deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5887
Published: 2012-11-17
Description: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html; http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
CVE: CVE-2012-5888
Published: 2012-11-17
Description: Cross-site scripting (XSS) vulnerability in Basic SEO Features (seo_basics) extension before 0.8.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forge.typo3.org/issues/35532; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-006/; http://www.securityfocus.com/bid/52772
CVE: CVE-2012-5889
Published: 2012-11-17
Description: Cross-site scripting (XSS) vulnerability in the powermail extension before 1.6.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-004/; https://exchange.xforce.ibmcloud.com/vulnerabilities/74461; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-004/
CVE: CVE-2012-5890
Published: 2012-11-17
Description: The Front End User Registration (sr_feuser_register) extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passwords via the (1) edit perspective or (2) autologin feature.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://forge.typo3.org/projects/extension-sr_feuser_register/repository/entry/trunk/ChangeLog; http://forge.typo3.org/projects/extension-sr_feuser_register/repository/revisions/58720; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-002/
CVE: CVE-2012-5891
Published: 2012-11-17
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an add action, (2) change user passwords via a change action, or (3) delete a user via a delete action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/80745; http://packetstormsecurity.org/files/111402/Dalbum-144-Build-174-Cross-Site-Request-Forgery.html; http://www.exploit-db.com/exploits/18685
CVE: CVE-2012-5892
Published: 2012-11-17
Description: Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the configuration database via a direct request for data/havalite.db3.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80770; http://packetstormsecurity.org/files/111358/Havalite-CMS-Shell-Upload-SQL-Injection-Disclosure.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/74488
CVE: CVE-2012-5893
Published: 2012-11-17
Description: Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading a file with a .php;.gif extension, then accessing it via a direct request to the file in tmp/files/.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/80768; http://packetstormsecurity.org/files/111358/Havalite-CMS-Shell-Upload-SQL-Injection-Disclosure.html; http://secunia.com/advisories/48646
CVE: CVE-2012-5894
Published: 2012-11-17
Description: SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the postId parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/80769; http://packetstormsecurity.org/files/111358/Havalite-CMS-Shell-Upload-SQL-Injection-Disclosure.html; http://secunia.com/advisories/48646
CVE: CVE-2012-5895
Published: 2012-11-17
Description: Multiple unspecified vulnerabilities in iRODS before 3.1 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/48600; http://www.securityfocus.com/bid/52827; https://exchange.xforce.ibmcloud.com/vulnerabilities/74493
CVE: CVE-2012-5896
Published: 2012-11-17
Description: The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Add method, which allows remote attackers to execute arbitrary code via a memory address in the first argument, related to an "uninitialized pointer."
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0153.html; http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/intrust_annotatex_add.rb; http://osvdb.org/80662
CVE: CVE-2012-5897
Published: 2012-11-17
Description: The (1) SimpleTree and (2) ReportTree classes in the ARDoc ActiveX control (ARDoc.dll) in Quest InTrust 10.4.0.853 and earlier do not properly implement the SaveToFile method, which allows remote attackers to write or overwrite arbitrary files via the bstrFileName argument.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0155.html; http://osvdb.org/80664; http://secunia.com/advisories/48566
CVE: CVE-2012-5898
Published: 2012-11-17
Description: Cross-site request forgery (CSRF) vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administrators for requests that change account settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/80800; http://packetstormsecurity.org/files/111415/Landshop-0.9.2-Cross-Site-Scripting-SQL-Injection.html; http://secunia.com/advisories/48661
CVE: CVE-2012-5899
Published: 2012-11-17
Description: Cross-site scripting (XSS) vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers to inject arbitrary web script or HTML via the OTR_HEADS[] parameter in an edit action. NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/111415/Landshop-0.9.2-Cross-Site-Scripting-SQL-Injection.html; http://secunia.com/advisories/48661; http://vulnerability-lab.com/get_content.php?id=485