deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-5183
Published: 2012-08-25
Description: Race condition in Webroot Internet Security Essentials 6.1.0.145 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.  NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-362
References: http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html; http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/
CVE: CVE-2010-5184
Published: 2012-08-25
Description: Race condition in ZoneAlarm Extreme Security 9.1.507.000 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.  NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-362
References: http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html; http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/
CVE: CVE-2009-5123
Published: 2012-08-26
Description: The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (memory consumption) via a crafted compressed file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://personalfirewall.comodo.com/release_notes.html; http://personalfirewall.comodo.com/release_notes.html
CVE: CVE-2009-5124
Published: 2012-08-26
Description: The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (application crash) via a crafted packed file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://personalfirewall.comodo.com/release_notes.html; http://personalfirewall.comodo.com/release_notes.html
CVE: CVE-2009-5125
Published: 2012-08-26
Description: Comodo Internet Security before 3.9.95478.509 allows remote attackers to bypass malware detection in an RAR archive via an unspecified manipulation of the archive file format.
CVSS Score: 4.3 (MEDIUM)
References: http://blog.zoller.lu/2009/04/comodo-antivirus-evasionbypass.html; http://personalfirewall.comodo.com/release_notes.html; http://www.securityfocus.com/archive/1/503018
CVE: CVE-2009-5126
Published: 2012-08-26
Description: The Antivirus component in Comodo Internet Security before 3.8.65951.477 allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVSS Score: 4.3 (MEDIUM)
References: http://personalfirewall.comodo.com/release_notes.html; http://personalfirewall.comodo.com/release_notes.html
CVE: CVE-2009-5127
Published: 2012-08-26
Description: The Antivirus component in Comodo Internet Security before 3.8.64739.471 allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVSS Score: 4.3 (MEDIUM)
References: http://personalfirewall.comodo.com/release_notes.html; http://personalfirewall.comodo.com/release_notes.html
CVE: CVE-2010-5185
Published: 2012-08-26
Description: The Antivirus component in Comodo Internet Security before 5.3[PII_REDACTED] does not check whether X.509 certificates in signed executable files have been revoked, which has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://personalfirewall.comodo.com/release_notes.html; http://personalfirewall.comodo.com/release_notes.html
CVE: CVE-2010-5186
Published: 2012-08-26
Description: The Antivirus component in Comodo Internet Security before 4.1.150349.920 allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVSS Score: 4.3 (MEDIUM)
References: http://personalfirewall.comodo.com/release_notes.html; http://personalfirewall.comodo.com/release_notes.html
CVE: CVE-2011-5118
Published: 2012-08-26
Description: Multiple race conditions in Comodo Internet Security before 5.8[PII_REDACTED] allow local users to bypass the Defense+ feature via unspecified vectors.
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://personalfirewall.comodo.com/release_notes.html; http://personalfirewall.comodo.com/release_notes.html
CVE: CVE-2011-5119
Published: 2012-08-26
Description: Multiple race conditions in Comodo Internet Security before 5.8[PII_REDACTED] allow local users to bypass the Defense+ feature via unspecified vectors.
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://personalfirewall.comodo.com/release_notes.html; http://personalfirewall.comodo.com/release_notes.html
CVE: CVE-2011-5120
Published: 2012-08-26
Description: The Antivirus component in Comodo Internet Security before 5.4[PII_REDACTED] allows remote attackers to cause a denial of service (application crash) via a crafted .PST file.
