Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2011-1394 State: PUBLISHED Published: 2012-03-13T01:00:00 Last Updated: 2024-08-06T22:28:40.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allow remote attackers to cause a denial of service (memory consumption) by establishing many UI sessions within one HTTP session. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?u
HTTP session. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21584666 - http://secunia.com/advisories/48299 - https://exchange.xforce.ibmcloud.com/vulnerabilities/71985 - http://secunia.com/advisories/48305 - http://www-01.ibm.com/support/docview.wss?uid=swg1IV09157 - http://www.securityfocus.com/bid/52333
CVE ID: CVE-2011-1395 State: PUBLISHED Published: 2012-03-13T01:00:00 Last Updated: 2024-08-06T22:28:40.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in imicon.jsp in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the controlid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/71996 - http://www.ibm.com/support/docview.wss?uid=swg21584666 - http://secunia.com/advisories/48299 - http://www.securityfocus.com/bid/52333 - http://www-01.ibm.com/support/docview.wss?
ttp://secunia.com/advisories/48299 - http://www.securityfocus.com/bid/52333 - http://www-01.ibm.com/support/docview.wss?uid=swg1IV09189
CVE ID: CVE-2011-1396 State: PUBLISHED Published: 2012-03-13T01:00:00 Last Updated: 2024-08-06T22:28:40.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the reportType parameter to an unspecified component. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg1IV09190 - http://www.ibm.com/support/docview.wss?uid=swg21584666 - http://secunia.com/advisories/48299 - https://exchange.xforce.ibmcloud.com/vulnerabilities/71999 - http://w
wg21584666 - http://secunia.com/advisories/48299 - https://exchange.xforce.ibmcloud.com/vulnerabilities/71999 - http://www.securityfocus.com/bid/52333
CVE ID: CVE-2011-1397 State: PUBLISHED Published: 2012-03-13T01:00:00 Last Updated: 2024-08-06T22:28:40.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Labor Reporting page in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allows remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xf
authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/72000 - http://www.ibm.com/support/docview.wss?uid=swg21584666 - http://secunia.com/advisories/48299 - http://secunia.com/advisories/48305 - http://www.securityfocus.com/bid/52333 - http://www-01.ibm.com/support/docview.wss?uid=swg1IV09193
CVE ID: CVE-2011-1398 State: PUBLISHED Published: 2012-08-30T22:00:00 Last Updated: 2024-08-06T22:28:40.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2012/09/05/15 - http:/
onal Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2012/09/05/15 - http://security-tracker.debian.org/tracker/CVE-2011-1398 - http://www.securitytracker.com/id?1027463 - http://secunia.com/advisories/55078 - https://bugs.php.net/bug.php?id=60227 - http://rhn.redhat.com/errata/RHSA-2013-1307.html - http://openwall.com/lists/oss-security/2012/08/29/5 - http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.html - http://article.gmane.org/gmane.comp.php.devel/70584 - http://www.ubuntu.com/usn/USN-1569-1
CVE ID: CVE-2011-1400 State: PUBLISHED Published: 2011-03-25T19:00:00 Last Updated: 2024-08-06T22:28:40.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of the shell_escape_commands directive in conf/texmf.d/95NonPath.cnf in the tex-common package before 2.08.1 in Debian GNU/Linux squeeze, Ubuntu 10.10 and 10.04 LTS, and possibly other operating systems lists certain programs, which might allow remote attackers to execute arbitrary code via a crafted TeX document. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/66249 - http://secunia.com/advisories/43973 - http://svn.debian.org/wsvn
://exchange.xforce.ibmcloud.com/vulnerabilities/66249 - http://secunia.com/advisories/43973 - http://svn.debian.org/wsvn/debian-tex/?op=comp&compare%5B%5D=%2Ftex-common%2Ftrunk%404781&compare%5B%5D=%2Ftex-common%2Ftrunk%404812 - http://www.securityfocus.com/bid/46986 - http://www.vupen.com/english/advisories/2011/0731 - http://svn.debian.org/wsvn/debian-tex/tex-common/trunk/?op=log - http://www.ubuntu.com/usn/USN-1103-1 - http://www.debian.org/security/2011/dsa-2198 - http://www.vupen.com/english/advisories/2011/0861 - http://secunia.com/advisories/43816
CVE ID: CVE-2011-1401 State: PUBLISHED Published: 2011-04-11T18:00:00 Last Updated: 2024-08-06T22:28:40.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2011/dsa-2214 - http://www.vupen.com/english/advisories/2011/1005 - http://www.vupen.com/
http://www.debian.org/security/2011/dsa-2214 - http://www.vupen.com/english/advisories/2011/1005 - http://www.vupen.com/english/advisories/2011/0907 - http://secunia.com/advisories/44137 - http://ikiwiki.info/security/#index39h2 - http://secunia.com/advisories/44079 - http://www.securityfocus.com/bid/47285 - http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058403.html
