Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2011-5049 State: PUBLISHED Published: 2012-01-04T19:00:00 Last Updated: 2024-08-07T00:23:39.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: MySQL 5.5.8, when running on Windows, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted packet to TCP port 3306. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/18269 - https://exchange.xforce.ibmcloud.com/vulnerabilities/71965
CVE ID: CVE-2011-5050 State: PUBLISHED Published: 2012-01-04T19:00:00 Last Updated: 2024-08-07T00:23:39.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in corporate/Controller in Elitecore Technologies Cyberoam UTM before 10.01.2 build 059 allows remote authenticated administrators to execute arbitrary SQL commands via the tableid parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/47304 - http://osvdb.org/77986 - https://exchange.xforce.ibmcloud.com/vulnerabilities/71920 - http://www.vulnerability-lab.com/get_content.php?id=
7986 - https://exchange.xforce.ibmcloud.com/vulnerabilities/71920 - http://www.vulnerability-lab.com/get_content.php?id=60
CVE ID: CVE-2011-5051 State: PUBLISHED Published: 2012-01-04T19:00:00 Last Updated: 2024-08-07T00:23:39.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension using (1) uploadify/upload_admin_avatar.php or (2) uploadify/upload_profile_avatar.php, then accessing it via a direct request to the file in an unspecified directory inside the webroot. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/78041 - http://secunia.com/advisories/46097 - https://wpsy
otes: - CVE Program Container: References: - http://osvdb.org/78041 - http://secunia.com/advisories/46097 - https://wpsymposium-trac.sourcerepo.com/wpsymposium_trac/ticket/265 - http://secunia.com/secunia_research/2011-91/ - http://osvdb.org/78042 - https://exchange.xforce.ibmcloud.com/vulnerabilities/72012
CVE ID: CVE-2011-5052 State: PUBLISHED Published: 2012-01-04T19:00:00 Last Updated: 2024-08-07T00:23:39.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in CoCSoft Stream Down 6.8.0 allows remote web servers to execute arbitrary code via a long response to a download request. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/18283 - http://secunia.com/advisories/47343 - http://osvdb.org/78043 - https://exchange.xforce.ibmcloud.com/vulnerabilities/72009
CVE ID: CVE-2011-5053 State: PUBLISHED Published: 2012-01-06T20:00:00 Last Updated: 2024-08-07T00:23:39.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Wi-Fi Protected Setup (WPS) protocol, when the "external registrar" authentication method is used, does not properly inform clients about failed PIN authentication, which makes it easier for remote attackers to discover the PIN value, and consequently discover the Wi-Fi network password or reconfigure an access point, by reading EAP-NACK messages. Additional Analyst Notes: - CVE Program Container: References: - http://code.google.com/p/reaver-wps/ - http://sviehb.wordpress.com/2011/12/27/wi-fi-protected-setup-pin-brute-for
ces: - http://code.google.com/p/reaver-wps/ - http://sviehb.wordpress.com/2011/12/27/wi-fi-protected-setup-pin-brute-force-vulnerability/ - http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf - http://www.kb.cert.org/vuls/id/723755 - http://www.us-cert.gov/cas/techalerts/TA12-006A.html - http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-sr-20120111-wps
CVE ID: CVE-2011-5054 State: PUBLISHED Published: 2012-01-06T21:00:00 Last Updated: 2024-08-07T00:23:39.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: kcheckpass passes a user-supplied argument to the pam_start function, often within a setuid environment, which allows local users to invoke any configured PAM stack, and possibly trigger unintended side effects, via an arbitrary valid PAM service name, a different vulnerability than CVE-2011-4122. NOTE: the vendor indicates that the possibility of resultant privilege escalation may be "a bit far-fetched." Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/72230
itional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/72230 - http://openwall.com/lists/oss-security/2011/12/07/3 - http://openwall.com/lists/oss-security/2011/12/28/5 - http://openwall.com/lists/oss-security/2011/12/27/3 - http://openwall.com/lists/oss-security/2011/12/23/8 - http://openwall.com/lists/oss-security/2012/01/02/11 - http://openwall.com/lists/oss-security/2011/12/27/1 - http://c-skills.blogspot.com/2011/11/openpam-trickery.html - http://openwall.com/lists/oss-security/2011/12/08/9 - http://openwall.com/lists/oss-security/2012/01/02/10
CVE ID: CVE-2011-5055 State: PUBLISHED Published: 2012-01-08T00:00:00Z Last Updated: 2024-09-16T19:15:23.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without properly restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted queries with the Recursion Desired (RD) bit set. NOTE: this issue exists because of an incomplete fix for CVE-2012-0024. Additional Analyst Notes: - CVE Program Container: References: - http://samiam.org/blog/20111230.html - https://bugzilla.redhat.com/show_bug.cgi?id=771428 - http://o
