deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-1567
Published: 2011-04-05
Description: Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted (1) ListAll, (2) Write File, (3) ReadFile, (4) Delete, (5) RenameFile, and (6) FileInfo commands in an 0xd opcode; (7) the Add, (8) ReadFile, (9) Write File, (10) Rename, (11) Delete, and (12) Add commands in an RMS report templates (0x7) opcode; and (13) 0x4 command in an STDREP request (0x8) opcode to TCP port 12401.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/igss_2-adv.txt; http://aluigi.org/adv/igss_3-adv.txt; http://aluigi.org/adv/igss_4-adv.txt
CVE: CVE-2011-1568
Published: 2011-04-05
Description: Format string vulnerability in the logText function in shmemmgr9.dll in IGSSdataServer.exe 9.00.00.11074, and 9.00.00.11063 and earlier, in 7-Technologies Interactive Graphical SCADA System (IGSS) allows remote attackers to cause a denial of service and possibly execute arbitrary code, as demonstrated using the RMS Reports Delete command, related to the logging of messages to GSST.LOG.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://aluigi.org/adv/igss_6-adv.txt; http://secunia.com/advisories/43849; http://securityreason.com/securityalert/8182
CVE: CVE-2011-1569
Published: 2011-04-05
Description: download.aspx in Douran Portal 3.9.7.8 allows remote attackers to obtain source code of arbitrary files under the web root via (1) a trailing ".", (2) a trailing space, or (3) mixed case in the FileNameAttach parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/71250; http://secunia.com/advisories/43792; http://securityreason.com/securityalert/8180
CVE: CVE-2011-1525
Published: 2011-04-06
Description: Heap-based buffer overflow in rvrender.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.2, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via a crafted frame in an Internet Video Recording (IVR) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/real_5-adv.txt; http://osvdb.org/71260; http://secunia.com/advisories/43847
CVE: CVE-2011-0895
Published: 2011-04-06
Description: Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x and 8.1x allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0787&w=2; http://secunia.com/advisories/44032; http://securityreason.com/securityalert/8186
CVE: CVE-2011-1652
Published: 2011-04-06
Description: The default configuration of Microsoft Windows 7 immediately prefers a new IPv6 and DHCPv6 service over a currently used IPv4 and DHCPv4 service upon receipt of an IPv6 Router Advertisement (RA), and does not provide an option to ignore an unexpected RA, which allows remote attackers to conduct man-in-the-middle attacks on communication with external IPv4 servers via vectors involving RAs, a DHCPv6 server, and NAT-PT on the local network, aka a "SLAAC Attack." NOTE: it can be argued that preferring IPv6 complies with RFC 3484, and that attempting to determine the legitimacy of an RA is currently outside the scope of recommended behavior of host operating systems
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://resources.infosecinstitute.com/slaac-attack/; https://lists.immunityinc.com/pipermail/dailydave/20110404/000122.html; http://resources.infosecinstitute.com/slaac-attack/
CVE: CVE-2010-4779
Published: 2011-04-07
Description: Cross-site scripting (XSS) vulnerability in lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wptouch_settings parameter to include/adsense-new.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/69538; http://secunia.com/advisories/42438; http://www.htbridge.ch/advisory/xss_in_wptouch_wordpress_plugin.html
CVE: CVE-2010-4780
Published: 2011-04-07
Description: SQL injection vulnerability in the check_banlist function in includes/sessions.php in Enano CMS 1.1.7pl1; 1.0.6pl2; and possibly other versions before 1.1.8, 1.0.6pl3, and 1.1.7pl2 allows remote attackers to execute arbitrary SQL commands via the email parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://enanocms.org/News:Article/2010/11/16/Enano_1.1.8.2c_1.0.6pl3.2c_and_1.1.7pl2_released; http://osvdb.org/69537; http://packetstormsecurity.org/files/view/96229/enanocms-sqldisclose.txt
CVE: CVE-2010-4781
Published: 2011-04-07
Description: index.php in Enano CMS 1.1.7pl1, and possibly other versions before 1.1.8, 1.0.6pl3, and 1.1.7pl2, allows remote attackers to obtain sensitive information via a crafted title parameter, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://enanocms.org/News:Article/2010/11/16/Enano_1.1.8.2c_1.0.6pl3.2c_and_1.1.7pl2_released; http://packetstormsecurity.org/files/view/96229/enanocms-sqldisclose.txt; http://securityreason.com/securityalert/8183
CVE: CVE-2010-4782
Published: 2011-04-07
