Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Additional Analyst Notes: - CVE Program Container: References: - http://lkml.org/lkml/2011/4/5/327 - http://openwall.com/lists/oss-security/2011/04/05/32 - http://www.securityfocus.com/archive/1/520102/100/0/threaded - http://secunia.com/advisories/46397 - https://bugzilla.redhat.com/show_bug.cgi?id=694021 - http://openwall.com/lists/oss-security/2011/04/06/2 - https://patchwork.kernel.org/patch/688021/ - http://www.vmware.com/security/advisories/VMSA-2011-0012.html - http://rhn.redhat.com/errata/RHSA-2011-0833.html - http://downloads.avaya.com/css/P8/documents/100145416 - http://www.securityfocus.com/bid/47185 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
CVE ID: CVE-2011-1496 State: PUBLISHED Published: 2011-04-18T18:00:00 Last Updated: 2024-08-06T22:28:41.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: tmux 1.3 and 1.4 does not properly drop group privileges, which allows local users to gain utmp group privileges via a filename to the -S command-line option. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2011/1015 - http://secunia.com/advisories/44081 - http://secunia.com/advisories/44239 - http://www.exploit-db.com/exploits/17147 - http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058452.html - http://www.securityfocus.com/bid/47283 - http://www.de
raproject.org/pipermail/package-announce/2011-April/058452.html - http://www.securityfocus.com/bid/47283 - http://www.debian.org/security/2011/dsa-2212 - http://www.vupen.com/english/advisories/2011/0897 - http://www.vupen.com/english/advisories/2011/1002 - http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058548.html - http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058367.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/66693
CVE ID: CVE-2011-1497 State: PUBLISHED Published: 2021-10-19T13:29:55 Last Updated: 2024-08-06T22:28:41.705Z Vendors: n/a Products: rails Problem Types: CWE-79 Description: A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2011/04/06/13 - https://github.com/rails/rails/blob/38df020c95beca7e12f0188cb7e18f3c37789e20/actionpack/CHANGELOG
CVE ID: CVE-2011-1498 State: PUBLISHED Published: 2011-07-07T21:00:00 Last Updated: 2024-08-06T22:28:41.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=httpclient-users&m=129853896315461&w=2 - http://openwall.com/lists/oss-security/2011/04/08/1 - https://bugzilla.redhat.com/show_bug.cgi?id=709531 - http://marc.info/?l=httpclient-users&m=12985
ecurity/2011/04/08/1 - https://bugzilla.redhat.com/show_bug.cgi?id=709531 - http://marc.info/?l=httpclient-users&m=129856318011586&w=2 - http://marc.info/?l=httpclient-users&m=129857589129183&w=2 - http://openwall.com/lists/oss-security/2011/04/07/7 - https://issues.apache.org/jira/browse/HTTPCLIENT-1061 - http://www.kb.cert.org/vuls/id/153049 - http://www.securityfocus.com/bid/46974 - http://marc.info/?l=httpclient-users&m=129858274406594&w=2 - http://securityreason.com/securityalert/8298 - http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061440.html - http://marc.info/?l=httpclient-users&m=129858299106950&w=2 - http://www.apache.org/dist/httpcomponents/httpclient/RELEASE
ttp://marc.info/?l=httpclient-users&m=129858299106950&w=2 - http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.1.x.txt
CVE ID: CVE-2011-1499 State: PUBLISHED Published: 2011-04-29T22:00:00 Last Updated: 2024-08-06T22:28:41.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=621493 - https://bugzilla.redhat.com/show_bug.cgi?id=694658 - http://secunia.com/advisories/44274 - http://openwall.com/lists/oss-security/2011/04/08/3 - https
ow_bug.cgi?id=694658 - http://secunia.com/advisories/44274 - http://openwall.com/lists/oss-security/2011/04/08/3 - https://banu.com/cgit/tinyproxy/diff/?id=e8426f6662dc467bd1d827100481b95d9a4a23e4 - https://exchange.xforce.ibmcloud.com/vulnerabilities/67256 - https://banu.com/bugzilla/show_bug.cgi?id=90 - http://www.debian.org/security/2011/dsa-2222 - http://openwall.com/lists/oss-security/2011/04/07/9
CVE ID: CVE-2011-1500 State: PUBLISHED Published: 2011-04-13T14:00:00 Last Updated: 2024-08-06T22:28:41.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: PreferencesPithosDialog.py in Pithos 0.3.7 does not properly restrict permissions for the .config/pithos.ini file in a user's home directory, which allows local users to obtain Pandora credentials by reading this file. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/pithos/+bug/733307 - http://secunia.com/advisories/44059 - https://exchange.xforce.ibmcloud.com/vulnerabilities/66661 - http://openwall.com/lists/oss-security/2011/04/08/4 - http://www.securityfocus.com/bid/47300 - http:/
rabilities/66661 - http://openwall.com/lists/oss-security/2011/04/08/4 - http://www.securityfocus.com/bid/47300 - http://openwall.com/lists/oss-security/2011/04/08/2
CVE ID: CVE-2011-1501 State: REJECTED Published: 2011-05-06T16:00:00Z Last Updated: 2024-09-17T03:47:50.096Z Description: No description available.
