deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2865
Published: 2012-08-31
Description: Google Chrome before 21.0.1180.89 does not properly perform line breaking, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=121347; http://googlechromereleases.blogspot.com/2012/08/stable-channel-update_30.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00030.html
CVE: CVE-2012-2866
Published: 2012-08-31
Description: Google Chrome before 21.0.1180.89 does not properly perform a cast of an unspecified variable during handling of run-in elements, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=134897; http://googlechromereleases.blogspot.com/2012/08/stable-channel-update_30.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00030.html
CVE: CVE-2012-2867
Published: 2012-08-31
Description: The SPDY implementation in Google Chrome before 21.0.1180.89 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=135485; http://googlechromereleases.blogspot.com/2012/08/stable-channel-update_30.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00030.html
CVE: CVE-2012-2868
Published: 2012-08-31
Description: Race condition in Google Chrome before 21.0.1180.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving improper interaction between worker processes and an XMLHttpRequest (aka XHR) object.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://code.google.com/p/chromium/issues/detail?id=136881; http://googlechromereleases.blogspot.com/2012/08/stable-channel-update_30.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00030.html
CVE: CVE-2012-2869
Published: 2012-08-31
Description: Google Chrome before 21.0.1180.89 does not properly load URLs, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a "stale buffer."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=137778; http://googlechromereleases.blogspot.com/2012/08/stable-channel-update_30.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00030.html
CVE: CVE-2012-2870
Published: 2012-08-31
Description: libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified during XPath navigation, related to (1) the xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the xsltGenerateIdFunction function in libxslt/functions.c.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=138672; http://code.google.com/p/chromium/issues/detail?id=140368; http://googlechromereleases.blogspot.com/2012/08/stable-channel-update_30.html
CVE: CVE-2012-2871
Published: 2012-08-31
Description: libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h.
CVSS Score: 6.8 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=138673; http://googlechromereleases.blogspot.com/2012/08/stable-channel-update_30.html; http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html
CVE: CVE-2012-2872
Published: 2012-08-31
Description: Cross-site scripting (XSS) vulnerability in an SSL interstitial page in Google Chrome before 21.0.1180.89 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://code.google.com/p/chromium/issues/detail?id=142956; http://googlechromereleases.blogspot.com/2012/08/stable-channel-update_30.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00030.html
CVE: CVE-2012-4171
Published: 2012-08-31
Description: Adobe Flash Player before 10.3.183.23 and 11.x before 11.4.402.265 on Windows and Mac OS X, before 10.3.183.23 and 11.x before 11.2.202.238 on Linux, before 11.1.111.16 on Android 2.x and 3.x, and before 11.1.115.17 on Android 4.x; Adobe AIR before 3.4.0.2540; and Adobe AIR SDK before 3.4.0.2540 allow attackers to cause a denial of service (application crash) by leveraging a logic error during handling of Firefox dialogs.
CVSS Score: 5.0 (MEDIUM)
References: http://www.adobe.com/support/security/bulletins/apsb12-19.html; http://www.securityfocus.com/bid/55365; https://exchange.xforce.ibmcloud.com/vulnerabilities/78226
CVE: CVE-2012-2704
Published: 2012-08-31
Description: The Advertisement module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access to debug information, which allows remote attackers to obtain sensitive site configuration information that is specified by the $conf variable in settings.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1585544; http://drupalcode.org/project/ad.git/commitdiff/c2ffab2; http://www.openwall.com/lists/oss-security/2012/06/14/3
CVE: CVE-2012-3533
Published: 2012-08-31
Description: The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which allows remote attackers to spoof a server via a man-in-the-middle (MITM) attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://gerrit.ovirt.org/#/c/7209/; http://gerrit.ovirt.org/#/c/7249/; http://secunia.com/advisories/50409
CVE: CVE-2012-3534
Published: 2012-08-31
Description: GNU Gatekeeper before 3.1 does not limit the number of connections to the status port, which allows remote attackers to cause a denial of service (connection and thread consumption) via a large number of connections.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-07/msg00070.html; http://secunia.com/advisories/50343; http://www.gnugk.org/gnugk-3.1.html
CVE: CVE-2012-4739