Description: Multiple SQL injection vulnerabilities in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) city, (2) state, (3) country, (4) minprice, (5) maxprice, (6) bed, and (7) bath parameters, different vectors than CVE-2006-6807.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/96305/anandarealestate-sql.txt; http://secunia.com/advisories/23506; http://securityreason.com/securityalert/8185
CVE: CVE-2010-4783
Published: 2011-04-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in PHP Web Scripts Easy Banner Free 2009.05.18, when magic_quotes_gpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl and (2) urlbanner parameters.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://evuln.com/vulns/148/summary.html; http://packetstormsecurity.org/files/view/96154/easybannerfree-xss.txt; http://secunia.com/advisories/42316
CVE: CVE-2010-4784
Published: 2011-04-07
Description: Multiple SQL injection vulnerabilities in member.php in PHP Web Scripts Easy Banner Free 2009.05.18, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://evuln.com/vulns/147/summary.html; http://packetstormsecurity.org/files/view/96153/easybannerfree-sql.txt; http://secunia.com/advisories/42316
CVE: CVE-2011-0465
Published: 2011-04-08
Description: xrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a (1) DHCP or (2) XDMCP message.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://cgit.freedesktop.org/xorg/app/xrdb/commit/?id=1027d5df07398c1507fb1fe3a9981aa6b4bc3a56; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057928.html; http://lists.freedesktop.org/archives/xorg-announce/2011-April/001635.html
CVE: CVE-2011-0536
Published: 2011-04-08
Description: Multiple untrusted search path vulnerabilities in elf/dl-object.c in certain modified versions of the GNU C Library (aka glibc or libc6), including glibc-2.5-49.el5_5.6 and glibc-2.12-1.7.el6_0.3 in Red Hat Enterprise Linux, allow local users to gain privileges via a crafted dynamic shared object (DSO) in a subdirectory of the current working directory during execution of a (1) setuid or (2) setgid program that has $ORIGIN in (a) RPATH or (b) RUNPATH within the program itself or a referenced library. NOTE: this issue exists because of an incorrect fix for CVE-2010-3847.
CVSS Score: 6.9 (MEDIUM)
References: http://lists.debian.org/debian-security-announce/2011/msg00005.html; http://openwall.com/lists/oss-security/2011/02/01/3; http://openwall.com/lists/oss-security/2011/02/03/2
CVE: CVE-2011-0997
Published: 2011-04-08
Description: dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is provided to dhclient-script.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057888.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058279.html
CVE: CVE-2011-1071
Published: 2011-04-08
Description: The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack," a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported for use of this library by Google Chrome.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-399
References: http://bugs.debian.org/615120; http://code.google.com/p/chromium/issues/detail?id=48733; http://openwall.com/lists/oss-security/2011/02/26/3
CVE: CVE-2011-1183
Published: 2011-04-08
Description: Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.
CVSS Score: 5.8 (MEDIUM)
References: http://seclists.org/fulldisclosure/2011/Apr/96; http://securityreason.com/securityalert/8187; http://svn.apache.org/viewvc?view=revision&revision=1087643
CVE: CVE-2011-1475
Published: 2011-04-08
Description: The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2011/Apr/97; http://securityreason.com/securityalert/8188; http://svn.apache.org/viewvc?view=revision&revision=1086349
CVE: CVE-2011-1491
Published: 2011-04-08
Description: The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an e-mail message, related to a "login CSRF" issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://openwall.com/lists/oss-security/2011/03/24/3; http://openwall.com/lists/oss-security/2011/03/24/4; http://openwall.com/lists/oss-security/2011/04/04/50
CVE: CVE-2011-1492
Published: 2011-04-08
Description: steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://openwall.com/lists/oss-security/2011/03/24/3; http://openwall.com/lists/oss-security/2011/03/24/4; http://openwall.com/lists/oss-security/2011/04/04/50
CVE: CVE-2011-1658
Published: 2011-04-08
Description: ld.so in the GNU C Library (aka glibc or libc6) 2.13 and earlier expands the $ORIGIN dynamic string token when RPATH is composed entirely of this token, which might allow local users to gain privileges by creating a hard link in an arbitrary directory to a (1) setuid or (2) setgid program with this RPATH value, and then executing the program with a crafted value for the LD_PRELOAD environment variable, a different vulnerability than CVE-2010-3847 and CVE-2011-0536.  NOTE: it is not expected that any standard operating-system distribution would ship an applicable setuid or setgid program.