CVSS Score: 4.3 (MEDIUM)
References: http://personalfirewall.comodo.com/release_notes.html; http://personalfirewall.comodo.com/release_notes.html
CVE: CVE-2011-5121
Published: 2012-08-26
Description: The Antivirus component in Comodo Internet Security before 5.3[PII_REDACTED] does not properly check whether unspecified X.509 certificates are revoked, which has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: http://personalfirewall.comodo.com/release_notes.html; http://personalfirewall.comodo.com/release_notes.html
CVE: CVE-2011-5122
Published: 2012-08-26
Description: The Antivirus component in Comodo Internet Security before 5.3[PII_REDACTED] allows remote attackers to cause a denial of service (application crash) via a crafted compressed file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://personalfirewall.comodo.com/release_notes.html; http://personalfirewall.comodo.com/release_notes.html
CVE: CVE-2011-5123
Published: 2012-08-26
Description: The Antivirus component in Comodo Internet Security before 5.3[PII_REDACTED] does not check whether X.509 certificates in signed executable files have been revoked, which has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: http://personalfirewall.comodo.com/release_notes.html; http://personalfirewall.comodo.com/release_notes.html
CVE: CVE-2012-2289
Published: 2012-08-26
Description: EMC ApplicationXtender Desktop before 6.5 SP2 and ApplicationXtender Web Access .NET before 6.5 SP2 allow remote attackers to upload files to any location, and possibly execute arbitrary code, via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-08/0168.html; http://www.securitytracker.com/id?1027442; http://archives.neohapsis.com/archives/bugtraq/2012-08/0168.html
CVE: CVE-2012-3477
Published: 2012-08-26
Description: SQL injection vulnerability in signup_check.php in NeoInvoice allows remote attackers to execute arbitrary SQL commands via the value parameter in a username action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://adamcaudill.com/2012/08/12/neoinvoice-blind-sql-injection-cve-2012-3477/; http://archives.neohapsis.com/archives/bugtraq/2012-08/0087.html; http://adamcaudill.com/2012/08/12/neoinvoice-blind-sql-injection-cve-2012-3477/
CVE: CVE-2012-3517
Published: 2012-08-26
Description: Use-after-free vulnerability in dns.c in Tor before 0.2.2.38 might allow remote attackers to cause a denial of service (daemon crash) via vectors related to failed DNS requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html; http://lists.opensuse.org/opensuse-updates/2012-08/msg00048.html; http://openwall.com/lists/oss-security/2012/08/21/6
CVE: CVE-2012-3518
Published: 2012-08-26
Description: The networkstatus_parse_vote_from_string function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, which allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted (1) vote document or (2) consensus document.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2012-08/msg00048.html; http://openwall.com/lists/oss-security/2012/08/21/6; http://secunia.com/advisories/50583
CVE: CVE-2012-3519
Published: 2012-08-26
Description: routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might allow remote attackers to obtain sensitive information about relay selection via a timing side-channel attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2012-08/msg00048.html; http://openwall.com/lists/oss-security/2012/08/21/6; http://secunia.com/advisories/50583
CVE: CVE-2012-4673
Published: 2012-08-26
Description: SQL injection vulnerability in application/controllers/invoice.php in NeoInvoice might allow remote attackers to execute arbitrary SQL commands via vectors involving the sort_col variable in the list_items function, a different vulnerability than CVE-2012-3477.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://adamcaudill.com/2012/08/12/neoinvoice-blind-sql-injection-cve-2012-3477/; https://github.com/mweimerskirch/neoinvoice/commit/501a9d5d261c718913cfc13d212b09b56f3bf087; https://github.com/tlhunter/neoinvoice/issues/2
CVE: CVE-2010-5080
Published: 2012-08-26
Description: The Security/changepassword URL action in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 passes a token as a GET parameter while changing a password through email, which allows remote attackers to obtain sensitive data and hijack the session via the HTTP referer logs on a server, aka "HTTP referer leakage."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-255, CWE-352
References: http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.10; http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.4; http://open.silverstripe.org/changeset/114758
CVE: CVE-2010-5087
Published: 2012-08-26
Description: SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism and hijack the authentication of administrators via vectors related to "form action requests" using a controller.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.10; http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.4; http://open.silverstripe.org/changeset/115182
CVE: CVE-2010-5088
Published: 2012-08-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in SilverStripe 2.3.x before 2.3.9 and 2.4.x before 2.4.3 allow remote attackers to hijack the authentication of administrators via destructive controller actions, a different vulnerability than CVE-2010-5087.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.9; http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.3; http://holisticinfosec.org/content/view/157/45/
CVE: CVE-2010-5089
Published: 2012-08-26
Description: SilverStripe before 2.4.2 does not properly restrict access to pages in draft mode, which allows remote attackers to obtain sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.2; http://open.silverstripe.org/changeset/110757; http://www.openwall.com/lists/oss-security/2012/04/30/1
CVE: CVE-2010-5090
Published: 2012-08-26
Description: SilverStripe before 2.4.2 allows remote authenticated users to change administrator passwords via vectors related to admin/security.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.2; http://www.openwall.com/lists/oss-security/2012/04/30/1; http://www.openwall.com/lists/oss-security/2012/04/30/3
CVE: CVE-2010-5091
Published: 2012-08-26
Description: The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://dl.packetstormsecurity.net/1006-exploits/silverstripe-shell.txt; http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.8; http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.1
CVE: CVE-2010-5092
Published: 2012-08-26
Description: The Add Member dialog in the Security admin page in SilverStripe 2.4.0 saves user passwords in plaintext, which allows local users to obtain sensitive information by reading a database.