Published: 2012-08-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Barracuda SSL VPN before 2.2.2.203 (2012-07-05) allow remote attackers to inject arbitrary web script or HTML via the (1) policyLaunching, (2) resourcePrefix, or (3) actionPath parameter in showUserResourceCategories.do; (4) list or (5) path parameter to fileSystem.do; or (6) return-To parameter to launchAgent.do.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-08/0003.html; http://www.securityfocus.com/bid/54761; http://www.securitytracker.com/id?1027279
CVE: CVE-2010-5193
Published: 2012-08-31
Description: Stack-based buffer overflow in the TIFMergeMultiFiles function in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx) in Viscom Image Viewer CP Pro 8.0 and Gold 6.0 allows remote attackers to execute arbitrary code via a long strDelimit parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/42445; http://www.exploit-db.com/exploits/15668; http://www.exploit-db.com/exploits/18123
CVE: CVE-2010-5194
Published: 2012-08-31
Description: Stack-based buffer overflow in the Image2PDF function in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx) in Viscom Image Viewer CP Pro 8.0, Gold 5.5, Gold 6.0, and earlier allows remote attackers to execute arbitrary code via a long strPDFFile parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/42445; http://www.exploit-db.com/exploits/15658; http://www.osvdb.org/69566
CVE: CVE-2011-5137
Published: 2012-08-31
Description: Multiple SQL injection vulnerabilities in tForum b0.915 allow remote attackers to execute arbitrary SQL commands via the (1) TopicID parameter to viewtopic.php, the (2) BoardID parameter to viewboard.php, or (3) CatID parameter to viewcat.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/108184/tforum-sqlxss.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/71975; http://packetstormsecurity.org/files/view/108184/tforum-sqlxss.txt
CVE: CVE-2011-5138
Published: 2012-08-31
Description: Cross-site scripting (XSS) vulnerability in member.php in tForum b0.915 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a viewprofile action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/108184/tforum-sqlxss.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/71973; http://packetstormsecurity.org/files/view/108184/tforum-sqlxss.txt
CVE: CVE-2011-5139
Published: 2012-08-31
Description: SQL injection vulnerability in page.php in Pre Studio Business Cards Designer allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/108148/prestudiobusinesscard-sql.txt; http://secunia.com/advisories/46545; http://www.exploit-db.com/exploits/18009
CVE: CVE-2011-5140
Published: 2012-08-31
Description: Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to (a) tags.php, (b) list.php, (c) index.php, (d) main_index.php, (e) viewpost.php, (f) archive.php, (g) control/approve_comments.php, (h) control/approve_posts.php, and (i) control/viewcat.php; and the (2) month and (3) year parameters to archive.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/47337; http://www.exploit-db.com/exploits/18288; http://www.osvdb.org/78071
CVE: CVE-2011-5141
Published: 2012-08-31
Description: Directory traversal vulnerability in exportcsv/exportcsv_index.php in Open Business Management (OBM) 2.4.0-rc13 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the module parameter in an export_page action.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/78003; https://exchange.xforce.ibmcloud.com/vulnerabilities/71921; https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_obm.html
CVE: CVE-2011-5142
Published: 2012-08-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tf_delegation, (2) tf_ip, or (3) tf_name parameter in a search action to host/host_index.php; (4) login parameter to obm.php; or (5) tf_user parameter in a search action to group/group_index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/78007; http://osvdb.org/78008; http://secunia.com/advisories/47139
CVE: CVE-2011-5143
Published: 2012-08-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tf_name, (2) tf_delegation, and (3) tf_ip parameters to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/47139; http://secunia.com/advisories/47139
CVE: CVE-2011-5144
Published: 2012-08-31
Description: Open Business Management (OBM) 2.4.0-rc13 and earlier allows remote attackers to obtain configuration information via a direct request to test.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/78009; http://secunia.com/advisories/47139; https://exchange.xforce.ibmcloud.com/vulnerabilities/71924
CVE: CVE-2011-5145
Published: 2012-08-31
Description: Multiple SQL injection vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sel_domain_id or (2) action parameter to obm.php; (3) tf_user parameter in a search action to group/group_index.php; (4) tf_delegation, (5) tf_ip, (6) tf_name to host/host_index.php; or (7) lang, (8) theme, (9) cal_alert, (10) cal_first_hour, (11) cal_interval, (12) cal_last_hour, (13) commentorder, (14) csv_sep, (15) date, (16) date_upd, (17) debug_exe, (18) debug_id, (19) debug_param, (20) debug_sess, (21) debug_solr, (22) debug_sql, (23) dsrc, (24) menu, (25) rows, (26) sel_display_days, (27) timeformat, (28) timezone, or (29) todo parameter to settings/settings_index.php.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/78004; http://osvdb.org/78005; http://osvdb.org/78006
CVE: CVE-2011-5146
Published: 2012-08-31
Description: Bokken before 1.6 and 1.5-x before 1.5-3 for Debian allows local users to overwrite arbitrary files via a symlink attack on /tmp/graph.dot.