CVSS Score: 3.7 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/46397; http://sourceware.org/bugzilla/show_bug.cgi?id=12393; http://www.securityfocus.com/archive/1/520102/100/0/threaded
CVE: CVE-2011-1659
Published: 2011-04-08
Description: Integer overflow in posix/fnmatch.c in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long UTF8 string that is used in an fnmatch call with a crafted pattern argument, a different vulnerability than CVE-2011-1071.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://code.google.com/p/chromium/issues/detail?id=48733; http://scarybeastsecurity.blogspot.com/2011/02/i-got-accidental-code-execution-via.html; http://secunia.com/advisories/44353
CVE: CVE-2011-0462
Published: 2011-04-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in the login page in the webui component in SUSE openSUSE Build Service (OBS) before 2.1.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://news.opensuse.org/2011/03/02/build-service-team-releases-new-versions-fixing-security-problems/; https://bugzilla.novell.com/show_bug.cgi?id=669909; http://news.opensuse.org/2011/03/02/build-service-team-releases-new-versions-fixing-security-problems/
CVE: CVE-2011-0463
Published: 2011-04-10
Description: The ocfs2_prepare_page_for_write function in fs/ocfs2/aops.c in the Oracle Cluster File System 2 (OCFS2) subsystem in the Linux kernel before 2.6.39-rc1 does not properly handle holes that cross page boundaries, which allows local users to obtain potentially sensitive information from uninitialized disk locations by reading a file.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=272b62c1f0f6f742046e45b50b6fec98860208a0; http://oss.oracle.com/pipermail/ocfs2-devel/2011-February/007846.html; http://secunia.com/advisories/43966
CVE: CVE-2011-0466
Published: 2011-04-10
Description: The API in SUSE openSUSE Build Service (OBS) 2.0.x before 2.0.8 and 2.1.x before 2.1.6 allows attackers to bypass intended write-access restrictions and modify a (1) package or (2) project via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://news.opensuse.org/2011/03/02/build-service-team-releases-new-versions-fixing-security-problems/; http://news.opensuse.org/2011/03/02/build-service-team-releases-new-versions-fixing-security-problems/
CVE: CVE-2011-1163
Published: 2011-04-10
Description: The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://downloads.avaya.com/css/P8/documents/100145416; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1eafbfeb7bdf59cfe173304c76188f3fd5f1fd05; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
CVE: CVE-2011-1660
Published: 2011-04-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in the DataDynamics.Reports.Web class library in GrapeCity Data Dynamics Reports before 1.6.2084.14 allow remote attackers to inject arbitrary web script or HTML via (1) the reportName or (2) uniqueId parameter to CoreViewerInit.js, or the (3) uniqueId or (4) traceLevel parameter to CoreController.js, as reachable by CoreHandler.ashx.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/43953; http://securityreason.com/securityalert/8190; http://www.gcpowertools.com/DownloadLatestVersion
CVE: CVE-2011-1661
Published: 2011-04-10
Description: The Node Quick Find module 6.x-1.1 for Drupal does not use db_rewrite_sql when presenting node titles, which allows remote attackers to bypass intended access restrictions and read potentially sensitive node titles via the autocomplete feature.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/files/issues/db_rewrite_sql_12.patch; http://drupal.org/node/1080114; http://drupal.org/node/1118408
CVE: CVE-2011-1662
Published: 2011-04-10
Description: Cross-site scripting (XSS) vulnerability in Translation Management module 6.x before 6.x-1.21 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1111174; http://secunia.com/advisories/43950; http://www.securityfocus.com/bid/47098
CVE: CVE-2011-1663
Published: 2011-04-10
Description: SQL injection vulnerability in the Translation Management module 6.x before 6.x-1.21 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/1111174; http://secunia.com/advisories/43950; http://www.securityfocus.com/bid/47098
CVE: CVE-2011-1664
Published: 2011-04-10
Description: Cross-site request forgery (CSRF) vulnerability in the Translation Management module 6.x before 6.x-1.21 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1111174; http://secunia.com/advisories/43950; https://exchange.xforce.ibmcloud.com/vulnerabilities/66477
CVE: CVE-2011-1665
Published: 2011-04-10
Description: PHPBoost 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain backup SQL files via a direct request for predictable filenames in cache/backup/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/43949; http://www.exploit-db.com/exploits/17085; https://exchange.xforce.ibmcloud.com/vulnerabilities/66474
CVE: CVE-2011-1666
Published: 2011-04-10
