deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5900
Published: 2012-11-17
Description: Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL commands via the (1) OB_ID parameter in a single action to admin/action/objects.php, (2) AREA_ID parameter in a single action to admin/action/areas.php, or (3) start parameter in a show action to admin/action/pdf.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/80796; http://osvdb.org/80797; http://osvdb.org/80798
CVE: CVE-2012-5901
Published: 2012-11-17
Description: DFLabs PTK 1.0.5 stores data files with predictable names under the web document root with insufficient access control, which allows remote attackers to read logs, images, or reports via a direct request to the file in the (1) log, (2) images, or (3) report directory.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80773; http://packetstormsecurity.org/files/111360/PTK-1.0.5-Cross-Site-Scripting-Unrestricted-Access.html; http://secunia.com/advisories/48585
CVE: CVE-2012-5902
Published: 2012-11-17
Description: Cross-site scripting (XSS) vulnerability in ptk/lib/modal_bookmark.php in DFLabs PTK 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the arg4 parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/80774; http://packetstormsecurity.org/files/111360/PTK-1.0.5-Cross-Site-Scripting-Unrestricted-Access.html; http://www.securityfocus.com/bid/52817
CVE: CVE-2012-5903
Published: 2012-11-17
Description: Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the scheduled parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/80766; http://packetstormsecurity.org/files/111356/SMF-2.0.2-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/52822
CVE: CVE-2012-5904
Published: 2012-11-17
Description: Heap-based buffer overflow in IrfanView before 4.33 allows remote attackers to execute arbitrary code via a crafted RLE compressed bitmap file such as a DIB, RLE, or BMP image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/80716; http://secunia.com/advisories/47333; http://www.irfanview.com/history_old.htm
CVE: CVE-2012-5905
Published: 2012-11-17
Description: Buffer overflow in KnFTPd 1.0.0 allows remote authenticated users to cause a denial of service (crash) via a long string in a FEAT command.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/80666; http://packetstormsecurity.org/files/111296/KnFTPd-1.0.0-Denial-Of-Service.html; http://www.exploit-db.com/exploits/18671
CVE: CVE-2012-5906
Published: 2012-11-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in GreenBrowser 6.1.0117 and 6.1.0216 allow remote attackers to inject arbitrary web script or HTML via (1) the URI in an about: page or (2) the last visited URL in the LastVisitWriteEn function in function.js.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lostmon.blogspot.com/2012/03/greenbrowser-about-dialog-xss-and.html; http://osvdb.org/80636; http://packetstormsecurity.org/files/111252/GreenBrowser-6.1.x-Cross-Site-Scripting.html
CVE: CVE-2012-5907
Published: 2012-11-17
Description: Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter in a "3" action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/80689; http://packetstormsecurity.org/files/111291/TomatoCart-1.2.0-Alpha-2-Local-File-Inclusion.html; http://www.mavitunasecurity.com/local-file-inclusion-vulnerability-in-tomatocart/
CVE: CVE-2012-5908
Published: 2012-11-17
Description: Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to inject arbitrary web script or HTML via the conditions[usergroup][] parameter in a search action to admin/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/80633; http://packetstormsecurity.org/files/111238/MyBB-1.6.6-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/52743
CVE: CVE-2012-5909
Published: 2012-11-17
Description: SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditions[usergroup][] parameter in a search action to admin/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/80634; http://packetstormsecurity.org/files/111238/MyBB-1.6.6-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/52743
CVE: CVE-2012-5910
Published: 2012-11-17
Description: SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://b2evolution.net/news/2012/04/06/b2evolution-4-1-4-stable; http://osvdb.org/80671; http://packetstormsecurity.org/files/111294/B2Evolution-CMS-4.1.3-SQL-Injection.html
CVE: CVE-2012-5911
Published: 2012-11-17
Description: Cross-site scripting (XSS) vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbitrary web script or HTML via the message body.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://b2evolution.net/news/2012/04/06/b2evolution-4-1-4-stable; http://osvdb.org/80672; http://packetstormsecurity.org/files/111294/B2Evolution-CMS-4.1.3-SQL-Injection.html
CVE: CVE-2012-5912
