deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5272
Published: 2012-10-09
Description: Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than other Flash Player memory corruption CVEs listed in APSB12-22.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00034.html; http://osvdb.org/86049; http://www.adobe.com/support/security/bulletins/apsb12-22.html
CVE: CVE-2011-5209
Published: 2012-10-09
Description: Cross-site scripting (XSS) vulnerability in search/ in GraphicsClone Script, possibly 1.11, allows remote attackers to inject arbitrary web script or HTML via the term parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/108145/graphicclone-xss.txt; http://secunia.com/advisories/47372; http://www.osvdb.org/78107
CVE: CVE-2011-5210
Published: 2012-10-09
Description: Directory traversal vulnerability in admin/preview.php in Limny 3.0.0 allows remote attackers to read arbitrary files via a ..%2F (encoded dot dot slash) in the theme parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/43124; http://www.autosectools.com/Advisories/Limny.3.0.0_Local.File.Inclusion_99.html; http://www.limny.org/releases/limny-3.0.2.7z
CVE: CVE-2012-4456
Published: 2012-10-09
Description: The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/50665; http://www.openwall.com/lists/oss-security/2012/09/28/5; http://www.securityfocus.com/bid/55716
CVE: CVE-2012-4457
Published: 2012-10-09
Description: OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/50665; http://www.openwall.com/lists/oss-security/2012/09/28/6; http://www.securityfocus.com/bid/55716
CVE: CVE-2012-5341
Published: 2012-10-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in statistik.php in Otterware StatIt 4 allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter, (2) show parameter in a stat_tld action, or (3) order parameter in a stat_abfragen action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/108340/statit4-xss.txt; http://st2tea.blogspot.com/2012/01/otterware-statit4-cross-site-scripting.html; http://www.securityfocus.com/bid/51280
CVE: CVE-2012-5342
Published: 2012-10-09
Description: Multiple SQL injection vulnerabilities in SenseSites CommonSense CMS allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) special.php, (2) article.php, or (3) cat2.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/108426/CommonSense-CMS-Blind-SQL-Injection.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72158; http://packetstormsecurity.org/files/108426/CommonSense-CMS-Blind-SQL-Injection.html
CVE: CVE-2012-5343
Published: 2012-10-09
Description: Cross-site scripting (XSS) vulnerability in admin/login.php in Limny 3.0.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO, related to the "PHP_SELF" variable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/78093; http://packetstormsecurity.org/files/108355/ZSL-2012-5066.txt; http://secunia.com/advisories/47444
CVE: CVE-2012-5344
Published: 2012-10-09
Description: Directory traversal vulnerability in the WebServer (Thttpd.bat) in IpTools (aka Tiny TCP/IP server) 0.1.4 allows remote attackers to read arbitrary files via a .. (dot dot) in a HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0045.html; http://www.securityfocus.com/bid/51311; http://archives.neohapsis.com/archives/bugtraq/2012-01/0045.html
CVE: CVE-2012-5345
Published: 2012-10-09
Description: Buffer overflow in the Remote command server (Rcmd.bat) in IpTools (aka Tiny TCP/IP server) 0.1.4 allows remote attackers to cause a denial of service (crash) via a long string to TCP port 23.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0046.html; http://www.securityfocus.com/bid/51312; http://archives.neohapsis.com/archives/bugtraq/2012-01/0046.html
CVE: CVE-2012-5346
Published: 2012-10-09
Description: Cross-site scripting (XSS) vulnerability in wp-live.php in the WP Live.php module 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/108282/wplivephp-xss.txt; http://www.securityfocus.com/bid/51220; https://exchange.xforce.ibmcloud.com/vulnerabilities/72080
CVE: CVE-2012-5347
Published: 2012-10-09
Description: TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter to (1) inc/filefunctions.inc or (2) info.php.
