deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-4561
Published: 2011-11-28
Description: Cross-site scripting (XSS) vulnerability in admin.php in Phorum 5.2.18 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/76026; http://secunia.com/advisories/46282; http://www.rul3z.de/advisories/SSCHADV2011-023.txt
CVE: CVE-2011-4562
Published: 2011-11-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header in a request to a post that does not exist.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dotxed.net/2011/websicherheit/lazy-xss-wenn-statistiken-und-loggs-zur-gefahr-werden.html; http://osvdb.org/76092; http://packetstormsecurity.org/files/view/105573/wpredirection229-xss.txt
CVE: CVE-2011-4563
Published: 2011-11-28
Description: Cross-site scripting (XSS) vulnerability in index.php in JAKCMS 2.0.4.1, and possibly other versions before 2.2.6 2011-09-23, allows remote attackers to inject arbitrary web script or HTML via the userpost parameter in a PM request, related to tinymce.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/46378; http://www.jakcms.com/tracker/t/62/cross-site-scripting-flaw; http://www.securityfocus.com/bid/50034
CVE: CVE-2011-4564
Published: 2011-11-28
Description: Cross-site scripting (XSS) vulnerability in the admin script in Active CMS 1.2 allows remote attackers to inject arbitrary web script or HTML via the mod parameter in a module action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.rul3z.de/advisories/SSCHADV2011-020.txt; http://www.securityfocus.com/archive/1/520029/100/0/threaded; http://www.securityfocus.com/bid/50001
CVE: CVE-2011-4565
Published: 2011-11-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.5.1.a, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to include/formdhtmltextarea_preview.php or (2) img BBCODE tag within the message parameter to pmlite.php (aka Private Message).  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/46238; http://www.securityfocus.com/bid/49995; http://xoops.org/modules/news/article.php?storyid=6094
CVE: CVE-2011-4541
Published: 2011-11-29
Description: Cross-site scripting (XSS) vulnerability in index.php in Hastymail2 2.1.1 before RC2 allows remote attackers to inject arbitrary web script or HTML via the rs parameter in a mailbox Drafts action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48308; https://exchange.xforce.ibmcloud.com/vulnerabilities/71520; https://www.dognaedis.com/vulns/DGS-SEC-2.html
CVE: CVE-2011-4547
Published: 2011-11-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in includes/templates/template_default/common/tpl_header_test_info.php in Zen Cart 1.3.9h, when debugging is enabled, might allow remote attackers to inject arbitrary web script or HTML via the (1) main_page parameter or (2) PATH_INFO, a different vulnerability than CVE-2011-4567.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/50787; https://exchange.xforce.ibmcloud.com/vulnerabilities/71519; https://www.dognaedis.com/vulns/DGS-SEC-9.html
CVE: CVE-2011-4566
Published: 2011-11-29
Description: Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html; http://rhn.redhat.com/errata/RHSA-2012-0071.html
CVE: CVE-2011-4567
Published: 2011-11-29
Description: Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gv_send action to index.php, a different vulnerability than CVE-2011-4547.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/50787; https://exchange.xforce.ibmcloud.com/vulnerabilities/71519; https://www.dognaedis.com/vulns/DGS-SEC-8.html
CVE: CVE-2011-4568
Published: 2011-11-29
Description: Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://plugins.trac.wordpress.org/changeset?reponame=&new=413607%40fv-wordpress-flowplayer&old=409594%40fv-wordpress-flowplayer; http://secunia.com/advisories/46346; http://wordpress.org/extend/plugins/fv-wordpress-flowplayer/changelog/
CVE: CVE-2011-4569
Published: 2011-11-29
Description: SQL injection vulnerability in userbarsettings.php in the Userbar plugin 2.2 for MyBB Forum allows remote attackers to execute arbitrary SQL commands via the image2 parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/17962; http://www.securityfocus.com/bid/50049; https://exchange.xforce.ibmcloud.com/vulnerabilities/70474
CVE: CVE-2011-4570
