297169 - http://www.debian.org/security/2012/dsa-2545
CVE ID: CVE-2012-2653 State: PUBLISHED Published: 2012-07-12T20:00:00 Last Updated: 2024-08-06T19:42:31.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/05/25/5 - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082569.html - http://www.openwall.com/lists/oss-security/2012/05/24/13 - http://www.openwall.com/lists/oss-security/201
/082569.html - http://www.openwall.com/lists/oss-security/2012/05/24/13 - http://www.openwall.com/lists/oss-security/2012/05/24/12 - http://www.debian.org/security/2012/dsa-2481 - http://www.openwall.com/lists/oss-security/2012/05/24/14 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:113 - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082565.html - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082553.html - https://security.gentoo.org/glsa/201607-16
CVE ID: CVE-2012-2654 State: PUBLISHED Published: 2012-06-21T15:00:00 Last Updated: 2024-08-06T19:42:31.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/46808 - https://review.openstack.org/#/c/8239/ - https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09bea
- https://review.openstack.org/#/c/8239/ - https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978 - https://bugs.launchpad.net/nova/+bug/985184 - https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654 - http://www.ubuntu.com/usn/USN-1466-1 - https://lists.launchpad.net/openstack/msg12883.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/76110 - http://secunia.com/advisories/49439
CVE ID: CVE-2012-2655 State: PUBLISHED Published: 2012-07-18T23:00:00 Last Updated: 2024-08-06T19:42:31.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: PostgreSQL 8.3.x before 8.3.19, 8.4.x before 8.4.12, 9.0.x before 9.0.8, and 9.1.x before 9.1.4 allows remote authenticated users to cause a denial of service (server crash) by adding the (1) SECURITY DEFINER or (2) SET attributes to a procedural language's call handler. Additional Analyst Notes: - CVE Program Container: References: - http://www.postgresql.org/about/news/1398/ - http://secunia.com/advisories/50718 - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082292.html - http://lists.fedoraproject.org
50718 - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082292.html - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082258.html - http://www.debian.org/security/2012/dsa-2491 - http://rhn.redhat.com/errata/RHSA-2012-1037.html - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082294.html - http://www.mandriva.com/security/advisories?name=MDVSA-2012:092 - http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html - http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html - http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html
CVE ID: CVE-2012-2656 State: PUBLISHED Published: 2019-12-18T18:16:54 Last Updated: 2024-08-06T19:42:32.418Z Vendors: www.restlet.org/ Products: Restlet Problem Types: vulnerability in Restlet Description: An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote attacker obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2012-2656 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2656 - https://access.redhat.com/security/cve/cve-2012-2656 - http://www.openwall.com/lists/oss-security/2012/05/29/9 - http://www.openwall.com/lists/oss-securit
/cve/cve-2012-2656 - http://www.openwall.com/lists/oss-security/2012/05/29/9 - http://www.openwall.com/lists/oss-security/2012/05/29/11
CVE ID: CVE-2012-2657 State: PUBLISHED Published: 2012-08-31T00:00:00 Last Updated: 2024-08-06T19:42:32.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although
lege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://www.osvdb.org/82460 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75940 - http://www.openwall.com/lists/oss-security/2012/06/06/3 - http://www.openwall.com/lists/oss-security/2012/05/30/7 - http://www.openwall.com/lists/oss-security/2012/05/31/2 - http://www.securityfocus.com/bid/53712 - http://www.openwall.com/lists/oss-security/2
/lists/oss-security/2012/05/31/2 - http://www.securityfocus.com/bid/53712 - http://www.openwall.com/lists/oss-security/2012/05/29/10 - http://www.openwall.com/lists/oss-security/2012/05/29/7
CVE ID: CVE-2012-2658 State: PUBLISHED Published: 2012-08-31T00:00:00 Last Updated: 2024-08-06T19:42:31.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that
may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/82460 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75940 - http://www.openwall.com/lists/oss-security/2012/06/06/3 - http://www.openwall.com/lists/oss-security/2012/05/30/7 - http://www.openwall.com/lists/oss-security/2012/05/31/2 - http://www.securityfocus.com/bid/53712 - http://www.openwall.com/lists/oss-security/2012/05/29/10 - http://www.openwall.com/lists/os
ecurityfocus.com/bid/53712 - http://www.openwall.com/lists/oss-security/2012/05/29/10 - http://www.openwall.com/lists/oss-security/2012/05/29/7
CVE ID: CVE-2012-2659 State: REJECTED Published: 2021-07-09T12:01:56 Last Updated: 2021-07-09T12:01:56 Description: No description available.