CVSS Score: 7.5 (HIGH)
References: http://www.exploit-db.com/exploits/18322; http://www.osvdb.org/82481; http://www.securityfocus.com/bid/51325
CVE: CVE-2012-5348
Published: 2012-10-09
Description: SQL injection vulnerability in MangosWeb Enhanced 3.0.3 allows remote attackers to execute arbitrary SQL commands via the login parameter in a login action to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/47468; http://www.exploit-db.com/exploits/18335; http://www.securityfocus.com/bid/51314
CVE: CVE-2012-5349
Published: 2012-10-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) link, (2) title, or (3) dl parameter.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/47475; http://wordpress.org/extend/plugins/pay-with-tweet/changelog/; http://www.exploit-db.com/exploits/18330
CVE: CVE-2012-5350
Published: 2012-10-09
Description: SQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the id parameter in a paywithtweet shortcode.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/47475; http://wordpress.org/extend/plugins/pay-with-tweet/changelog/; http://www.exploit-db.com/exploits/18330
CVE: CVE-2012-3436
Published: 2012-10-09
Description: OpenTTD 0.6.0 through 1.2.1 does not properly validate requests to clear a water tile, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a certain sequence of steps related to "the water/coast aspect of tiles which also have railtracks on one half."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.openttd.org/task/5254; http://lists.opensuse.org/opensuse-updates/2012-08/msg00043.html; http://secunia.com/advisories/50042
CVE: CVE-2012-0182
Published: 2012-10-09
Description: Microsoft Word 2007 SP2 and SP3 does not properly handle memory during the parsing of Word documents, which allows remote attackers to execute arbitrary code via a crafted document, aka "Word PAPX Section Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/55780; http://www.us-cert.gov/cas/techalerts/TA12-283A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-064
CVE: CVE-2012-2520
Published: 2012-10-09
Description: Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/55797; http://www.securitytracker.com/id?1027625; http://www.securitytracker.com/id?1027626
CVE: CVE-2012-2528
Published: 2012-10-09
Description: Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation Services on Microsoft SharePoint Server 2010; and Office Web Apps 2010 SP1 allows remote attackers to execute arbitrary code via a crafted RTF document, aka "RTF File listid Use-After-Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/55781; http://www.us-cert.gov/cas/techalerts/TA12-283A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-064
CVE: CVE-2012-2529
Published: 2012-10-09
Description: Integer overflow in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory, aka "Windows Kernel Integer Overflow Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/cas/techalerts/TA12-283A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-068; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15867
CVE: CVE-2012-2550
Published: 2012-10-09
Description: Microsoft Works 9 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted Word .doc file, aka "Works Heap Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/50844; http://www.securityfocus.com/bid/55796; http://www.securitytracker.com/id?1027621
CVE: CVE-2012-2551
Published: 2012-10-09
Description: The server in Kerberos in Microsoft Windows Server 2008 R2 and R2 SP1, and Windows 7 Gold and SP1, allows remote attackers to cause a denial of service (NULL pointer dereference and reboot) via a crafted session request, aka "Kerberos NULL Dereference Vulnerability."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/50867; http://www.securityfocus.com/bid/55778; http://www.securitytracker.com/id?1027620
CVE: CVE-2012-2552
Published: 2012-10-09
Description: Cross-site scripting (XSS) vulnerability in the SQL Server Report Manager in Microsoft SQL Server 2000 Reporting Services SP2 and SQL Server 2005 SP4, 2008 SP2 and SP3, 2008 R2 SP1, and 2012 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "Reflected XSS Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/55783; http://www.us-cert.gov/cas/techalerts/TA12-283A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-070
CVE: CVE-2012-3505
Published: 2012-10-09
Description: Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that trigger hash collisions predictably.  bucket.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=685281; http://secunia.com/advisories/50278; http://secunia.com/advisories/51074
CVE: CVE-2012-3549
Published: 2012-10-09
Description: The SCTP implementation in FreeBSD 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted ASCONF chunk.
CVSS Score: 7.8 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686962; http://www.exploit-db.com/exploits/20226; http://www.openwall.com/lists/oss-security/2012/08/28/9
CVE: CVE-2012-4002
Published: 2012-10-09
Description: Cross-site request forgery (CSRF) vulnerability in GLPI-PROJECT GLPI before 0.83.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.mandriva.com/security/advisories?name=MDVSA-2012:132; http://www.openwall.com/lists/oss-security/2012/07/13/1; https://forge.indepnet.net/issues/3704
CVE: CVE-2012-4003
Published: 2012-10-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in GLPI-PROJECT GLPI before 0.83.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mandriva.com/security/advisories?name=MDVSA-2012:132; http://www.openwall.com/lists/oss-security/2012/07/13/1; https://forge.indepnet.net/issues/3705
CVE: CVE-2012-4399
Published: 2012-10-09
Description: The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1; http://seclists.org/bugtraq/2012/Jul/101; http://secunia.com/advisories/49900
CVE: CVE-2012-4418
Published: 2012-10-09
Description: Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf; http://www.openwall.com/lists/oss-security/2012/09/12/1; http://www.openwall.com/lists/oss-security/2012/09/13/1
CVE: CVE-2012-4452
Published: 2012-10-09
Description: MySQL 5.0.88, and possibly other versions and platforms, allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value.  NOTE: this vulnerability exists because of a CVE-2009-4030 regression, which was not omitted in other packages and versions such as MySQL 5.0.95 in Red Hat Enterprise Linux 6.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0121.html; http://www.openwall.com/lists/oss-security/2012/09/27/1; http://www.securityfocus.com/bid/55715
CVE: CVE-2012-4453
Published: 2012-10-09
Description: dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information.