Published: 2011-11-29
Description: SQL injection vulnerability in the Time Returns (com_timereturns) component 2.0 and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a timereturns action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/76268; http://secunia.com/advisories/46267; http://www.exploit-db.com/exploits/17944
CVE: CVE-2011-4571
Published: 2011-11-29
Description: SQL injection vulnerability in the Estate Agent (com_estateagent) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showEO action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/105618/joomlaestateagent-sql.txt; http://www.securityfocus.com/bid/50024; https://exchange.xforce.ibmcloud.com/vulnerabilities/70444
CVE: CVE-2011-4572
Published: 2011-11-29
Description: Cross-site scripting (XSS) vulnerability in inc/tesmodrewite.php in CF Image Hosting Script 1.3.82, 1.4.1, and probably other versions before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter.  NOTE: this was originally reported as a file disclosure vulnerability, but this is likely inaccurate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/76059; http://packetstormsecurity.org/files/view/105524/cfimagehosting1382-disclose.txt; http://secunia.com/advisories/46290
CVE: CVE-2011-3150
Published: 2011-11-29
Description: Software Center in Ubuntu 11.10, 11.04 10.10 does not properly validate server certificates, which allows remote attackers to execute arbitrary code or obtain sensitive information via a man-in-the-middle (MITM) attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/46950; http://www.securityfocus.com/bid/50754; http://www.ubuntu.com/usn/USN-1270-1
CVE: CVE-2011-3365
Published: 2011-11-29
Description: The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.kde.org/info/security/advisory-20111003-1.txt; http://www.mandriva.com/security/advisories?name=MDVSA-2011:162; http://www.redhat.com/support/errata/RHSA-2011-1364.html
CVE: CVE-2011-3366
Published: 2011-11-29
Description: Rekonq 0.7.0 and earlier does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.kde.org/info/security/advisory-20111003-1.txt; http://www.securityfocus.com/archive/1/520041; https://bugzilla.redhat.com/show_bug.cgi?id=743194
CVE: CVE-2011-3367
Published: 2011-11-29
Description: Arora, possibly 0.11 and other versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/520041; http://www.securityfocus.com/archive/1/520041
CVE: CVE-2011-4313
Published: 2011-11-29
Description: query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver.
CVSS Score: 5.0 (MEDIUM)
References: http://blogs.oracle.com/sunsecurity/entry/cve_2011_4313_denial_of; http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069463.html
CVE: CVE-2011-4405
Published: 2011-11-29
Description: The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to execute arbitrary code via a man-in-the-middle (MITM) attack that modifies packages or repositories.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/77214; http://secunia.com/advisories/46909; http://www.securityfocus.com/bid/50721
CVE: CVE-2009-5028
Published: 2011-11-30
Description: Stack-based buffer overflow in Namazu before 2.0.20 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted request containing an empty uri field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://cvs.namazu.org/namazu/src/result.c?sortdir=down&r1=1.59.8.28&r2=1.59.8.29&sortby=log; http://cvs.namazu.org/namazu/src/result.c?sortdir=down&r1=1.77.2.8&r2=1.77.2.9&sortby=log; http://cvs.namazu.org/namazu/src/result.c?sortdir=down&r1=1.86&r2=1.87&sortby=log
CVE: CVE-2011-3173
Published: 2011-11-30
Description: Stack-based buffer overflow in the GetDriverSettings function in nipplib.dll in the iPrint client in Novell Open Enterprise Server 2 (aka OES2) SP3 allows remote attackers to execute arbitrary code via a long (1) hostname or (2) port field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5117030.html; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5117031.html; http://www.novell.com/support/viewContent.do?externalId=7009676
CVE: CVE-2011-3639
Published: 2011-11-30
Description: The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2012-0128.html; http://svn.apache.org/viewvc?view=revision&revision=1188745; http://www.debian.org/security/2012/dsa-2405
