deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-4591
Published: 2012-07-20
Description: Cross-site scripting (XSS) vulnerability in the print_object function in lib/datalib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3, when a developer debugging script is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors involving object states.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=187672608ec96659e07f2461b3b83634debd16cb; http://moodle.org/mod/forum/discuss.php?d=191760; https://bugzilla.redhat.com/show_bug.cgi?id=761248
CVE: CVE-2011-4592
Published: 2012-07-20
Description: The command-line cron implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly interact with IP blocking, which might allow remote attackers to bypass intended IP address restrictions by leveraging a configuration in which IP blocking was disabled to restore cron functionality.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=ade30ad3c420ce035a3d68287db701b70e806b3f; http://moodle.org/mod/forum/discuss.php?d=191761; https://bugzilla.redhat.com/show_bug.cgi?id=761248
CVE: CVE-2011-4593
Published: 2012-07-20
Description: Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle user/action_redir group messages, which allows remote authenticated users to discover e-mail addresses by visiting the messaging interface.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e94113a859015a4a80b9397957b8fc4044e2951f; http://moodle.org/mod/forum/discuss.php?d=191762; https://bugzilla.redhat.com/show_bug.cgi?id=761248
CVE: CVE-2012-2688
Published: 2012-07-20
Description: Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow."
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00022.html
CVE: CVE-2012-2955
Published: 2012-07-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2.8 and IBM ISS Proventia Network Mail Security System allow remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/84014; http://secunia.com/advisories/49897; http://www-01.ibm.com/support/docview.wss?uid=swg21605626
CVE: CVE-2012-3008
Published: 2012-07-20
Description: Stack-based buffer overflow in OSIsoft PI OPC DA Interface before 2.3.20.9 allows remote authenticated users to execute arbitrary code by sending packet data during the processing of messages associated with OPC items.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/84091; http://secunia.com/advisories/49986; http://www.securityfocus.com/bid/54609
CVE: CVE-2012-3365
Published: 2012-07-20
Description: The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00022.html; http://osvdb.org/84100
CVE: CVE-2012-2353
Published: 2012-07-21
Description: Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31923; http://openwall.com/lists/oss-security/2012/05/23/2; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31923
CVE: CVE-2012-2354
Published: 2012-07-21
Description: Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=48e03792ca8faa2d781f9ef74606f3b3f0d3baec; http://openwall.com/lists/oss-security/2012/05/23/2; http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=48e03792ca8faa2d781f9ef74606f3b3f0d3baec
CVE: CVE-2012-2355
Published: 2012-07-21
Description: Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass question:use* capability requirements and add arbitrary questions to a quiz via the questions feature.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-32240; http://openwall.com/lists/oss-security/2012/05/23/2; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-32240
CVE: CVE-2012-2356
Published: 2012-07-21
Description: The question-bank functionality in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass intended capability requirements and save questions via a save_question action.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-32239; http://openwall.com/lists/oss-security/2012/05/23/2; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-32239
CVE: CVE-2012-2357
Published: 2012-07-21
Description: The Multi-Authentication feature in the Central Authentication Service (CAS) functionality in auth/cas/cas_form.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=895e76ea51c462c18ad66e0761ad76cd26a63ecf; http://openwall.com/lists/oss-security/2012/05/23/2; http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=895e76ea51c462c18ad66e0761ad76cd26a63ecf
CVE: CVE-2012-2358
Published: 2012-07-21
Description: Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to bypass an activity's read-only state and modify the database by leveraging the student role and editing database activity entries that already exist.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31811; http://openwall.com/lists/oss-security/2012/05/23/2; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31811
CVE: CVE-2012-2359
Published: 2012-07-21
Description: admin/roles/override.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to gain privileges by leveraging the teacher role and modifying their own capabilities, as demonstrated by obtaining the backup:userinfo capability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=0f75e1e6272db0303abc8e27362e5c3a1344b82f; http://openwall.com/lists/oss-security/2012/05/23/2; http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=0f75e1e6272db0303abc8e27362e5c3a1344b82f
CVE: CVE-2012-2360
Published: 2012-07-21
Description: Cross-site scripting (XSS) vulnerability in the Wiki subsystem in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted string that is inserted into a page title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-32018; http://openwall.com/lists/oss-security/2012/05/23/2; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-32018