CVE ID: CVE-2011-1402 State: PUBLISHED Published: 2011-05-13T22:00:00 Last Updated: 2024-08-06T22:28:40.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara before 1.3.6 allows remote authenticated users to bypass intended access restrictions, and suspend a user account, edit a view, visit a view, edit a plan artefact, read a plans block, read a plan artefact, edit a blog, read a blog block, read a blog artefact, or access a block, via a request associated with (1) admin/users/search.json.php, (2) view/newviewtoken.json.php, (3) lib/mahara.php, (4) artefact/plans/tasks.json.php, (5) artefact/plans/viewtasks.json.php, (6) artefact/blog/view/index.json.php, (7) artefact/blog/
t/plans/tasks.json.php, (5) artefact/plans/viewtasks.json.php, (6) artefact/blog/view/index.json.php, (7) artefact/blog/posts.json.php, or (8) blocktype/myfriends/myfriends.json.php, related to incorrect privilege enforcement, a missing user id check, and incorrect enforcement of the Overriding Start/Stop Dates setting. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/mahara/+milestone/1.3.6 - https://launchpad.net/mahara/+bug/771637 - https://launchpad.net/mahara/+bug/771623 - https://launchpad.net/mahara/+bug/771614 - https://exchange.xforce.ibmcloud.com/vulnerabilities/67397 - https://launchpad.net/mahara/+bug/746182 - https://launchpad.net/mahara/+bu
.xforce.ibmcloud.com/vulnerabilities/67397 - https://launchpad.net/mahara/+bug/746182 - https://launchpad.net/mahara/+bug/771592 - https://launchpad.net/mahara/+bug/771644 - https://exchange.xforce.ibmcloud.com/vulnerabilities/67396 - https://launchpad.net/mahara/+bug/772140 - http://www.securityfocus.com/bid/47798 - http://secunia.com/advisories/44433 - https://launchpad.net/mahara/+bug/771653 - http://www.debian.org/security/2011/dsa-2246
CVE ID: CVE-2011-1403 State: PUBLISHED Published: 2011-05-13T22:00:00 Last Updated: 2024-08-06T22:28:40.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the pieforms implementation in Mahara before 1.3.6 allows remote attackers to hijack the authentication of arbitrary users for requests to any form, related to inappropriate regeneration of session keys. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/mahara/+milestone/1.3.6 - https://launchpad.net/mahara/+bug/771598 - https://exchange.xforce.ibmcloud.com/vulnerabilities/67398 - http://www.securityfocus.com/bid/47798 - http://secunia.com/
ttps://exchange.xforce.ibmcloud.com/vulnerabilities/67398 - http://www.securityfocus.com/bid/47798 - http://secunia.com/advisories/44433 - http://www.debian.org/security/2011/dsa-2246
CVE ID: CVE-2011-1404 State: PUBLISHED Published: 2011-05-13T22:00:00 Last Updated: 2024-08-06T22:28:40.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara before 1.3.6 does not properly restrict the data in responses to AJAX calls, which allows remote authenticated users to obtain sensitive information via a request associated with (1) blocktype/myfriends/myfriends.json.php, (2) json/usersearch.php, (3) group/membersearchresults.json.php, or (4) json/friendsearch.php, as demonstrated by information about friends and e-mail addresses. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/mahara/+milestone/1.3.6 - https://launchpad.net/mahar
otes: - CVE Program Container: References: - https://launchpad.net/mahara/+milestone/1.3.6 - https://launchpad.net/mahara/+bug/772179 - https://exchange.xforce.ibmcloud.com/vulnerabilities/67395 - https://launchpad.net/mahara/+bug/772140 - http://www.securityfocus.com/bid/47798 - http://secunia.com/advisories/44433 - https://launchpad.net/mahara/+bug/772174 - https://launchpad.net/mahara/+bug/772160 - http://www.debian.org/security/2011/dsa-2246
CVE ID: CVE-2011-1405 State: PUBLISHED Published: 2011-05-13T22:00:00 Last Updated: 2024-08-06T22:28:40.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Mahara before 1.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors associated with HTML e-mail messages, related to artefact/comment/lib.php and interaction/forum/lib.php. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/mahara/+milestone/1.3.6 - https://exchange.xforce.ibmcloud.com/vulnerabilities/67399 - https://launchpad.net/mahara/+bug/772860 - http://www.securityfocus.com/bid/47798 - http://secunia.com/a
ilities/67399 - https://launchpad.net/mahara/+bug/772860 - http://www.securityfocus.com/bid/47798 - http://secunia.com/advisories/44433 - http://www.debian.org/security/2011/dsa-2246
CVE ID: CVE-2011-1406 State: PUBLISHED Published: 2011-05-13T22:00:00 Last Updated: 2024-08-06T22:28:40.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara before 1.3.6 does not properly handle an https URL in the wwwroot configuration setting, which makes it easier for user-assisted remote attackers to obtain credentials by sniffing the network at a time when an http URL is used for a login. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/mahara/+milestone/1.3.6 - https://exchange.xforce.ibmcloud.com/vulnerabilities/67400 - https://launchpad.net/mahara/+bug/685942 - http://www.debian.org/security/2011/dsa-2246