CVE: CVE-2011-4002
Published: 2011-11-30
Description: HP no Mawashimono Nikki 6.6 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN48839888/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000076; http://jvn.jp/en/jp/JVN48839888/index.html
CVE: CVE-2011-4191
Published: 2011-11-30
Description: Stack-based buffer overflow in the xdrDecodeString function in XNFS.NLM in Novell NetWare 6.5 SP8 allows remote attackers to execute arbitrary code or cause a denial of service (abend or NFS outage) via long packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=Cfw1tDezgbw~; https://bugzilla.novell.com/show_bug.cgi?id=671020; https://bugzilla.novell.com/show_bug.cgi?id=702491
CVE: CVE-2011-4317
Published: 2011-11-30
Description: The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041; http://kb.juniper.net/JSA10585; http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
CVE: CVE-2011-4345
Published: 2011-11-30
Description: Cross-site scripting (XSS) vulnerability in Namazu before 2.0.21, when Internet Explorer 6 or 7 is used, allows remote attackers to inject arbitrary web script or HTML via a cookie.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/46925; http://www.namazu.org/security.html#cross-site-scripting; http://www.securityfocus.com/bid/50771
CVE: CVE-2011-4542
Published: 2011-11-30
Description: Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Drafts action to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/48308; https://www.dognaedis.com/vulns/DGS-SEC-3.html; http://secunia.com/advisories/48308
CVE: CVE-2011-4646
Published: 2011-11-30
Description: SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote authenticated users with the Author role to execute arbitrary SQL commands via the id attribute of the ratings shortcode when creating a post.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://plugins.trac.wordpress.org/changeset/430970/wp-postratings/trunk/wp-postratings.php?old=355076&old_path=wp-postratings%2Ftrunk%2Fwp-postratings.php; http://secunia.com/advisories/46328; http://wordpress.org/extend/plugins/wp-postratings/changelog/
CVE: CVE-2011-4647
Published: 2011-11-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in the story creation feature in Geeklog 1.8.0 allow remote attackers to inject arbitrary web script or HTML via the (1) code or (2) raw BBcode tags.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/76297; http://project.geeklog.net/cgi-bin/hgwebdir.cgi/geeklog/rev/fd3ca3aebf86; http://project.geeklog.net/tracking/view.php?id=1368
CVE: CVE-2011-2461
Published: 2011-12-01
Description: Cross-site scripting (XSS) vulnerability in the Adobe Flex SDK 3.x and 4.x before 4.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to the loading of modules from different domains.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.mindedsecurity.com/2015/03/the-old-is-new-again-cve-2011-2461-is.html; http://blog.nibblesec.org/2015/03/the-old-is-new-again-cve-2011-2461-is.html; http://kb2.adobe.com/cps/915/cpsid_91544.html
CVE: CVE-2011-4001
Published: 2011-12-01
Description: Directory traversal vulnerability in HP no Mawashimono Nikki 6.6 and earlier allows remote attackers to read and modify arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN80081509/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000075; http://jvn.jp/en/jp/JVN80081509/index.html
CVE: CVE-2011-4344
Published: 2011-12-01
Description: Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://groups.google.com/group/jenkinsci-advisories/msg/1b94588f90f876b5?dmode=source&output=gplain; http://openwall.com/lists/oss-security/2011/11/23/5; http://openwall.com/lists/oss-security/2011/11/23/6
CVE: CVE-2011-4161
Published: 2011-12-01
Description: The default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx, 4xxx, 5550, 9500, CMxxxx, CPxxxx, and Enterprise CPxxxx; Digital Sender 9200c and 9250c; LaserJet 4xxx, 5200, 90xx, Mxxxx, and Pxxxx; and LaserJet Enterprise 500 color M551, 600, M4555 MFP, and P3015 enables the Remote Firmware Update (RFU) setting, which allows remote attackers to execute arbitrary code by using a session on TCP port 9100 to upload a crafted firmware update.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03102449; http://isc.sans.org/diary/Hacking+HP+Printers+for+Fun+and+Profit/12112; http://redtape.msnbc.msn.com/_news/2011/11/29/9076395-exclusive-millions-of-printers-open-to-devastating-hack-attack-researchers-say