CVE ID: CVE-2012-2660 State: PUBLISHED Published: 2012-06-22T14:00:00 Last Updated: 2024-08-06T19:42:31.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.o
related issue to CVE-2012-2694. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html - http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html - https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain - http://rhn.redhat.com/errata/RHSA-2013-0154.html
CVE ID: CVE-2012-2661 State: PUBLISHED Published: 2012-06-22T14:00:00 Last Updated: 2024-08-06T19:42:31.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/group/rubyonrails-security/msg/fc2da6c627fc92df?dmode=source&ou
ogram Container: References: - https://groups.google.com/group/rubyonrails-security/msg/fc2da6c627fc92df?dmode=source&output=gplain - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html - http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html - http://rhn.redhat.com/errata/RHSA-2013-0154.html
CVE ID: CVE-2012-2662 State: PUBLISHED Published: 2012-08-13T20:00:00 Last Updated: 2024-08-06T19:42:31.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to the (1) System Agent or (2) End Entity pages. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1027284 - https://exchange.xforce.ibmcloud.com/vulnerabilities/77101 - http://rhn.redhat.com/errata/RHSA-2015-1347.html - http://secunia.com/advisories/50013 - htt
com/vulnerabilities/77101 - http://rhn.redhat.com/errata/RHSA-2015-1347.html - http://secunia.com/advisories/50013 - http://osvdb.org/84099 - http://www.securityfocus.com/bid/54608 - http://rhn.redhat.com/errata/RHSA-2012-1103.html
CVE ID: CVE-2012-2663 State: PUBLISHED Published: 2014-02-15T11:00:00 Last Updated: 2024-08-06T19:42:31.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant. Additional Analyst Notes: - CVE Program Container: References: - http://www.spinics.net/lists/netfilter-devel/msg21248.html - https://bugzilla.redhat.com/show_bug.cgi?id=826702
CVE ID: CVE-2012-2664 State: PUBLISHED Published: 2012-06-29T19:00:00 Last Updated: 2024-08-06T19:42:32.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sosreport utility in the Red Hat sos package before 2.2-29 does not remove the root user password information from the Kickstart configuration file (/root/anaconda-ks.cfg) when creating an archive of debugging information, which might allow attackers to obtain passwords or password hashes. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - http://rhn.redhat.com/errata/RHSA-2012-0958.html - http://rhn.redhat.com/errata/RHSA-201
mbulletinjul2016-3090546.html - http://rhn.redhat.com/errata/RHSA-2012-0958.html - http://rhn.redhat.com/errata/RHSA-2013-1121.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/76468 - http://www.securityfocus.com/bid/54116
CVE ID: CVE-2012-2665 State: PUBLISHED Published: 2012-08-06T18:00:00 Last Updated: 2024-08-06T19:42:31.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Open Document Text (.odt) file with (1) a child tag within an incorrect parent tag, (2) duplicate tags, or (3) a Base64 ChecksumAttribute whose length is not evenly divisible by four. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/60799 - ht
sible by four. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/60799 - http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml - http://security.gentoo.org/glsa/glsa-201209-05.xml - https://bugzilla.redhat.com/show_bug.cgi?id=826077 - http://www.debian.org/security/2012/dsa-2520 - http://www.ubuntu.com/usn/USN-1536-1 - http://rhn.redhat.com/errata/RHSA-2012-1135.html - http://www.pre-cert.de/advisories/PRE-SA-2012-05.txt - http://www.securityfocus.com/bid/54769 - http://secunia.com/advisories/50692 - http://www.securitytracker.com/id?1027332 - http://www.securitytracker.com/id?1027331 - http://secunia.com/advisories/50142 - http://www.ubuntu.c
r.com/id?1027332 - http://www.securitytracker.com/id?1027331 - http://secunia.com/advisories/50142 - http://www.ubuntu.com/usn/USN-1537-1 - http://www.libreoffice.org/about-us/security/advisories/cve-2012-2665/ - http://secunia.com/advisories/50146
CVE ID: CVE-2012-2666 State: PUBLISHED Published: 2021-07-09T10:50:05 Last Updated: 2024-08-06T19:42:31.647Z Vendors: n/a Products: go/golang Problem Types: CWE-377 Description: golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicable name and executes it as shell script. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2012-2666 - https://bugzilla.suse.com/show_bug.cgi?id=765455 - https://github.com/golang/go/commit/8ac275bb01588a8c0e6c0fe2de7fd11f08feccdd - https://codereview.appspot.com/5992078 - https://security.netapp.com/ad
ommit/8ac275bb01588a8c0e6c0fe2de7fd11f08feccdd - https://codereview.appspot.com/5992078 - https://security.netapp.com/advisory/ntap-20210902-0009/
CVE ID: CVE-2012-2667 State: PUBLISHED Published: 2012-06-07T19:00:00 Last Updated: 2024-08-06T19:42:32.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes." Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/06/04/1 - http://trac.symfony-project.org/browser/tags/RELEASE_1_4_18/CHANGELOG - http://www.securityfocus.com/bid/53776 - http://symfony.com/blog/security-release-sym