CVE ID: CVE-2011-1502 State: PUBLISHED Published: 2011-05-07T19:00:00Z Last Updated: 2024-09-16T16:27:31.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://issues.liferay.com/browse/LPS-14927 - http://openwall.com/lists/oss-security/2011/04/08/5 - http://openwall.com/lists/oss-security/2011/04/11/9 - http://openwall.com/lists/oss-security/2011/03/29/
/2011/04/08/5 - http://openwall.com/lists/oss-security/2011/04/11/9 - http://openwall.com/lists/oss-security/2011/03/29/1
CVE ID: CVE-2011-1503 State: PUBLISHED Published: 2011-05-07T19:00:00Z Last Updated: 2024-09-17T01:50:53.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2011/04/08/5 - http://openwall.com/lists/oss-security/2011/04/11/9 - http://openwall.com/lists/oss-security/2011/03/29/1 - http://issues.liferay.com/browse/LPS-13762 - http://issues.lifer
- http://openwall.com/lists/oss-security/2011/03/29/1 - http://issues.liferay.com/browse/LPS-13762 - http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952
CVE ID: CVE-2011-1504 State: PUBLISHED Published: 2011-05-07T19:00:00Z Last Updated: 2024-09-16T20:32:19.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA allows remote authenticated users to inject arbitrary web script or HTML via a blog title. Additional Analyst Notes: - CVE Program Container: References: - http://issues.liferay.com/browse/LPS-11506 - http://openwall.com/lists/oss-security/2011/04/08/5 - http://openwall.com/lists/oss-security/2011/04/11/9 - http://issues.liferay.com/browse/LPS-12145 - http://openwall.com/lists/oss-security/2011/03/29/1 - http://issues
/11/9 - http://issues.liferay.com/browse/LPS-12145 - http://openwall.com/lists/oss-security/2011/03/29/1 - http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952
CVE ID: CVE-2011-1505 State: PUBLISHED Published: 2011-03-22T17:00:00 Last Updated: 2024-08-06T22:28:41.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.27 services for Lotus Domino has unknown impact and attack vectors, aka SPR ESEO8DQME2. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/66142 - http://secunia.com/advisories/43689 - http://www.ibm.com/support/docview.wss?uid=swg1LO58209 - http://www.securityfocus.com/bid/46903 - http://securitytracker.com/id?1025228 - http://www.vupen.com/english/advisories/2011/0707 - http://www-01.ibm.com/suppo
http://securitytracker.com/id?1025228 - http://www.vupen.com/english/advisories/2011/0707 - http://www-01.ibm.com/support/docview.wss?uid=swg27013341
CVE ID: CVE-2011-1506 State: PUBLISHED Published: 2011-03-22T17:00:00 Last Updated: 2024-08-06T22:28:41.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls
om third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/MAPG-8D9M4P - https://exchange.xforce.ibmcloud.com/vulnerabilities/65932 - http://www.vupen.com/english/advisories/2011/0610 - http://www.securityfocus.com/bid/46767 - http://www.kb.cert.org/vuls/id/555316 - http://secunia.com/advisories/43678
CVE ID: CVE-2011-1507 State: PUBLISHED Published: 2011-04-27T00:00:00 Last Updated: 2024-08-06T22:28:41.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial of service (file descriptor exhaustion and disk space exhaustion) via a series of TCP connections. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2011/1188 - http://lists.fedor
yst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2011/1188 - http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058922.html - http://www.debian.org/security/2011/dsa-2225 - http://securitytracker.com/id?1025432 - http://www.vupen.com/english/advisories/2011/1086 - http://www.vupen.com/english/advisories/2011/1107 - http://secunia.com/advisories/44529 - http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059702.html - http://downloads.digium.com/pub/security/AST-2011-005.html - https://bugzilla.redhat.com/show_bug.cgi?id=698916 - http://secunia.com/advisories/44197
CVE ID: CVE-2011-1508 State: PUBLISHED Published: 2011-12-14T00:00:00 Last Updated: 2024-08-06T22:28:41.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, does not properly manage memory allocations for function pointers, which allows user-assisted remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Function Pointer Overwrite Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14816 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-091