iner: References: - http://samiam.org/blog/20111230.html - https://bugzilla.redhat.com/show_bug.cgi?id=771428 - http://openwall.com/lists/oss-security/2012/01/03/6 - http://openwall.com/lists/oss-security/2012/01/03/13
CVE ID: CVE-2011-5056 State: PUBLISHED Published: 2012-01-08T00:00:00 Last Updated: 2024-08-07T00:23:39.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: The authoritative server in MaraDNS through 2.0.04 computes hash values for DNS data without restricting the ability to trigger hash collisions predictably, which might allow local users to cause a denial of service (CPU consumption) via crafted records in zone files, a different vulnerability than CVE-2012-0024. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/72258 - http://samiam.org/blog/20111229.html - http://www.securitytracker.com/id?1026820
CVE ID: CVE-2011-5057 State: PUBLISHED Published: 2012-01-08T17:00:00 Last Updated: 2024-08-07T00:23:39.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "ea
esponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor." Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/WW-3631 - http://secunia.com/advisories/47109 - https://issues.apache.org/jira/browse/WW-2264 - http://codesecure.blogspot.com/2011/12/struts-2-session-tampering-via.html
CVE ID: CVE-2011-5058 State: PUBLISHED Published: 2012-01-10T23:00:00 Last Updated: 2024-08-07T00:23:39.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CmbWebserver.dll module of the Control service in 3S CoDeSys 3.4 SP4 Patch 2 allows remote attackers to create arbitrary directories under the web root by specifying a non-existent directory using \ (backslash) characters in an HTTP GET request. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/72339 - http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-336-01A.pdf - http://secunia.com/advisories/47018 - http://aluigi.altervista.org/adv/codesys_1-adv.t
ms/pdf/ICS-ALERT-11-336-01A.pdf - http://secunia.com/advisories/47018 - http://aluigi.altervista.org/adv/codesys_1-adv.txt
CVE ID: CVE-2011-5059 State: PUBLISHED Published: 2012-01-10T23:00:00Z Last Updated: 2024-09-16T17:09:03.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Final Draft 8 before 8.02 allows remote attackers to execute arbitrary code via a crafted SmartType element, a different vulnerability than CVE-2011-5002. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/47044
CVE ID: CVE-2011-5060 State: PUBLISHED Published: 2012-01-13T19:00:00 Last Updated: 2024-08-07T00:23:39.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: The par_mktmpdir function in the PAR module before 1.003 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program, a different vulnerability in a different package than CVE-2011-4114. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=753955 - http://cpansearch.perl.org/src/RSCHUPP/PAR-1.003/ChangeLog -
ces: - https://bugzilla.redhat.com/show_bug.cgi?id=753955 - http://cpansearch.perl.org/src/RSCHUPP/PAR-1.003/ChangeLog - https://exchange.xforce.ibmcloud.com/vulnerabilities/72435 - https://rt.cpan.org/Public/Bug/Display.html?id=69560
CVE ID: CVE-2011-5061 State: PUBLISHED Published: 2012-01-14T02:00:00Z Last Updated: 2024-09-16T21:56:43.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: functions.php in WHMCompleteSolution (WHMCS) 4.0.x through 5.0.x allows remote attackers to trigger arbitrary code execution in the Smarty templating system by submitting a crafted ticket, related to improper handling of characters in the subject field. Additional Analyst Notes: - CVE Program Container: References: - http://forum.whmcs.com/showthread.php?t=43462 - http://www.webhostingtalk.com/showpost.php?p=7848685&postcount=35
CVE ID: CVE-2011-5062 State: PUBLISHED Published: 2012-01-14T21:00:00 Last Updated: 2024-08-07T00:23:39.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2012/dsa-2401 - http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00002.html - http://rhn.redhat.com/errata
012/dsa-2401 - http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00002.html - http://rhn.redhat.com/errata/RHSA-2012-0325.html - http://svn.apache.org/viewvc?view=rev&rev=1159309 - http://rhn.redhat.com/errata/RHSA-2012-0078.html - http://www.redhat.com/support/errata/RHSA-2011-1845.html - http://svn.apache.org/viewvc?view=rev&rev=1158180 - http://rhn.redhat.com/errata/RHSA-2012-0075.html - http://rhn.redhat.com/errata/RHSA-2012-0074.html - http://tomcat.apache.org/security-7.html - http://svn.apache.org/viewvc?view=rev&rev=1087655 - http://tomcat.apache.org/security-6.html - http://secunia.com/advisories/57126 - http://tomcat.apache.org/security-5.html - http://lists.opensuse.