CVE: CVE-2012-2361
Published: 2012-07-21
Description: Cross-site scripting (XSS) vulnerability in admin/webservice/forms.php in the web services implementation in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via the name field (aka the service name) to admin/webservice/service.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31694; http://openwall.com/lists/oss-security/2012/05/23/2; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31694
CVE: CVE-2012-2362
Published: 2012-07-21
Description: Cross-site scripting (XSS) vulnerability in blog/lib.php in the blog implementation in Moodle 1.9.x before 1.9.18, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via a crafted parameter to blog/index.php.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=038131c8b5614f18c14d964dc53b6960ae6c30d8; http://openwall.com/lists/oss-security/2012/05/23/2; http://osvdb.org/82069
CVE: CVE-2012-2363
Published: 2012-07-21
Description: SQL injection vulnerability in calendar/event.php in the calendar implementation in Moodle 1.9.x before 1.9.18 allows remote authenticated users to execute arbitrary SQL commands via a crafted calendar event.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=refs%2Fheads%2FMOODLE_19_STABLE&st=commit&s=MDL-31746; http://openwall.com/lists/oss-security/2012/05/23/2; http://git.moodle.org/gw?p=moodle.git&a=search&h=refs%2Fheads%2FMOODLE_19_STABLE&st=commit&s=MDL-31746
CVE: CVE-2012-2364
Published: 2012-07-21
Description: Cross-site scripting (XSS) vulnerability in lib/filelib.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via an assignment submission with zip compression, leading to text/html rendering during a "download all" action.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=ce4126c7a9e07dd0514f7ac297b5e60cad0b8d20; http://openwall.com/lists/oss-security/2012/05/23/2; http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=ce4126c7a9e07dd0514f7ac297b5e60cad0b8d20
CVE: CVE-2012-2365
Published: 2012-07-21
Description: Cross-site scripting (XSS) vulnerability in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via the idnumber field to cohort/edit.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31691; http://openwall.com/lists/oss-security/2012/05/23/2; http://osvdb.org/82072
CVE: CVE-2012-2366
Published: 2012-07-21
Description: mod/data/preset.php in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not properly iterate through an array, which allows remote authenticated users to overwrite arbitrary database activity presets via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31763; http://openwall.com/lists/oss-security/2012/05/23/2; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31763
CVE: CVE-2012-2367
Published: 2012-07-21
Description: Moodle 1.9.x before 1.9.18, 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/calendar:manageownentries capability requirement and add a calendar entry via a New Entry action.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-18335; http://openwall.com/lists/oss-security/2012/05/23/2; http://osvdb.org/82074
CVE: CVE-2009-5031
Published: 2012-07-22
Description: ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks via a single quote in a request parameter in the Content-Disposition field of a request with a multipart/form-data Content-Type header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.ivanristic.com/2012/06/modsecurity-and-modsecurity-core-rule-set-multipart-bypasses.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html
CVE: CVE-2012-2738
Published: 2012-07-22
Description: The VteTerminal in gnome-terminal (vte) before 0.32.2 allows remote authenticated users to cause a denial of service (long loop and CPU consumption) via an escape sequence with a large repeat count value.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://ftp.gnome.org/pub/GNOME/sources/vte/0.32/vte-0.32.2.changes; http://ftp.gnome.org/pub/GNOME/sources/vte/0.32/vte-0.32.2.news; http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083398.html
CVE: CVE-2012-2751
Published: 2012-07-22
Description: ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.
CVSS Score: 4.3 (MEDIUM)
References: http://blog.ivanristic.com/2012/06/modsecurity-and-modsecurity-core-rule-set-multipart-bypasses.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html
CVE: CVE-2012-3356
Published: 2012-07-22
Description: The remote SVN views functionality (lib/vclib/svn/svn_ra.py) in ViewVC before 1.1.15 does not properly perform authorization, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/83225; http://viewvc.tigris.org/issues/show_bug.cgi?id=353; http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.1.15/CHANGES
CVE: CVE-2012-3357
Published: 2012-07-22
Description: The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which allows remote attackers to obtain sensitive information, related to a "log msg leak."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/83227; http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2758; http://www.debian.org/security/2012/dsa-2563
CVE: CVE-2012-3360
Published: 2012-07-22
Description: Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083984.html; http://secunia.com/advisories/49763; http://secunia.com/advisories/49802
CVE: CVE-2012-3361
Published: 2012-07-22