CVE ID: CVE-2011-1407 State: PUBLISHED Published: 2011-05-16T18:00:00 Last Updated: 2024-08-06T22:28:40.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-1135-1 - https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html - http://www.debian.org/security/2011/dsa-2236 - https://lists.exim.org/lurker/message/20110509.091632.daed0206.en.ht
ml - http://www.debian.org/security/2011/dsa-2236 - https://lists.exim.org/lurker/message/20110509.091632.daed0206.en.html - http://www.securityfocus.com/bid/47836
CVE ID: CVE-2011-1408 State: PUBLISHED Published: 2019-10-29T19:51:39 Last Updated: 2024-08-06T22:28:40.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2011-1408 - https://snyk.io/vuln/SNYK-LINUX-IKIWIKI-133098 - https://ikiwiki.info/security/#index40h2 - https://www.tenable.com/plugins/nessus/55157
CVE ID: CVE-2011-1409 State: PUBLISHED Published: 2011-06-24T20:00:00 Last Updated: 2024-08-06T22:28:40.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frams's Fast File EXchange (F*EX, aka fex) 20100208, and possibly other versions before 20110610, allows remote attackers to bypass authentication and upload arbitrary files via a request that lacks an authentication ID. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/48239 - http://fex.rus.uni-stuttgart.de/fex.html - http://secunia.com/advisories/44940 - https://exchange.xforce.ibmcloud.com/vulnerabilities/68005 - http://www.debian.org/security/2011/dsa-2259
CVE ID: CVE-2011-1411 State: PUBLISHED Published: 2011-09-02T23:00:00 Last Updated: 2024-08-06T22:28:40.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack." Additional Analyst Notes: - CVE Program Container: References: - http://shibboleth.internet2.edu/secadv/secadv_20110725.txt - http://www.debian.org/security/2011/dsa-2284 - http://secunia.com/advisories/50994 - http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html - http://www.mandriva.com/security/advisories?
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html - http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
CVE ID: CVE-2011-1412 State: PUBLISHED Published: 2011-08-04T01:00:00 Last Updated: 2024-08-06T22:28:40.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: sys/sys_unix.c in the ioQuake3 engine on Unix and Linux, as used in World of Padman 1.5.x before 1.5.1.1 and OpenArena 0.8.x-15 and 0.8.x-16, allows remote game servers to execute arbitrary commands via shell metacharacters in a long fs_game variable. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.html - http://svn.icculus.org/quake3?view=rev&revision=2097 - http://thilo.tjps.eu/download/patches/ioq3-svn-r2097.diff - http://secunia.com/advisor
g/quake3?view=rev&revision=2097 - http://thilo.tjps.eu/download/patches/ioq3-svn-r2097.diff - http://secunia.com/advisories/45468 - http://worldofpadman.com/website/news/en/article/266/wop-1-5-1-1-hotfix-released-for-linux.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/68869 - https://bugzilla.redhat.com/show_bug.cgi?id=725951 - http://www.osvdb.org/74137 - http://www.securityfocus.com/bid/48915 - http://www.securityfocus.com/archive/1/519051/100/0/threaded - http://securityreason.com/securityalert/8324 - https://security.gentoo.org/glsa/201706-23 - http://secunia.com/advisories/45417 - http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063460.html
CVE ID: CVE-2011-1413 State: PUBLISHED Published: 2011-03-11T01:00:00 Last Updated: 2024-08-06T22:28:40.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome before 10.0.648.127 on Linux does not properly mitigate an unspecified flaw in an X server, which allows remote attackers to cause a denial of service (application crash) via vectors involving long messages. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/65949 - http://www.securityfocus.com/bid/46785 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13922 - http://googlechromereleases.blogspot.com/2011/03
.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13922 - http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html - http://code.google.com/p/chromium/issues/detail?id=49747 - http://www.vupen.com/english/advisories/2011/0628
CVE ID: CVE-2011-1414 State: PUBLISHED Published: 2011-03-22T17:00:00 Last Updated: 2024-08-06T22:28:41.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the tibbr web server, as used in TIBCO tibbr 1.0.0 through 1.5.0 and tibbr Service 1.0.0 through 1.5.0, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories/tibbr-tibbr-service-advisory_20110315.jsp - http://www.vupen.com/english/advisories/2011/0687 - http://securitytracker.com/id?1025220 - http://www.osvdb.org/71178 - http://www.securi
om/english/advisories/2011/0687 - http://securitytracker.com/id?1025220 - http://www.osvdb.org/71178 - http://www.securityfocus.com/bid/46891 - http://www.tibco.com/multimedia/tibbr_advisory_20110315_tcm8-13474.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/66113 - http://secunia.com/advisories/43765
CVE ID: CVE-2011-1415 State: REJECTED Published: 2011-03-11T17:00:00Z Last Updated: 2024-09-16T17:38:09.236Z Description: No description available.