CVSS Score: 1.9 (LOW)
CWE: CWE-255
References: http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.1; http://open.silverstripe.org/changeset/107532; http://open.silverstripe.org/ticket/5772
CVE: CVE-2010-5093
Published: 2012-08-26
Description: Member_ProfileForm in security/Member.php in SilverStripe 2.3.x before 2.3.7 allows remote attackers to hijack user accounts by saving data using the email address (ID) of another user.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.7; http://open.silverstripe.org/changeset/100744; http://www.openwall.com/lists/oss-security/2012/04/30/1
CVE: CVE-2010-5094
Published: 2012-08-26
Description: The deleteinstallfiles function in control/ContentController.php in SilverStripe 2.3.x before 2.3.7 does not require ADMIN permissions, which allows remote attackers to delete index.php and "disrupt mod_rewrite-less URL routing."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.7; http://open.silverstripe.org/changeset/101227; http://www.openwall.com/lists/oss-security/2012/04/30/1
CVE: CVE-2010-5095
Published: 2012-08-26
Description: Cross-site scripting (XSS) vulnerability in SilverStripe 2.3.x before 2.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to DataObjectSet pagination.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.6; http://groups.google.com/group/silverstripe-announce/browse_thread/thread/c75fbd7926ed2725?tvc=2&fwc=1; http://secunia.com/advisories/38697
CVE: CVE-2010-5187
Published: 2012-08-26
Description: SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1, when running on servers with certain configurations, allows remote attackers to obtain sensitive information via a direct request to PHP files in the (1) sapphire, (2) cms, or (3) mysite folders, which reveals the installation path in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.8; http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.1; http://www.openwall.com/lists/oss-security/2012/04/30/1
CVE: CVE-2010-5188
Published: 2012-08-26
Description: SilverStripe 2.3.x before 2.3.6 allows remote attackers to obtain sensitive information via the (1) debug_memory parameter to core/control/Director.php or (2) debug_profile parameter to main.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.6; http://groups.google.com/group/silverstripe-announce/browse_thread/thread/c75fbd7926ed2725?tvc=2&fwc=1; http://open.silverstripe.org/changeset/98229
CVE: CVE-2012-2227
Published: 2012-08-26
Description: Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the default_lang parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-05/0011.html; http://osvdb.org/81638; http://secunia.com/advisories/49026
CVE: CVE-2012-4674
Published: 2012-08-26
Description: PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://telechargements.pluxml.org/changelog; http://www.pluxml.org/article59/sortie-de-pluxml-5-1-6; http://telechargements.pluxml.org/changelog
CVE: CVE-2012-4675
Published: 2012-08-26
Description: Cross-site scripting (XSS) vulnerability in PluXml 5.1.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to file update.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49026; http://telechargements.pluxml.org/changelog; http://www.pluxml.org/article59/sortie-de-pluxml-5-1-6
CVE: CVE-2009-5128
Published: 2012-08-26
Description: The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (memory consumption and process crash) via a large file that is not properly handled during buffering.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://kb.websense.com/pf/12/webfiles/V10000%20Documentation/V10000%20Patches/v1.0.1/V10000_v1.0.1_ReleaseNotes.pdf; http://kb.websense.com/pf/12/webfiles/V10000%20Documentation/V10000%20Patches/v1.0.1/V10000_v1.0.1_ReleaseNotes.pdf
CVE: CVE-2009-5129
Published: 2012-08-26
Description: The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (intermittent LDAP authentication outage) via a login attempt with an incorrect password.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://kb.websense.com/pf/12/webfiles/V10000%20Documentation/V10000%20Patches/v1.0.1/V10000_v1.0.1_ReleaseNotes.pdf; http://kb.websense.com/pf/12/webfiles/V10000%20Documentation/V10000%20Patches/v1.0.1/V10000_v1.0.1_ReleaseNotes.pdf
CVE: CVE-2009-5130
Published: 2012-08-26
Description: The Rules Service in Websense Email Security before 7.1 allows remote attackers to cause a denial of service (service crash) via an attachment with a crafted size.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.websense.com/support/article/t-kbarticle/Release-Notes-for-Websense-Email-Security-v7-1; http://www.websense.com/support/article/t-kbarticle/Release-Notes-for-Websense-Email-Security-v7-1
CVE: CVE-2009-5131
Published: 2012-08-26
Description: The Receive Service in Websense Email Security before 7.1 does not recognize domain extensions in the blacklist, which allows remote attackers to bypass intended access restrictions and send e-mail messages via an SMTP session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.websense.com/support/article/t-kbarticle/Release-Notes-for-Websense-Email-Security-v7-1; http://www.websense.com/support/article/t-kbarticle/Release-Notes-for-Websense-Email-Security-v7-1