ecurity-6.html - http://secunia.com/advisories/57126 - http://tomcat.apache.org/security-5.html - http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00006.html - http://rhn.redhat.com/errata/RHSA-2012-0076.html - http://marc.info/?l=bugtraq&m=139344343412337&w=2 - http://rhn.redhat.com/errata/RHSA-2012-0077.html - https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.o
https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E
CVE ID: CVE-2011-5063 State: PUBLISHED Published: 2012-01-14T21:00:00 Last Updated: 2024-08-07T00:23:39.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2012/dsa-2401 - http://lists.opensuse.org/op
otes: - CVE Program Container: References: - http://www.debian.org/security/2012/dsa-2401 - http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00002.html - http://rhn.redhat.com/errata/RHSA-2012-0325.html - http://svn.apache.org/viewvc?view=rev&rev=1159309 - http://rhn.redhat.com/errata/RHSA-2012-0078.html - http://www.redhat.com/support/errata/RHSA-2011-1845.html - http://svn.apache.org/viewvc?view=rev&rev=1158180 - http://rhn.redhat.com/errata/RHSA-2012-0075.html - http://rhn.redhat.com/errata/RHSA-2012-0074.html - http://tomcat.apache.org/security-7.html - http://svn.apache.org/viewvc?view=rev&rev=1087655 - http://tomcat.apache.org/security-6.html - http://secunia.com/advisor
ttp://svn.apache.org/viewvc?view=rev&rev=1087655 - http://tomcat.apache.org/security-6.html - http://secunia.com/advisories/57126 - http://tomcat.apache.org/security-5.html - http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00006.html - http://rhn.redhat.com/errata/RHSA-2012-0076.html - http://marc.info/?l=bugtraq&m=139344343412337&w=2 - http://rhn.redhat.com/errata/RHSA-2012-0077.html - https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r584a
d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E
CVE ID: CVE-2011-5064 State: PUBLISHED Published: 2012-01-14T21:00:00 Last Updated: 2024-08-07T00:23:39.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2012/dsa-2401 - http://lists.opensus
nalyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2012/dsa-2401 - http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00002.html - http://rhn.redhat.com/errata/RHSA-2012-0325.html - http://svn.apache.org/viewvc?view=rev&rev=1159309 - http://rhn.redhat.com/errata/RHSA-2012-0078.html - http://www.redhat.com/support/errata/RHSA-2011-1845.html - http://svn.apache.org/viewvc?view=rev&rev=1158180 - http://rhn.redhat.com/errata/RHSA-2012-0075.html - http://rhn.redhat.com/errata/RHSA-2012-0074.html - http://tomcat.apache.org/security-7.html - http://svn.apache.org/viewvc?view=rev&rev=1087655 - http://tomcat.apache.org/security-6.html - http://secunia.com
html - http://svn.apache.org/viewvc?view=rev&rev=1087655 - http://tomcat.apache.org/security-6.html - http://secunia.com/advisories/57126 - http://tomcat.apache.org/security-5.html - http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00006.html - http://rhn.redhat.com/errata/RHSA-2012-0076.html - http://marc.info/?l=bugtraq&m=139344343412337&w=2 - http://rhn.redhat.com/errata/RHSA-2012-0077.html - https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.ht
af7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E
CVE ID: CVE-2011-5065 State: PUBLISHED Published: 2012-01-15T02:00:00 Last Updated: 2024-08-07T00:23:39.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 allows remote attackers to inject arbitrary web script or HTML via vectors related to web messaging. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg27007951 - http://www-01.ibm.com/support/docview.wss?uid=swg1PM37840 - http://www.securityfocus.com/bid/51559 - https://exchange.xforce.ibmcloud.com/vulnerabilities/72336 - http://secunia.com/advisories/46469 - htt