CVE ID: CVE-2011-1416 State: PUBLISHED Published: 2011-03-11T17:00:00Z Last Updated: 2024-09-17T03:19:00.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246 allows attackers to read the contents of memory locations via unknown vectors, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011. Additional Analyst Notes: - CVE Program Container: References: - http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011 - http://www.zdnet.com/blog/security/pwn2own-2011-blackberry-falls-to-webkit-browser-attack/8401
CVE ID: CVE-2011-1417 State: PUBLISHED Published: 2011-03-11T17:00:00 Last Updated: 2024-08-06T22:28:40.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in QuickLook, as used in Apple Mac OS X before 10.6.7 and MobileSafari in Apple iOS before 4.2.7 and 4.3.x before 4.3.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a Microsoft Office document with a crafted size field in the OfficeArtMetafileHeader, related to OfficeArtBlip, as demonstrated on the iPhone by Charlie Miller and Dion Blazakis during a Pwn2Own competition at CanSecWest 2011. Additional Analyst Notes: - CVE Program Co
lie Miller and Dion Blazakis during a Pwn2Own competition at CanSecWest 2011. Additional Analyst Notes: - CVE Program Container: References: - http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html - http://lists.apple.com/archives/security-announce/2011//Apr/msg00001.html - http://lists.apple.com/archives/Security-announce/2011//Oct/msg00005.html - http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011 - http://support.apple.com/kb/HT4607 - http://lists.apple.com/archives/security-announce/2011//Apr/msg00000.html - http://support.apple.com/kb/HT5003 - http://www.zerodayinitiative.com/advisories/ZDI-11-109/ - http://secunia.com/advisories/44154 - http://www.zdnet.com/b
- http://www.zerodayinitiative.com/advisories/ZDI-11-109/ - http://secunia.com/advisories/44154 - http://www.zdnet.com/blog/security/charlie-miller-wins-pwn2own-again-with-iphone-4-exploit/8378 - http://support.apple.com/kb/HT4581
CVE ID: CVE-2011-1418 State: PUBLISHED Published: 2011-03-11T22:00:00Z Last Updated: 2024-09-16T19:19:15.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: The stateless address autoconfiguration (aka SLAAC) functionality in the IPv6 networking implementation in Apple iOS before 4.3 and Apple TV before 4.2 places the MAC address into the IPv6 address, which makes it easier for remote IPv6 servers to track users by logging source IPv6 addresses. Additional Analyst Notes: - CVE Program Container: References: - http://support.apple.com/kb/HT4564 - http://support.apple.com/kb/HT4565 - http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html - http://lists.apple.com/
pple.com/kb/HT4565 - http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html - http://lists.apple.com/archives/security-announce/2011//Mar/msg00005.html
CVE ID: CVE-2011-1419 State: PUBLISHED Published: 2011-03-14T19:00:00 Last Updated: 2024-08-06T22:28:40.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/65971 - http://secunia.com/advisories/43684 - http://www.securityfocus.com/bid/46685 - http://www.vupen.c
ulnerabilities/65971 - http://secunia.com/advisories/43684 - http://www.securityfocus.com/bid/46685 - http://www.vupen.com/english/advisories/2011/0563 - http://tomcat.apache.org/security-7.html - http://securityreason.com/securityalert/8131 - https://exchange.xforce.ibmcloud.com/vulnerabilities/66154 - http://www.osvdb.org/71027 - http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E - http://svn.apache.org/viewvc?view=revision&revision=1079752 - http://markmail.org/message/lzx5273wsgl5pob6 - http://markmail.org/message/yzmyn44f5aetmm2r - http://marc.info/?l=tomcat-user&m=129966773405409&w=2