Published: 2012-11-17
Description: Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) page.php or (2) single.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/80667; http://osvdb.org/80668; http://packetstormsecurity.org/files/111274/PicoPublisher-2.0-SQL-Injection.html
CVE: CVE-2012-5913
Published: 2012-11-17
Description: Cross-site scripting (XSS) vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter to wp-login.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/80628; http://packetstormsecurity.org/files/111249/WordPress-Integrator-1.32-Cross-Site-Scripting.html; http://www.darksecurity.de/advisories/2012/SSCHADV2012-010.txt
CVE: CVE-2012-5914
Published: 2012-11-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in the sed_import function in system/functions.php in Neocrome Seditio build 160 and 161 allow remote attackers to inject arbitrary web script or HTML via the (1) newmsg or (2) rtext parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://osvdb.org/80688; http://packetstormsecurity.org/files/111320/Seditio-Build-161-Cross-Site-Scripting-Information-Disclosure.html; http://secunia.com/advisories/48637
CVE: CVE-2012-5915
Published: 2012-11-17
Description: Neocrome Seditio build 161 and earlier allows remote attackers to obtain sensitive information via direct request to (1) view.php, (2) plugins/contact/lang/contact.en.lang.php, (3) system/lang/en/main.lang.php, (4) system/lang/en/message.lang.php, or (5) system/core/view/view.inc.php, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.org/files/111320/Seditio-Build-161-Cross-Site-Scripting-Information-Disclosure.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/74464; http://packetstormsecurity.org/files/111320/Seditio-Build-161-Cross-Site-Scripting-Information-Disclosure.html
CVE: CVE-2012-5916
Published: 2012-11-17
Description: Neocrome Seditio build 161 allows remote attackers to obtain sensitive information via a direct request to (1) docs/new/seditio-createnew-160.sql, (2) docs/upgrade/sedito_convert_to_utf8.optional.sql, or (3) system/install/install.parser.sql.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.org/files/111320/Seditio-Build-161-Cross-Site-Scripting-Information-Disclosure.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/74464; http://packetstormsecurity.org/files/111320/Seditio-Build-161-Cross-Site-Scripting-Information-Disclosure.html
CVE: CVE-2012-5917
Published: 2012-11-17
Description: SnackAmp 3.1.3 allows remote attackers to cause a denial of service (application crash) via a long string in an aiff file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/80805; http://www.exploit-db.com/exploits/18692; http://www.securityfocus.com/bid/52842
CVE: CVE-2012-4575
Published: 2012-11-18
Description: The add_database function in objects.c in the pgbouncer pooler 1.5.2 for PostgreSQL allows remote attackers to cause a denial of service (daemon outage) via a long database name in a request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692103; http://git.postgresql.org/gitweb/?p=pgbouncer.git%3Ba=commit%3Bh=4b92112b820830b30cd7bc91bef3dd8f35305525; http://openwall.com/lists/oss-security/2012/11/02/8
CVE: CVE-2012-4956
Published: 2012-11-18
Description: Heap-based buffer overflow in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to execute arbitrary code via a large number of VOL elements in an SRS record.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/87574; http://www.kb.cert.org/vuls/id/273371; https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
CVE: CVE-2012-4957
Published: 2012-11-18
Description: Absolute path traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a /FSF/CMD request with a full pathname in a PATH element of an SRS record.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/273371; https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959; http://www.kb.cert.org/vuls/id/273371
CVE: CVE-2012-4958
Published: 2012-11-18
Description: Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a 126 /FSF/CMD request with a .. (dot dot) in a FILE element of an FSFUI record.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/273371; https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959; http://www.kb.cert.org/vuls/id/273371
CVE: CVE-2012-4959
Published: 2012-11-18
Description: Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to upload and execute files via a 130 /FSF/CMD request with a .. (dot dot) in a FILE element of an FSFUI record.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/273371; https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959; http://www.kb.cert.org/vuls/id/273371
CVE: CVE-2012-4935
Published: 2012-11-18