CVE: CVE-2011-4540
Published: 2011-12-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in AtMail Open (aka AtMail Open-Source edition) 1.04 allow remote attackers to inject arbitrary web script or HTML via the func parameter to (1) ldap.php or (2) search.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/77330; http://secunia.com/advisories/47012; http://secunia.com/advisories/48308
CVE: CVE-2011-4544
Published: 2011-12-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in Prestashop before 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) address or (2) relativ_base_dir parameter to modules/mondialrelay/googlemap.php; the (3) relativ_base_dir, (4) Pays, (5) Ville, (6) CP, (7) Poids, (8) Action, or (9) num parameter to prestashop/modules/mondialrelay/googlemap.php; (10) the num_mode parameter to modules/mondialrelay/kit_mondialrelay/RechercheDetailPointRelais_ajax.php; (11) the Expedition parameter to modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php; or the (12) folder or (13) name parameter to admin/ajaxfilemanager/ajax_save_text.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/50784; https://www.dognaedis.com/vulns/DGS-SEC-5.html; https://www.dognaedis.com/vulns/DGS-SEC-6.html
CVE: CVE-2011-4033
Published: 2011-12-02
Description: Buffer overflow in the Steema TeeChart ActiveX control, as used in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier, allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.citect.com/index.php?option=com_content&view=article&id=1656&Itemid=1695; http://www.scada.schneider-electric.com/sites/scada/en/login/historian-vulnerability.page; http://www.us-cert.gov/control_systems/pdf/ICSA-11-307-01.pdf
CVE: CVE-2011-4034
Published: 2011-12-02
Description: Buffer overflow in the Steema TeeChart ActiveX control, as used in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.citect.com/index.php?option=com_content&view=article&id=1656&Itemid=1695; http://www.scada.schneider-electric.com/sites/scada/en/login/historian-vulnerability.page; http://www.us-cert.gov/control_systems/pdf/ICSA-11-307-01.pdf
CVE: CVE-2011-4035
Published: 2011-12-02
Description: Cross-site scripting (XSS) vulnerability in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.citect.com/index.php?option=com_content&view=article&id=1656&Itemid=1695; http://www.scada.schneider-electric.com/sites/scada/en/login/historian-vulnerability.page; http://www.us-cert.gov/control_systems/pdf/ICSA-11-307-01.pdf
CVE: CVE-2011-4036
Published: 2011-12-02
Description: Directory traversal vulnerability in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.citect.com/index.php?option=com_content&view=article&id=1656&Itemid=1695; http://www.scada.schneider-electric.com/sites/scada/en/login/historian-vulnerability.page; http://www.us-cert.gov/control_systems/pdf/ICSA-11-307-01.pdf
CVE: CVE-2011-4545
Published: 2011-12-02
Description: CRLF injection vulnerability in admin/displayImage.php in Prestashop 1.4.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the name parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/50785; https://www.dognaedis.com/vulns/DGS-SEC-7.html; http://www.securityfocus.com/bid/50785
CVE: CVE-2011-4668
Published: 2011-12-02
Description: IBM Tivoli Netcool/Reporter 2.2 before 2.2.0.8 allows remote attackers to execute arbitrary code via vectors related to an unspecified CGI program used with the Apache HTTP Server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/77402; http://secunia.com/advisories/46999; http://www-01.ibm.com/support/docview.wss?uid=swg24031456
CVE: CVE-2011-4669
Published: 2011-12-02
Description: SQL injection vulnerability in wp-users.php in WordPress Users plugin 1.3 and possibly earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the uid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://plugins.trac.wordpress.org/changeset/448261/wordpress-users; http://secunia.com/advisories/46442; http://wordpress.org/extend/plugins/wordpress-users/