CVE ID: CVE-2011-1509 State: PUBLISHED Published: 2011-09-20T10:00:00 Last Updated: 2024-08-06T22:28:41.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/69841 - http://www.securityfocus.com/bid/49636 - http://securityreason.com/securityalert/8385 - http://www.coresecurity.com/content/multiples-vulnerabilitie
/bid/49636 - http://securityreason.com/securityalert/8385 - http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp - http://www.securityfocus.com/archive/1/519652/100/0/threaded
CVE ID: CVE-2011-1510 State: PUBLISHED Published: 2011-09-20T10:00:00 Last Updated: 2024-08-06T22:28:41.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/69840 - http://www.securityfocus.com/bid/49636 - http://securityreason.com/securityalert/8385 - http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp - http://www.securityfocus.com/ar
/8385 - http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp - http://www.securityfocus.com/archive/1/519652/100/0/threaded
CVE ID: CVE-2011-1511 State: PUBLISHED Published: 2011-07-20T22:36:00 Last Updated: 2024-08-06T22:28:41.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Products Suite 2.1.1 and 3.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to Administration. Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/cas/techalerts/TA11-201A.html - http://securityreason.com/securityalert/8254 - http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html
CVE ID: CVE-2011-1512 State: PUBLISHED Published: 2011-05-31T20:00:00 Last Updated: 2024-08-06T22:28:41.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in xlssr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a malformed BIFF record in a .xls Excel spreadsheet attachment, aka SPR PRAD8E3HKR. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21500034 - http://www.securityfocus.com/bid/47962 - http://www.securityfocus.com/archive/1/518120/100/0/threaded - http://secunia.com/advisories/44624 - http://www.coresecurity.
//www.securityfocus.com/archive/1/518120/100/0/threaded - http://secunia.com/advisories/44624 - http://www.coresecurity.com/content/LotusNotes-XLS-viewer-heap-overflow - http://securityreason.com/securityalert/8263 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14203 - https://exchange.xforce.ibmcloud.com/vulnerabilities/67619
CVE ID: CVE-2011-1513 State: PUBLISHED Published: 2011-11-04T21:00:00 Last Updated: 2024-08-06T22:28:41.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107_config.php via a crafted MySQL server name. Additional Analyst Notes: - CVE Program Container: References: - http://www.coresecurity.com/content/e107-cms-script-command-injection - http://www.securityfocus.com/bid/50339 - https://exchange.xforce.ibmcloud.com/vulnerabilities/70921 - http://e107.svn.sourceforge.net/viewvc/
cus.com/bid/50339 - https://exchange.xforce.ibmcloud.com/vulnerabilities/70921 - http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.8/install_.php?r1=11931&r2=12376&pathrev=12376
CVE ID: CVE-2011-1514 State: PUBLISHED Published: 2011-07-01T10:00:00Z Last Updated: 2024-09-16T18:07:58.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: The inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request containing crafted parameters. Additional Analyst Notes: - CVE Program Container: References: - http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182 - http://secunia.com/advisories/45100 - http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182 - http://www.coresecurity.com/content/HP-Data-Pro
000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182 - http://www.coresecurity.com/content/HP-Data-Protector-multiple-vulnerabilities
CVE ID: CVE-2011-1515 State: PUBLISHED Published: 2011-07-01T10:00:00Z Last Updated: 2024-09-16T19:35:05.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: The inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to cause a denial of service (daemon exit) via a request containing crafted parameters. Additional Analyst Notes: - CVE Program Container: References: - http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182 - http://secunia.com/advisories/45100 - http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182 - http://www.coresecurity.com/content/HP-Data-Protector-multiple-vulnerabilitie
hSupport/Document.jsp?objectID=c02872182 - http://www.coresecurity.com/content/HP-Data-Protector-multiple-vulnerabilities
