deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-4960
Published: 2011-10-09
Description: Cross-site scripting (XSS) vulnerability in the Branchenbuch (aka Yellow Pages or mh_branchenbuch) extension before 0.9.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/67032; http://secunia.com/advisories/40951; http://typo3.org/extensions/repository/view/mh_branchenbuch/0.9.1/
CVE: CVE-2010-4961
Published: 2011-10-09
Description: SQL injection vulnerability in the Webkit PDFs (webkitpdf) extension before 1.1.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/webkitpdf/1.1.4; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-015/; http://www.securityfocus.com/bid/42381
CVE: CVE-2010-4962
Published: 2011-10-09
Description: Unspecified vulnerability in the Webkit PDFs (webkitpdf) extension before 1.1.4 for TYPO3 allows remote attackers to execute arbitrary commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://typo3.org/extensions/repository/view/webkitpdf/1.1.4/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-015/; http://www.securityfocus.com/bid/42381
CVE: CVE-2010-4963
Published: 2011-10-09
Description: SQL injection vulnerability in folder/list in Hulihan BXR 0.6.8 allows remote attackers to execute arbitrary SQL commands via the order_by parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://dev.hulihanapplications.com/issues/show/203; http://packetstormsecurity.org/1008-exploits/bxr-sqlxssxsrf.txt; http://secunia.com/advisories/40875
CVE: CVE-2011-2189
Published: 2011-10-10
Description: net/core/net_namespace.c in the Linux kernel 2.6.32 and earlier does not properly handle a high rate of creation and cleanup of network namespaces, which makes it easier for remote attackers to cause a denial of service (memory consumption) via requests to a daemon that requires a separate namespace per connection, as demonstrated by vsftpd.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629373; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2b035b[PII_REDACTED]2598f7a9d548835f9bdd730f; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f875bae[PII_REDACTED]96da12523f9df85c89f5712
CVE: CVE-2011-2675
Published: 2011-10-10
Description: Cross-site scripting (XSS) vulnerability in Enkai-kun before 110916 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN03869266/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000077; http://secunia.com/advisories/46314
CVE: CVE-2011-3323
Published: 2011-10-10
Description: The OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (out-of-bounds memory access and daemon crash) via a Link State Update message with an invalid IPv6 prefix length.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://code.quagga.net/?p=quagga.git%3Ba=commit%3Bh=abc7ef44ca[PII_REDACTED]5ce81f7b84f5c4eb6594; http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00007.html
CVE: CVE-2011-3324
Published: 2011-10-10
Description: The ospf6_lsa_is_changed function in ospf6_lsa.c in the OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via trailing zero values in the Link State Advertisement (LSA) header list of an IPv6 Database Description message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://code.quagga.net/?p=quagga.git%3Ba=commit%3Bh=09395e2a0e93b2cf4258cb1de[PII_REDACTED]6bb68; http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00007.html
CVE: CVE-2011-3325
Published: 2011-10-10
Description: ospf_packet.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) via (1) a 0x0a type field in an IPv4 packet header or (2) a truncated IPv4 Hello packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://code.quagga.net/?p=quagga.git%3Ba=commit%3Bh=61ab[PII_REDACTED]192f45c188bc48afc837518770; http://code.quagga.net/?p=quagga.git%3Ba=commit%3Bh=[PII_REDACTED]39762d23a5f8d88fe0b4d57c8d490a; http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00027.html
CVE: CVE-2011-3326
Published: 2011-10-10
Description: The ospf_flood function in ospf_flood.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) via an invalid Link State Advertisement (LSA) type in an IPv4 Link State Update message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://code.quagga.net/?p=quagga.git%3Ba=commit%3Bh=6b161fc12a15aba8824c84d1eb38e529aaf70769; http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00007.html
CVE: CVE-2011-3327
Published: 2011-10-10
Description: Heap-based buffer overflow in the ecommunity_ecom2str function in bgp_ecommunity.c in bgpd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by sending a crafted BGP UPDATE message over IPv4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.quagga.net/?p=quagga.git%3Ba=commit%3Bh=94431dbc753171b48b5c6806af97fd690813b00a; http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00007.html
CVE: CVE-2011-3587
Published: 2011-10-10
Description: Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.
CVSS Score: 9.3 (HIGH)
References: http://plone.org/products/plone-hotfix/releases/20110928; http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zip; http://plone.org/products/plone/security/advisories/20110928
CVE: CVE-2011-3599
Published: 2011-10-10
Description: The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://osvdb.org/76025; http://secunia.com/advisories/46275; http://www.openwall.com/lists/oss-security/2011/10/05/5
CVE: CVE-2011-4030
Published: 2011-10-10
Description: The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://plone.org/products/plone-hotfix/releases/20110928; http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zip; http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0
CVE: CVE-2011-1247
Published: 2011-10-12
Description: Untrusted search path vulnerability in the Microsoft Active Accessibility component in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Active Accessibility Insecure Library Loading Vulnerability."