Description: Metaways Tine 2.0 allows remote attackers to obtain sensitive information via unknown vectors in (1) Crm/Controller.php, (2) Crm/Export/Csv.php, or (3) Calendar/Model/Attender.php, which reveal the full installation path.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://securityreason.com/securityalert/8191; http://www.htbridge.ch/advisory/path_disclosure_in_tine_2_0.html; http://www.securityfocus.com/archive/1/517269/100/0/threaded
CVE: CVE-2011-1667
Published: 2011-04-10
Description: SQL injection vulnerability in index.php in Anzeigenmarkt 2011 allows remote attackers to execute arbitrary SQL commands via the q parameter in a list action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/71463; http://packetstormsecurity.org/files/view/100006/anzeigenmarkt-sql.txt; http://secunia.com/advisories/44005
CVE: CVE-2011-1668
Published: 2011-04-10
Description: Cross-site scripting (XSS) vulnerability in search.php in AR Web Content Manager (AWCM) 2.1, 2.2, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secpod.org/advisories/SECPOD_AWCM_XSS.txt; http://securityreason.com/securityalert/8193; http://www.securityfocus.com/archive/1/517294/100/0/threaded
CVE: CVE-2011-1669
Published: 2011-04-10
Description: Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F (encoded dot dot) sequences in the url parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/71707; http://secunia.com/advisories/43963; http://www.autosectools.com/Advisories/WordPress.WP.Custom.Pages.0.5.0.1_Local.File.Inclusion_169.html
CVE: CVE-2011-1670
Published: 2011-04-10
Description: Cross-site scripting (XSS) vulnerability in actions/add.php in InTerra Blog Machine 1.84, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the subject parameter to post_url/edit.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/8195; http://www.exploit-db.com/exploits/17098; http://www.htbridge.ch/advisory/xss_vulnerability_in_interra_blog_machine.html
CVE: CVE-2011-1671
Published: 2011-04-10
Description: Cross-site scripting (XSS) vulnerability in app/controllers/todos_controller.rb in Tracks 1.7.2, 2.0RC2, and 2.0devel allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to todos/tag/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/71352; http://secunia.com/advisories/43909; http://securityreason.com/securityalert/8196
CVE: CVE-2011-0765
Published: 2011-04-10
Description: Unspecified vulnerability in lft in pWhois Layer Four Traceroute (LFT) 3.x before 3.3 allows local users to gain privileges via a crafted command line.
CVSS Score: 7.2 (HIGH)
References: http://pwhois.org/lft/; http://www.kb.cert.org/vuls/id/946652; http://www.securityfocus.com/bid/46477
CVE: CVE-2011-0994
Published: 2011-04-10
Description: Stack-based buffer overflow in NFRAgent.exe in Novell File Reporter (NFR) before 1.0.2 allows remote attackers to execute arbitrary code via unspecified XML data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=rCAgCcbPH9s~; http://secunia.com/advisories/43975; http://securityreason.com/securityalert/8194
CVE: CVE-2011-1089
Published: 2011-04-10
Description: The addmntent function in the GNU C Library (aka glibc or libc6) 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it easier for local users to trigger corruption of this file, as demonstrated by writes from a process with a small RLIMIT_FSIZE value, a different vulnerability than CVE-2010-0296.
CVSS Score: 3.3 (LOW)
CWE: CWE-16
References: http://openwall.com/lists/oss-security/2011/03/04/10; http://openwall.com/lists/oss-security/2011/03/04/11; http://openwall.com/lists/oss-security/2011/03/04/12
CVE: CVE-2011-1095
Published: 2011-04-10
Description: locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted localization environment variable, in conjunction with a program that executes a script that uses the eval function.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://bugs.gentoo.org/show_bug.cgi?id=330923; http://openwall.com/lists/oss-security/2011/03/08/21; http://openwall.com/lists/oss-security/2011/03/08/22
CVE: CVE-2011-1672
Published: 2011-04-10
Description: The Dell KACE K2000 Systems Deployment Appliance 3.3.36822 and earlier contains a peinst CIFS share, which allows remote attackers to obtain sensitive information by reading the (1) unattend.xml or (2) sysprep.inf file, as demonstrated by reading a password.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kace.com/support/kb/index.php?action=artikel&cat=1&id=1104; http://www.kb.cert.org/vuls/id/598700; http://www.securityfocus.com/bid/47172
CVE: CVE-2011-1673
Published: 2011-04-10
Description: BackupConfig.php on the NetGear ProSafe WNAP210 allows remote attackers to obtain the administrator password by reading the configuration file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/44045; http://www.kb.cert.org/vuls/id/644812; http://www.vupen.com/english/advisories/2011/0884