CVE ID: CVE-2011-1516 State: PUBLISHED Published: 2011-11-15T18:00:00 Last Updated: 2024-08-06T22:28:41.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kSBXProfileNoNetwork and kSBXProfileNoInternet sandbox profiles in Apple Mac OS X 10.5.x through 10.7.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as demonstrated by use of osascript to send Apple events to the launchd daemon, a related issue to CVE-2008-7303. Additional Analyst Notes: - CVE Program Container: References: - http://www.coresecurity.com/content/apple-osx-sandbox-bypass - http://www.securityfocus.com/archive/1/52
: References: - http://www.coresecurity.com/content/apple-osx-sandbox-bypass - http://www.securityfocus.com/archive/1/520479/100/100/threaded
CVE ID: CVE-2011-1517 State: PUBLISHED Published: 2020-02-05T22:15:25 Last Updated: 2024-08-06T22:28:41.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function. By sending a specially-crafted packet, an attacker could exploit this vulnerability to cause the application to crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53424 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75452 - http://archives.neohapsis.com/archives/bugtraq/2012-05/0061.html
CVE ID: CVE-2011-1518 State: PUBLISHED Published: 2011-04-18T18:00:00 Last Updated: 2024-08-06T22:28:41.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.4.x before 2.4.10 and 3.x before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html - http://secunia.com/advisories/44029 - http://www.securityfocus.com/bid/47323 - http://otrs.org/advisory/OSA-2011-01-en/ - http://www.vupen.com/english/advisories/2011/1186 -
rityfocus.com/bid/47323 - http://otrs.org/advisory/OSA-2011-01-en/ - http://www.vupen.com/english/advisories/2011/1186 - http://www.osvdb.org/71790 - http://www.debian.org/security/2011/dsa-2231 - https://exchange.xforce.ibmcloud.com/vulnerabilities/66698 - http://secunia.com/advisories/44479
CVE ID: CVE-2011-1519 State: PUBLISHED Published: 2011-03-25T19:00:00 Last Updated: 2024-08-06T22:28:41.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: The remote console in the Server Controller in IBM Lotus Domino 7.x and 8.x verifies credentials against a file located at a UNC share pathname specified by the client, which allows remote attackers to bypass authentication, and consequently execute arbitrary code, by placing this pathname in the COOKIEFILE field. NOTE: this might overlap CVE-2011-0920. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-11-110 - http://www.vupen.com/english/advisories/2011/0758 - ht
ences: - http://www.zerodayinitiative.com/advisories/ZDI-11-110 - http://www.vupen.com/english/advisories/2011/0758 - http://securitytracker.com/id?1025241 - http://www.securityfocus.com/archive/1/517119/100/0/threaded - http://secunia.com/advisories/43860 - http://www.securityfocus.com/bid/46985 - http://securityreason.com/securityalert/8164
CVE ID: CVE-2011-1520 State: PUBLISHED Published: 2011-03-25T19:00:00 Last Updated: 2024-08-06T22:28:41.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of the server console in IBM Lotus Domino does not require a password (aka Server_Console_Password), which allows physically proximate attackers to perform administrative changes or obtain sensitive information via a (1) Load, (2) Tell, or (3) Set Configuration command. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-11-110 - http://publib.boulder.ibm.com/infocenter/domhelp/v8r0/index.jsp?topic=/com.ibm.help.domino.admin.doc/DOC/H_THE_DO
-110 - http://publib.boulder.ibm.com/infocenter/domhelp/v8r0/index.jsp?topic=/com.ibm.help.domino.admin.doc/DOC/H_THE_DOMINO_CONTROLLER_AND_CONSOLE_OVER.html - http://www.lotus.com/ldd/doc/domino_notes/rnext/help6_admin.nsf/2e73cbb2141acefa85256b8700688cea/0c50e423038555d085256c1d003a31f0?OpenDocument - http://www.securityfocus.com/archive/1/517119/100/0/threaded - http://securityreason.com/securityalert/8164 - http://www.lotus.com/ldd/dominowiki.nsf/dx/server_console_password
CVE ID: CVE-2011-1521 State: PUBLISHED Published: 2011-05-24T23:00:00 Last Updated: 2024-08-06T22:28:41.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service (resource consumption) via a crafted URL, as demonstrated by the file:///etc/passwd and file:///dev/zero URLs. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2011/09/15/5 - http://www.mandriva.com/security/advisories?name=MDVSA