CVSS Score: 9.3 (HIGH)
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-075; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13116; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-075
CVE: CVE-2011-1253
Published: 2011-10-12
Description: Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.0.60831, does not properly restrict inheritance, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, (3) a crafted .NET Framework application, or (4) a crafted Silverlight application, aka ".NET Framework Class Inheritance Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-078; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13069; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-078
CVE: CVE-2011-1895
Published: 2011-10-12
Description: CRLF injection vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting (XSS) attacks, via unspecified vectors, aka "ExcelTable Response Splitting XSS Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/76235; http://www.securityfocus.com/bid/49979; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-079
CVE: CVE-2011-1896
Published: 2011-10-12
Description: Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "ExcelTable Reflected XSS Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/76233; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-079; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12197
CVE: CVE-2011-1897
Published: 2011-10-12
Description: Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Default Reflected XSS Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-079; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13039; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-079
CVE: CVE-2011-1969
Published: 2011-10-12
Description: Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 provides the MicrosoftClient.jar file containing a signed Java applet, which allows remote attackers to execute arbitrary code on client machines via unspecified vectors, aka "Poisoned Cup of Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/49983; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-079; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13032
CVE: CVE-2011-1985
Published: 2011-10-12
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a crafted application, aka "Win32k Null Pointer De-reference Vulnerability."
CVSS Score: 7.1 (HIGH)
CWE: CWE-476
References: http://www.securitytracker.com/id?1026165; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-077; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12935
CVE: CVE-2011-1993
Published: 2011-10-12
Description: Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Scroll Event Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12705; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-081
CVE: CVE-2011-1995
Published: 2011-10-12
Description: Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that was not properly initialized, aka "OLEAuto32.dll Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-908
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12838; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-081
CVE: CVE-2011-1996
Published: 2011-10-12
Description: Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Option Element Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12896; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-081
CVE: CVE-2011-1997
Published: 2011-10-12
Description: Microsoft Internet Explorer 6 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnLoad Event Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13204; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-081
CVE: CVE-2011-1998
Published: 2011-10-12
Description: Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that was not properly initialized, aka "Jscript9.dll Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-908
References: http://www.securityfocus.com/bid/49963; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13199
CVE: CVE-2011-1999
Published: 2011-10-12
Description: Microsoft Internet Explorer 8 does not properly allocate and access memory, which allows remote attackers to execute arbitrary code via vectors involving a "dereferenced memory address," aka "Select Element Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.securityfocus.com/bid/49964; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12697
CVE: CVE-2011-2000
Published: 2011-10-12
Description: Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Body Element Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13083; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-081
CVE: CVE-2011-2001
Published: 2011-10-12
Description: Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an attempted access to a virtual function table after corruption of this table has occurred, aka "Virtual Function Table Corruption Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.securityfocus.com/bid/49966; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12223
CVE: CVE-2011-2002
Published: 2011-10-12
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle TrueType fonts, which allows local users to cause a denial of service (system hang) via a crafted font file, aka "Win32k TrueType Font Type Translation Vulnerability."
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/49973; http://www.securitytracker.com/id?1026165; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-077
CVE: CVE-2011-2003
Published: 2011-10-12
Description: Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted .fon file, aka "Font Library File Buffer Overrun Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/8473; http://www.securitytracker.com/id?1026165; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-077
CVE: CVE-2011-2005
Published: 2011-10-12
Description: afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-080; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13114; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-080
CVE: CVE-2011-2007
Published: 2011-10-12
Description: Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server service outage) via crafted TCP or UDP traffic, aka "Endless Loop DoS in snabase.exe Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-082; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13040; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-082
CVE: CVE-2011-2008
Published: 2011-10-12
Description: Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server service outage) via crafted TCP or UDP traffic, aka "Access of Unallocated Memory DoS Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-082; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12915; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-082
CVE: CVE-2011-2009
Published: 2011-10-12
Description: Untrusted search path vulnerability in Windows Media Center in Microsoft Windows Vista SP2 and Windows 7 Gold and SP1, and Windows Media Center TV Pack for Windows Vista, allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Media Center Insecure Library Loading Vulnerability."
CVSS Score: 9.3 (HIGH)
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-076; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12934; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-076
CVE: CVE-2011-2011
Published: 2011-10-12
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, aka "Win32k Use After Free Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/49981; http://www.securitytracker.com/id?1026165; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-077
CVE: CVE-2011-2012
Published: 2011-10-12
Description: Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 does not properly validate session cookies, which allows remote attackers to cause a denial of service (IIS outage) via unspecified network traffic, aka "Null Session Cookie Crash."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/49980; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-079; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12799
CVE: CVE-2011-3155
Published: 2011-10-12
Description: Unspecified vulnerability in HP Onboard Administrator (OA) 3.21 through 3.31 allows remote attackers to bypass intended access restrictions via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8182&w=2; http://securityreason.com/securityalert/8471; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8182&w=2
CVE: CVE-2011-0259
Published: 2011-10-12
Description: CoreFoundation, as used in Apple iTunes before 10.5, does not properly perform string tokenization, which allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
CVE: CVE-2011-2338
Published: 2011-10-12
Description: WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html
CVE: CVE-2011-2339
Published: 2011-10-12
Description: WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html