CVE: CVE-2009-5132
Published: 2012-08-26
Description: The Filtering Service in Websense Web Security and Web Filter before 6.3.1 Hotfix 106 and 7.x before 7.1 allow remote attackers to cause a denial of service (filtering outage) via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
References: http://www.websense.com/content/support/library/web/v71/wws_pdfs/ws_releasenotes.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/78570; http://www.websense.com/content/support/library/web/v71/wws_pdfs/ws_releasenotes.pdf
CVE: CVE-2010-5189
Published: 2012-08-26
Description: Blue Coat ProxySG before SGOS 4.3.4.1, 5.x before SGOS 5.4.5.1, 5.5 before SGOS 5.5.4.1, and 6.x before SGOS 6.1.1.1 allows remote authenticated users to execute arbitrary CLI commands by leveraging read-only administrator privileges and establishing an HTTPS session.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: https://kb.bluecoat.com/index?page=content&id=SA45; https://kb.bluecoat.com/index?page=content&id=SA45
CVE: CVE-2010-5190
Published: 2012-08-26
Description: The Active Content Transformation functionality in Blue Coat ProxySG before SGOS 4.3.4.2, 5.x before SGOS 5.4.5.1, 5.5 before SGOS 5.5.4.1, and 6.x before SGOS 6.1.2.1 allows remote attackers to bypass JavaScript detection via HTML entities.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://kb.bluecoat.com/index?page=content&id=SA48; https://kb.bluecoat.com/index?page=content&id=SA48
CVE: CVE-2010-5191
Published: 2012-08-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities on the Blue Coat ProxyAV appliance before 3.2.6.1 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password, (2) modify a policy, or (3) restart the device.
CVSS Score: 9.3 (HIGH)
CWE: CWE-352
References: https://kb.bluecoat.com/index?page=content&id=SA46; https://kb.bluecoat.com/index?page=content&id=SA46
CVE: CVE-2010-5192
Published: 2012-08-26
Description: Cross-site scripting (XSS) vulnerability in the Java Management Console in Blue Coat ProxySG before SGOS 4.3.4.1, 5.x before SGOS 5.4.5.1, 5.5 before SGOS 5.5.4.1, and 6.x before SGOS 6.1.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41695; http://securitytracker.com/id?1024503; http://www.osvdb.org/68322
CVE: CVE-2011-5124
Published: 2012-08-26
Description: Stack-based buffer overflow in the BCAAA component before build 60258, as used by Blue Coat ProxySG 4.2.3 through 6.1 and ProxyOne, allows remote attackers to execute arbitrary code via a large packet to the synchronization port (16102/tcp).
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://kb.bluecoat.com/index?page=content&id=SA55; https://kb.bluecoat.com/index?page=content&id=SA55
CVE: CVE-2011-5125
Published: 2012-08-26
Description: Cross-site scripting (XSS) vulnerability in Blue Coat Director before 5.5.2.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving the HTTP TRACE method.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://kb.bluecoat.com/index?page=content&id=SA62; https://kb.bluecoat.com/index?page=content&id=SA62
CVE: CVE-2011-5126
Published: 2012-08-26
Description: Blue Coat ProxySG 6.1 before SGOS 6.1.5.1 and 6.2 before SGOS 6.2.2.1 writes the secure heap to core images, which allows context-dependent attackers to obtain sensitive authentication information by leveraging read access to a downloaded core file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://kb.bluecoat.com/index?page=content&id=SA56; https://kb.bluecoat.com/index?page=content&id=SA56
CVE: CVE-2011-5127
Published: 2012-08-26
Description: Directory traversal vulnerability in Blue Coat Reporter 9.x before 9.2.4.13, 9.2.5.x before 9.2.5.1, and 9.3 before 9.3.1.2 on Windows allows remote attackers to read arbitrary files, and consequently execute arbitrary code, via an unspecified HTTP request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: https://kb.bluecoat.com/index?page=content&id=SA60; https://kb.bluecoat.com/index?page=content&id=SA60
CVE: CVE-2012-3483
Published: 2012-08-26
Description: Race condition in the runScript function in Tunnelblick 3.3beta20 and earlier allows local users to gain privileges by replacing a script file.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-362
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0122.html; http://code.google.com/p/tunnelblick/issues/detail?id=212; http://git.zx2c4.com/Pwnnel-Blicker/tree/pwnnel-blicker.c
CVE: CVE-2012-3484
Published: 2012-08-26
Description: Tunnelblick 3.3beta20 and earlier relies on a test for specific ownership and permissions to determine whether a program can be safely executed, which allows local users to bypass intended access restrictions and gain privileges via a (1) user-mountable image or (2) network share.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0122.html; http://code.google.com/p/tunnelblick/issues/detail?id=212; http://www.openwall.com/lists/oss-security/2012/08/14/1