CVSS Score: 2.6 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=651931; http://inguma.eu/projects/bokken/repository/revisions/56894084b0ec; http://ingumadev.blogspot.com/2012/01/bokken-16-is-more-stable-and-easier-to.html
CVE: CVE-2011-5147
Published: 2012-08-31
Description: Static code injection vulnerability in ajax_save_name.php in the Ajax File Manager module in the tinymce plugin in FreeWebshop 2.2.9 R2 and earlier allows remote attackers to inject arbitrary PHP code into data.php via the selected document, as demonstrated by a call to ajax_file_cut.php and then to ajax_save_name.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/18121; http://www.freewebshop.org/forum/index.php?topic=5235.0; http://www.osvdb.org/77162
CVE: CVE-2011-5148
Published: 2012-08-31
Description: Multiple incomplete blacklist vulnerabilities in the Simple File Upload (mod_simplefileuploadv1.3) module before 1.3.5 for Joomla! allow remote attackers to execute arbitrary code by uploading a file with a (1) php5, (2) php6, or (3) double (e.g. .php.jpg) extension, then accessing it via a direct request to the file in images/, as exploited in the wild in January 2012.
CVSS Score: 6.8 (MEDIUM)
References: http://docs.joomla.org/Vulnerable_Extensions_List#Simple_File_Upload_1.3; http://secunia.com/advisories/47370; http://wasen.net/index.php?option=com_content&view=article&id=87&Itemid=59
CVE: CVE-2011-5149
Published: 2012-08-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in SpamTitan 5.08 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) testaddr or (2) testpass parameter to auth-settings.php; (3) hostname, (4) domainname, or (5) mailserver parameter to setup-relay.php; or (6) subnetmask or (7) defaultroute parameter to setup-network.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/77987; http://osvdb.org/77988; http://osvdb.org/77989
CVE: CVE-2011-5150
Published: 2012-08-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in SpamTitan 5.07 and possibly earlier allow remote attackers or authenticated users to inject arbitrary web script or HTML via the (1) ipaddress or (2) domain parameter to setup-network.php, different vectors than CVE-2011-5149.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/47309; http://www.osvdb.org/77989; http://secunia.com/advisories/47309
CVE: CVE-2011-4946
Published: 2012-08-31
Description: SQL injection vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to execute arbitrary SQL commands via the user_field parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://e107.org/svn_changelog.php?version=0.7.26; http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/users_extended.php?r1=12225&r2=12306; http://secunia.com/advisories/44968
CVE: CVE-2011-4947
Published: 2012-08-31
Description: Cross-site request forgery (CSRF) vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the user_include parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://e107.org/svn_changelog.php?version=0.7.26; http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/users_extended.php?r1=12225&r2=12306; http://www.openwall.com/lists/oss-security/2012/03/28/4
CVE: CVE-2011-4948
Published: 2012-08-31
Description: Directory traversal vulnerability in admin/remote.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8[PII_REDACTED]5 allows remote attackers to read arbitrary files via a ..%2f (encoded dot dot slash) in the type parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://comments.gmane.org/gmane.comp.web.egroupware.german/33144; http://packetstormsecurity.org/files/101676/eGroupware-1.8[PII_REDACTED]1-Local-File-Inclusion.html; http://www.autosectools.com/Advisory/eGroupware-1.8[PII_REDACTED]1-Local-File-Inclusion-224
CVE: CVE-2011-4949
Published: 2012-08-31
Description: SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/with_db/loaddetails.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8[PII_REDACTED]5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://comments.gmane.org/gmane.comp.web.egroupware.german/33144; http://packetstormsecurity.org/files/100179/eGroupware-1.8.001-SQL-Injection.html; http://www.autosectools.com/Advisory/eGroupware-1.8.001-SQL-Injection-179
CVE: CVE-2011-4950
Published: 2012-08-31