s.com/bid/51559 - https://exchange.xforce.ibmcloud.com/vulnerabilities/72336 - http://secunia.com/advisories/46469 - http://www-01.ibm.com/support/docview.wss?uid=swg1PM49872
CVE ID: CVE-2011-5066 State: PUBLISHED Published: 2012-01-15T02:00:00Z Last Updated: 2024-09-16T20:27:08.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 does not properly handle a Service Integration Bus (SIB) dump operation involving the First Failure Data Capture (FFDC) introspection code, which allows local users to obtain sensitive information by reading the FFDC log file. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg27007951 - http://www-01.ibm.com/support/docview.wss?u
r: References: - http://www-01.ibm.com/support/docview.wss?uid=swg27007951 - http://www-01.ibm.com/support/docview.wss?uid=swg1PM36685
CVE ID: CVE-2011-5067 State: PUBLISHED Published: 2012-01-29T02:00:00Z Last Updated: 2024-09-17T02:07:11.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: move_uploaded_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/576355
CVE ID: CVE-2011-5068 State: PUBLISHED Published: 2012-01-29T02:00:00 Last Updated: 2024-08-07T00:23:39.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to hijack the authentication of user for requests that delete a user via user_delete.php and other unspecified programs. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/576355 - http://secunia.com/advisories/45437 - http://www.securityfocus.com/bid/50896 - http://osvdb.org/show/osvdb/77657 - https://exchange.xforce.ibmcloud.com/vulnerabilities/71653
CVE ID: CVE-2011-5069 State: PUBLISHED Published: 2012-01-29T02:00:00 Last Updated: 2024-08-07T00:23:39.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in incident_attachments.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in unspecified directory, a different program than CVE-2011-3833. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/71651 - http://www.kb.cert.org/vuls/id/576355 - http://secunia.com/advisorie
xchange.xforce.ibmcloud.com/vulnerabilities/71651 - http://www.kb.cert.org/vuls/id/576355 - http://secunia.com/advisories/45437 - http://www.securityfocus.com/bid/50896 - http://www.osvdb.org/77653
CVE ID: CVE-2011-5070 State: PUBLISHED Published: 2012-01-29T02:00:00 Last Updated: 2024-08-07T00:23:39.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to inject arbitrary web script or HTML via (1) the file name to incident_attachments.php; (2) unspecified vectors in link_add.php, possibly involving origref, linkref, linktype parameters, which are not properly handled in the clean_int function in lib/base.inc.php, or the redirect parameter, which is not properly handled in the html_redirect function in lib/html.inc.php; and (3) unspecified vectors in transla
which is not properly handled in the html_redirect function in lib/html.inc.php; and (3) unspecified vectors in translate.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/71652 - http://www.kb.cert.org/vuls/id/576355 - http://secunia.com/advisories/45437 - http://www.securityfocus.com/bid/50896 - http://www.osvdb.org/77655 - http://www.osvdb.org/77654 - http://www.osvdb.org/77656
CVE ID: CVE-2011-5071 State: PUBLISHED Published: 2012-01-29T02:00:00Z Last Updated: 2024-09-16T22:30:12.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.64 allow remote attackers to execute arbitrary SQL commands via the (1) exc[] parameter to report_marketing.php, (2) selected[] parameter to tasks.php, (3) sites[] parameter to billable_incidents.php, or (4) search_string parameter to search.php. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/45437 - http://seclists.org/bug
onal Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/45437 - http://seclists.org/bugtraq/2011/Jul/174 - http://en.securitylab.ru/lab/PT-2011-25 - http://secunia.com/advisories/45277 - http://sitracker.org/wiki/ReleaseNotes364