Description: Cross-site request forgery (CSRF) vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/51203; http://www.kb.cert.org/vuls/id/802596; http://www.securityfocus.com/bid/56381
CVE: CVE-2012-4936
Published: 2012-11-18
Description: The web interface in Pattern Insight 2.3 allows remote attackers to conduct clickjacking attacks via a FRAME element.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/51203; http://www.kb.cert.org/vuls/id/802596; http://www.securityfocus.com/bid/56381
CVE: CVE-2012-4937
Published: 2012-11-18
Description: Session fixation vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack web sessions via a jsession_id cookie.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/51203; http://www.kb.cert.org/vuls/id/802596; http://www.securityfocus.com/bid/56381
CVE: CVE-2012-4938
Published: 2012-11-18
Description: Cross-site scripting (XSS) vulnerability in the web interface in Pattern Insight 2.3 allows remote authenticated administrators to inject arbitrary web script or HTML via the banner message.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/51203; http://www.kb.cert.org/vuls/id/802596; http://www.securityfocus.com/bid/56381
CVE: CVE-2012-4941
Published: 2012-11-18
Description: Multiple SQL injection vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/427547; http://www.securityfocus.com/bid/56427; http://www.kb.cert.org/vuls/id/427547
CVE: CVE-2012-4942
Published: 2012-11-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to inject arbitrary web script or HTML via an arbitrary text field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/427547; http://www.securityfocus.com/bid/56427; http://www.kb.cert.org/vuls/id/427547
CVE: CVE-2012-4943
Published: 2012-11-18
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to hijack the authentication of arbitrary users for requests that modify (1) passwords, (2) accounts, or (3) permissions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/427547; http://www.securityfocus.com/bid/56427; https://exchange.xforce.ibmcloud.com/vulnerabilities/79854
CVE: CVE-2012-4944
Published: 2012-11-18
Description: Multiple unrestricted file upload vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary code by uploading a file via an unspecified page.
CVSS Score: 10.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/427547; http://www.securityfocus.com/bid/56427; http://www.kb.cert.org/vuls/id/427547
CVE: CVE-2012-4945
Published: 2012-11-18
Description: Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/427547; http://www.securityfocus.com/bid/56427; http://www.kb.cert.org/vuls/id/427547
CVE: CVE-2012-4946
Published: 2012-11-18
Description: Agile FleetCommander and FleetCommander Kiosk before 4.08 use an XOR format for password encryption, which makes it easier for context-dependent attackers to obtain sensitive information by reading a key file and the encrypted strings.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/427547; http://www.securityfocus.com/bid/56427; https://exchange.xforce.ibmcloud.com/vulnerabilities/79857
CVE: CVE-2012-4947
Published: 2012-11-18
Description: Agile FleetCommander and FleetCommander Kiosk before 4.08 store database credentials in cleartext, which allows remote attackers to obtain sensitive information via requests to unspecified pages.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/427547; http://www.securityfocus.com/bid/56427; https://exchange.xforce.ibmcloud.com/vulnerabilities/79858
CVE: CVE-2012-4950
Published: 2012-11-18
Description: Cross-site scripting (XSS) vulnerability in the Keyword Search page in the web interface in Pattern Insight 2.3 allows remote attackers to inject arbitrary web script or HTML via crafted characters that are not properly handled during construction of error messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/87053; http://secunia.com/advisories/51203; http://www.kb.cert.org/vuls/id/802596
CVE: CVE-2012-4417
Published: 2012-11-18
Description: GlusterFS 3.3.0, as used in Red Hat Storage server 2.0, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2012-1456.html; http://www.securityfocus.com/bid/56522; http://www.securitytracker.com/id?1027756
CVE: CVE-2012-4433
Published: 2012-11-18
Description: Multiple integer overflows in operations/external/ppm-load.c in GEGL (Generic Graphics Library) 0.2.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large (1) width or (2) height value in a Portable Pixel Map (ppm) image, which triggers a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://git.gnome.org/browse/gegl/commit/?id=1e92e5235ded0415d555aa86066b8e4041ee5a53; http://git.gnome.org/browse/gegl/commit/?id=4757cdf73d3675478d645a3ec8250ba02168a230; http://lists.opensuse.org/opensuse-updates/2013-01/msg00054.html
CVE: CVE-2012-4520
Published: 2012-11-18