CVSS Score: 2.1 (LOW)
CWE: CWE-276
References: http://git.kernel.org/?p=boot/dracut/dracut.git%3Ba=commit%3Bh=e1b48995c26c4f06d1a71; http://rhn.redhat.com/errata/RHSA-2013-1674.html; http://www.openwall.com/lists/oss-security/2012/09/27/3
CVE: CVE-2012-5351
Published: 2012-10-09
Description: Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79487; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2012-5352
Published: 2012-10-09
Description: Java Open Single Sign-On Project Home (JOSSO) allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf; http://www.securityfocus.com/bid/55892; https://bugzilla.redhat.com/show_bug.cgi?id=865169
CVE: CVE-2012-5353
Published: 2012-10-09
Description: Eduserv OpenAthens SP 2.0 for Java allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://status.openathens.net/adv.php; http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf; http://status.openathens.net/adv.php
CVE: CVE-2012-3982
Published: 2012-10-10
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://rhn.redhat.com/errata/RHSA-2012-1351.html; http://secunia.com/advisories/50856
CVE: CVE-2012-3983
Published: 2012-10-10
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://secunia.com/advisories/50856; http://secunia.com/advisories/50892
CVE: CVE-2012-3984
Published: 2012-10-10
Description: Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly handle navigation away from a web page that has a SELECT element's menu active, which allows remote attackers to spoof page content via vectors involving absolute positioning and scrolling.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://secunia.com/advisories/50856; http://secunia.com/advisories/50892
CVE: CVE-2012-3985
Published: 2012-10-10
Description: Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly implement the HTML5 Same Origin Policy, which allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging initial-origin access after document.domain has been set.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86106; http://secunia.com/advisories/50856
CVE: CVE-2012-3986
Published: 2012-10-10
Description: Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict calls to DOMWindowUtils (aka nsDOMWindowUtils) methods, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://rhn.redhat.com/errata/RHSA-2012-1351.html; http://secunia.com/advisories/50856
CVE: CVE-2012-3987
Published: 2012-10-10
Description: Mozilla Firefox before 16.0 on Android assigns chrome privileges to Reader Mode pages, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86107; http://secunia.com/advisories/50856
CVE: CVE-2012-3988
Published: 2012-10-10
Description: Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 might allow user-assisted remote attackers to execute arbitrary code via vectors involving use of mozRequestFullScreen to enter full-screen mode, and use of the history.back method for backwards history navigation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86109; http://rhn.redhat.com/errata/RHSA-2012-1351.html
CVE: CVE-2012-3989
Published: 2012-10-10
Description: Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly perform a cast of an unspecified variable during use of the instanceof operator on a JavaScript object, which allows remote attackers to execute arbitrary code or cause a denial of service (assertion failure) via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86097; http://secunia.com/advisories/50856
CVE: CVE-2012-3990
Published: 2012-10-10
Description: Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors, related to the nsIContent::GetNameSpaceID function.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://rhn.redhat.com/errata/RHSA-2012-1351.html; http://secunia.com/advisories/50856
CVE: CVE-2012-3991
Published: 2012-10-10
Description: Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the GetProperty function, which allows remote attackers to bypass the Same Origin Policy and possibly have unspecified other impact via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86098; http://rhn.redhat.com/errata/RHSA-2012-1351.html
CVE: CVE-2012-3992
Published: 2012-10-10
Description: Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly manage history data, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive POST content via vectors involving a location.hash write operation and history navigation that triggers the loading of a URL into the history object.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://rhn.redhat.com/errata/RHSA-2012-1351.html; http://secunia.com/advisories/50856
CVE: CVE-2012-3993
Published: 2012-10-10
Description: The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not properly interact with failures of InstallTrigger methods, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site, related to an "XrayWrapper pollution" issue.
CVSS Score: 9.3 (HIGH)
CWE: CWE-269
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86111; http://rhn.redhat.com/errata/RHSA-2012-1351.html