Description: virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083969.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083984.html; http://secunia.com/advisories/49763
CVE: CVE-2011-2199
Published: 2012-07-22
Description: Buffer overflow in tftp-hpa before 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the utimeout option.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/?p=network/tftp/tftp-hpa.git%3Ba=blob%3Bf=CHANGES%3Bh=6df0d97b1f6c99f49d65e9ff80aa7b847f0e21e1%3Bhb=badf05140d3c2408715a73a52c0f35887e337c04; http://git.kernel.org/?p=network/tftp/tftp-hpa.git%3Ba=commitdiff%3Bh=f3035c45bc50bb5cac87ca01e7ef6a12485184f8; http://security.gentoo.org/glsa/glsa-201206-12.xml
CVE: CVE-2011-3148
Published: 2012-07-22
Description: Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://git.fedorahosted.org/git/?p=linux-pam.git%3Ba=commitdiff%3Bh=caf5e7f61c8d9288daa49b4f61962e6b1239121d; http://secunia.com/advisories/46583; http://secunia.com/advisories/49711
CVE: CVE-2011-3149
Published: 2012-07-22
Description: The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://git.fedorahosted.org/git/?p=linux-pam.git%3Ba=commitdiff%3Bh=109823cb621c900c07c4b6cdc99070d354d19444; http://secunia.com/advisories/46583; http://secunia.com/advisories/49711
CVE: CVE-2011-3464
Published: 2012-07-22
Description: Off-by-one error in the png_formatted_warning function in pngerror.c in libpng 1.5.4 through 1.5.7 might allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unspecified vectors, which trigger a stack-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/47827; http://secunia.com/advisories/49660; http://security.gentoo.org/glsa/glsa-201206-15.xml
CVE: CVE-2012-2088
Published: 2012-07-22
Description: Integer signedness error in the TIFFReadDirectory function in tif_dirread.c in libtiff 3.9.4 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a negative tile depth in a tiff image, which triggers an improper conversion between signed and unsigned types, leading to a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00010.html; http://rhn.redhat.com/errata/RHSA-2012-1054.html
CVE: CVE-2012-2113
Published: 2012-07-22
Description: Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00010.html; http://rhn.redhat.com/errata/RHSA-2012-1054.html; http://secunia.com/advisories/49493
CVE: CVE-2012-2737
Published: 2012-07-22
Description: The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://cgit.freedesktop.org/accountsservice/commit/?id=26213aa0e0d8dca5f36cc23f[PII_REDACTED]cbe9f5; http://cgit.freedesktop.org/accountsservice/commit/?id=27f3d93a82fde4f6c7ab54f3f008af04f93f9c69; http://cgit.freedesktop.org/accountsservice/commit/?id=4c5b12e363410e490e776e4b4a86dcce157a543d
CVE: CVE-2012-3383
Published: 2012-07-22
Description: The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://codex.wordpress.org/Version_3.4.1; http://codex.wordpress.org/Version_3.4.2; http://core.trac.wordpress.org/changeset?old_path=%2Ftags%2F3.4.1&old=21780&new_path=%2Ftags%2F3.4.2&new=21780#file23
CVE: CVE-2012-3384
Published: 2012-07-22
Description: Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://codex.wordpress.org/Version_3.4.1; http://www.openwall.com/lists/oss-security/2012/07/02/1; http://www.openwall.com/lists/oss-security/2012/07/08/1
CVE: CVE-2012-3385
Published: 2012-07-22
Description: WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://codex.wordpress.org/Version_3.4.1; http://www.openwall.com/lists/oss-security/2012/07/02/1; http://www.openwall.com/lists/oss-security/2012/07/08/1
CVE: CVE-2012-4045
Published: 2012-07-22
Description: Multiple heap-based buffer overflows in bmp.w5s in Winamp before 5.63 build 3235 allow remote attackers to execute arbitrary code via the (1) strf chunk in BI_RGB or (2) UYVY video data in an AVI file, or (3) decompressed TechSmith Screen Capture Codec (TSCC) data in an AVI file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://forums.winamp.com/showthread.php?t=345684; http://secunia.com/advisories/46624; http://www.securityfocus.com/bid/54131
CVE: CVE-2012-0305
Published: 2012-07-23
Description: Untrusted search path vulnerability in Symantec System Recovery 2011 before SP2 and Backup Exec System Recovery 2010 before SP5 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVSS Score: 4.4 (MEDIUM)
References: http://www.securityfocus.com/bid/54594; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_01; http://www.securityfocus.com/bid/54594
CVE: CVE-2012-2574
Published: 2012-07-23
Description: SQL injection vulnerability in the management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to a "blind SQL injection" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/108471; http://www.securityfocus.com/bid/54424; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
CVE: CVE-2012-2953
Published: 2012-07-23
Description: The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary commands via crafted input to application scripts.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www.kb.cert.org/vuls/id/108471; http://www.securityfocus.com/bid/54426; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
CVE: CVE-2012-2957
Published: 2012-07-23
Description: The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows local users to gain privileges by modifying files, related to a "file inclusion" issue.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/108471; http://www.securityfocus.com/bid/54429; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00