er/tags/RELEASE_1_4_18/CHANGELOG - http://www.securityfocus.com/bid/53776 - http://symfony.com/blog/security-release-symfony-1-4-18-released - http://www.openwall.com/lists/oss-security/2012/06/05/2 - http://secunia.com/advisories/49312 - https://exchange.xforce.ibmcloud.com/vulnerabilities/76027
CVE ID: CVE-2012-2668 State: PUBLISHED Published: 2012-06-17T01:00:00 Last Updated: 2024-08-06T19:42:31.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/06/06/2 - http://security.gentoo.org/glsa/glsa-201406-36.xml - http://bugs.debian.org/cgi-bin/bugreport.cgi?b
urity/2012/06/06/2 - http://security.gentoo.org/glsa/glsa-201406-36.xml - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=676309 - http://rhn.redhat.com/errata/RHSA-2012-1151.html - http://www.openldap.org/its/index.cgi?findid=7285 - http://www.openwall.com/lists/oss-security/2012/06/05/4 - https://bugzilla.redhat.com/show_bug.cgi?id=825875 - http://www.openwall.com/lists/oss-security/2012/06/06/1 - https://exchange.xforce.ibmcloud.com/vulnerabilities/76099 - http://www.securitytracker.com/id?1027127 - http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commitdiff%3Bh=2c2bb2e - http://www.securityfocus.com/bid/53823 - https://support.apple.com/kb/HT210788 - https://seclists.org/bugt
3Bh=2c2bb2e - http://www.securityfocus.com/bid/53823 - https://support.apple.com/kb/HT210788 - https://seclists.org/bugtraq/2019/Dec/23 - http://seclists.org/fulldisclosure/2019/Dec/26
CVE ID: CVE-2012-2669 State: PUBLISHED Published: 2012-12-27T11:00:00 Last Updated: 2024-08-06T19:42:31.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin of Netlink messages, which allows local users to spoof Netlink communication via a crafted connector message. Additional Analyst Notes: - CVE Program Container: References: - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.5 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bcc2c9c3fff859e0eb019fe6fec26f9b8eba795c - https://bugzilla.novell.com/show_
l/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bcc2c9c3fff859e0eb019fe6fec26f9b8eba795c - https://bugzilla.novell.com/show_bug.cgi?id=761200 - http://openwall.com/lists/oss-security/2012/06/06/12 - http://www.openwall.com/lists/oss-security/2012/11/27/12 - https://github.com/torvalds/linux/commit/bcc2c9c3fff859e0eb019fe6fec26f9b8eba795c - http://lists.opensuse.org/opensuse-updates/2012-11/msg00042.html
CVE ID: CVE-2012-2670 State: PUBLISHED Published: 2012-06-17T01:00:00 Last Updated: 2024-08-06T19:42:31.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: manageuser.php in Collabtive before 0.7.6 allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg, then accessing it via a direct request to the file in files/standard/avatar. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53813 - http://www.collabtive.o-dyn.de/blog/?p=426 - http://archives.neohapsis.com/a
- http://www.securityfocus.com/bid/53813 - http://www.collabtive.o-dyn.de/blog/?p=426 - http://archives.neohapsis.com/archives/bugtraq/2012-06/0007.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/76101 - http://xync.org/2012/06/04/Arbitrary-File-Upload-in-Collabtive.html - http://www.securityfocus.com/archive/1/522973/30/0/threaded - http://www.openwall.com/lists/oss-security/2012/06/06/6 - http://www.openwall.com/lists/oss-security/2012/06/06/9
CVE ID: CVE-2012-2671 State: PUBLISHED Published: 2012-06-17T01:00:00Z Last Updated: 2024-08-06T19:42:31.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.novell.com/show_bug.cgi?id=763650 - https://github.com/rtomayko/rack-cache/commit/2e3a64d07daac4c757cc57620f2288e865a09b90 - https://github.com/rtomayko/rack-cache/blob/master/CHANGES - http://lists.fedoraproject.org/pi
7cc57620f2288e865a09b90 - https://github.com/rtomayko/rack-cache/blob/master/CHANGES - http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081812.html - https://github.com/rtomayko/rack-cache/pull/52 - http://www.openwall.com/lists/oss-security/2012/06/06/8 - http://www.openwall.com/lists/oss-security/2012/06/06/4 - https://bugzilla.redhat.com/show_bug.cgi?id=824520
CVE ID: CVE-2012-2672 State: PUBLISHED Published: 2012-06-17T01:00:00 Last Updated: 2024-08-06T19:42:31.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function. Additional Analyst Notes: - CVE Program Container: References: - https://issues.jboss.org/browse/JBPAPP-9197 - http://rhn.redhat.com/errata/RHSA-2012-1594.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/76179 - http://secunia.com/advisories/49284 - http://secunia.com/advis
ps://exchange.xforce.ibmcloud.com/vulnerabilities/76179 - http://secunia.com/advisories/49284 - http://secunia.com/advisories/51607 - http://rhn.redhat.com/errata/RHSA-2012-1592.html - http://rhn.redhat.com/errata/RHSA-2012-1591.html - http://java.net/jira/browse/JAVASERVERFACES-2436 - http://www.openwall.com/lists/oss-security/2012/06/07/2 - http://www.openwall.com/lists/oss-security/2012/06/07/3