Description: The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691145; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090666.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090904.html
CVE: CVE-2012-4552
Published: 2012-11-18
Description: Stack-based buffer overflow in the error function in ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to execute arbitrary code via a crafted 3d model file that triggers a long error message, as demonstrated by a .ase file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091932.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091937.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091964.html
CVE: CVE-2012-4533
Published: 2012-11-19
Description: Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" line.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691062; http://osvdb.org/86566; http://secunia.com/advisories/51041
CVE: CVE-2011-0433
Published: 2012-11-19
Description: Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, a different vulnerability than CVE-2010-2642.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2012-1201.html; http://secunia.com/advisories/48985; http://www.mandriva.com/security/advisories?name=MDVSA-2012:144
CVE: CVE-2011-2486
Published: 2012-11-19
Description: nspluginwrapper before 1.4.4 does not properly provide access to NPNVprivateModeBool variable settings, which could prevent Firefox plugins from determining if they should run in Private Browsing mode and allow remote attackers to bypass intended access restrictions, as demonstrated using Flash.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lwn.net/Alerts/524725/; http://rhn.redhat.com/errata/RHSA-2012-1459.html; http://www.securitytracker.com/id?1027757
CVE: CVE-2011-5244
Published: 2012-11-19
Description: Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, different vulnerabilities than CVE-2010-2642 and CVE-2011-0433.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://git.gnome.org/browse/evince/commit/?id=439c5070022e; http://git.gnome.org/browse/evince/commit/?id=d4139205b010; http://www.openwall.com/lists/oss-security/2011/03/04/21
CVE: CVE-2012-4225
Published: 2012-11-19
Description: NVIDIA UNIX graphics driver before 295.71 and before 304.32 allows local users to write to arbitrary physical memory locations and gain privileges by modifying the VGA window using /dev/nvidia0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://nvidia.custhelp.com/app/answers/detail/a_id/3140; http://seclists.org/fulldisclosure/2012/Aug/4; http://seclists.org/fulldisclosure/2012/Aug/76
CVE: CVE-2012-4233
Published: 2012-11-19
Description: LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted (1) odt file to vcllo.dll, (2) ODG (Drawing document) file to svxcorelo.dll, (3) PolyPolygon record in a .wmf (Window Meta File) file embedded in a ppt (PowerPoint) file to tllo.dll, or (4) xls (Excel) file to scfiltlo.dll.
CVSS Score: 4.3 (MEDIUM)
References: http://cgit.freedesktop.org/libreoffice/binfilter/commit/?h=libreoffice-3-5-7&id=7e22ee55ffc9743692f3ddb93e59dd4427029c5b; http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-3-5-7&id=44bc6b5cac723b52df40fbef026e99b7119d8a69; http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-3-5-7&id=6789ec4c1a9c6af84bd62e650a03226a46365d97
CVE: CVE-2012-4423
Published: 2012-11-19
Description: The virNetServerProgramDispatchCall function in libvirt before 0.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and segmentation fault) via an RPC call with (1) an event as the RPC number or (2) an RPC number whose value is in a "gap" in the RPC dispatch table.
CVSS Score: 5.0 (MEDIUM)
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=b7ff9e696063189a715802d081d55a398663c15a; http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=f8fbeb50d52520a109d71c8566fed2ea600650ec; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089976.html
CVE: CVE-2012-4541
Published: 2012-11-19
Description: Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://piwik.org/blog/2012/10/piwik-1-9/; http://www.openwall.com/lists/oss-security/2012/10/22/1; http://www.openwall.com/lists/oss-security/2012/10/23/2
CVE: CVE-2012-5854
Published: 2012-11-19
Description: Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attackers to cause a denial of service (crash or hang) and possibly execute arbitrary code via crafted IRC colors that are not properly decoded.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092228.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092490.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092536.html
CVE: CVE-2012-5918
Published: 2012-11-19
Description: razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a directory.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/18344; http://www.exploit-db.com/exploits/18344