Description: Cross-site scripting (XSS) vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8[PII_REDACTED]5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://comments.gmane.org/gmane.comp.web.egroupware.german/33144; http://packetstormsecurity.org/files/100180/eGroupware-1.8.001-Cross-Site-Scripting.html; http://www.autosectools.com/Advisory/eGroupware-1.8.001-Reflected-Cross-site-Scripting-178
CVE: CVE-2011-4951
Published: 2012-08-31
Description: Open redirect vulnerability in phpgwapi/ntlm/index.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8[PII_REDACTED]5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://comments.gmane.org/gmane.comp.web.egroupware.german/33144; http://packetstormsecurity.org/files/101675/eGroupware-1.8[PII_REDACTED]1-Open-Redirect.html; http://www.autosectools.com/Advisory/eGroupware-1.8.001-Reflected-Cross-site-Scripting-178
CVE: CVE-2012-2083
Published: 2012-08-31
Description: Cross-site scripting (XSS) vulnerability in the fusion_core_preprocess_page function in fusion_core/template.php in the Fusion module before 6.x-1.13 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1506600; http://drupal.org/node/1507510; http://drupalcode.org/project/fusion.git/commit/f7cee3d
CVE: CVE-2012-2114
Published: 2012-08-31
Description: Stack-based buffer overflow in fprintf in musl before 0.8.8 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string to an unbuffered stream such as stderr.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.etalabs.net/musl/download.html; http://www.openwall.com/lists/musl/2012/04/17/1; http://www.openwall.com/lists/oss-security/2012/04/18/5
CVE: CVE-2012-2116
Published: 2012-08-31
Description: Cross-site request forgery (CSRF) vulnerability in the Commerce Reorder module before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that add items to the shopping cart.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1538198; http://drupalcode.org/project/commerce_reorder.git/commit/bf060ab; http://secunia.com/advisories/48912
CVE: CVE-2012-2117
Published: 2012-08-31
Description: Cross-site scripting (XSS) vulnerability in the Gigya - Social optimization module 6.x before 6.x-3.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1515084; http://drupal.org/node/1538704; http://secunia.com/advisories/48832
CVE: CVE-2012-4740
Published: 2012-08-31
Description: Cross-site scripting (XSS) vulnerability in the captive portal in PacketFence before 3.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48833; http://sourceforge.net/mailarchive/message.php?msg_id=29126135; http://www.securityfocus.com/bid/53027
CVE: CVE-2012-4741
Published: 2012-08-31
Description: The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication for users with custom VLAN assignment extensions, which allows remote attackers to spoof user identities via the User-Name RADIUS attribute.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://sourceforge.net/mailarchive/message.php?msg_id=29126135; http://www.packetfence.org/bugs/view.php?id=1390; https://exchange.xforce.ibmcloud.com/vulnerabilities/78868
CVE: CVE-2012-4742
Published: 2012-08-31
Description: The web_node_register function in web.pm in PacketFence before 3.0.2 might allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.packetfence.org/bugs/changelog_page.php; http://www.packetfence.org/bugs/view.php?id=763; http://www.packetfence.org/bugs/changelog_page.php
CVE: CVE-2012-4743
Published: 2012-08-31
Description: Multiple SQL injection vulnerabilities in ssearch.php in Siche search module 0.5 for Zeroboard allow remote attackers to execute arbitrary SQL commands via the (1) ss, (2) sm, (3) align, or (4) category parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0099.html; http://osvdb.org/81178; http://www.securityfocus.com/bid/53035
CVE: CVE-2012-4744
Published: 2012-08-31
Description: Cross-site scripting (XSS) vulnerability in ssearch.php in the Siche search module 0.5 for Zeroboard allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0099.html; http://www.osvdb.org/81179; http://www.securityfocus.com/bid/53035
CVE: CVE-2012-4745
Published: 2012-08-31
Description: Cross-site scripting (XSS) vulnerability in admin/login.asp in Acuity CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0125.html; http://www.securityfocus.com/bid/53048; http://yehg.net/lab/pr0js/advisories/%5Bacuity_cms2.6.x_%28asp%29%5D_xss