deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-4478
Published: 2012-11-30
Description: Cross-site request forgery (CSRF) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1679442; http://www.openwall.com/lists/oss-security/2012/10/04/5; http://drupal.org/node/1679442
CVE: CVE-2012-4479
Published: 2012-11-30
Description: SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/1679442; http://www.openwall.com/lists/oss-security/2012/10/04/5; http://drupal.org/node/1679442
CVE: CVE-2012-4551
Published: 2012-11-30
Description: Use-after-free vulnerability in libunity-webapps before 2.4.1 allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted web site, related to "certain hash tables."
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://bazaar.launchpad.net/~webapps/libunity-webapps/trunk/revision/815; http://www.openwall.com/lists/oss-security/2012/10/29/3; http://www.securityfocus.com/bid/56314
CVE: CVE-2012-4559
Published: 2012-11-30
Description: Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in channels.c, (3) ssh_userauth_pubkey function in auth.c, (4) sftp_parse_attr_3 function in sftp.c, and (5) try_publickey_from_file function in keyfiles.c in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093313.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093474.html; http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00002.html
CVE: CVE-2012-4560
Published: 2012-11-30
Description: Multiple buffer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093313.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093474.html; http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00002.html
CVE: CVE-2012-4561
Published: 2012-11-30
Description: The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys.c in libssh before 0.5.3 free "an invalid pointer on an error path," which might allow remote attackers to cause a denial of service (crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093313.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093474.html; http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00002.html
CVE: CVE-2012-4562
Published: 2012-11-30
Description: Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors, which triggers a buffer overflow, infinite loop, or possibly some other unspecified vulnerabilities.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093313.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093474.html; http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00015.html
CVE: CVE-2012-4571
Published: 2012-11-30
Description: Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://pypi.python.org/pypi/keyring; http://www.openwall.com/lists/oss-security/2012/10/31/8; http://www.ubuntu.com/usn/USN-1634-1
CVE: CVE-2012-6063
Published: 2012-11-30
Description: Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors, a different vector than CVE-2012-4559.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://git.libssh.org/projects/libssh.git/commit/?h=v0-5&id=4d8420f3282ed07fc99fc5e930c17df27ef1e9b2; http://www.debian.org/security/2012/dsa-2577; http://www.libssh.org/2012/11/20/libssh-0-5-3-security-release/
CVE: CVE-2012-5579
Published: 2012-12-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-5611.  Reason: This candidate is a duplicate of CVE-2012-5611.  Notes: All CVE users should reference CVE-2012-5611 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-5611
Published: 2012-12-03
Description: Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00002.html
CVE: CVE-2012-5612
Published: 2012-12-03
Description: Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html; http://seclists.org/fulldisclosure/2012/Dec/5; http://secunia.com/advisories/53372
CVE: CVE-2012-5613
Published: 2012-12-03
Description: MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-16
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html; http://seclists.org/fulldisclosure/2012/Dec/6; http://secunia.com/advisories/53372
CVE: CVE-2012-5614
Published: 2012-12-03
Description: Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.
CVSS Score: 4.0 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2013-0772.html; http://seclists.org/fulldisclosure/2012/Dec/7; http://secunia.com/advisories/53372
CVE: CVE-2012-5615
Published: 2012-12-03
Description: Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html; http://seclists.org/fulldisclosure/2012/Dec/9
CVE: CVE-2012-0218
Published: 2012-12-03
Description: Xen 3.4, 4.0, and 4.1, when the guest OS has not registered a handler for a syscall or sysenter instruction, does not properly clear a flag for exception injection when injecting a General Protection Fault, which allows local PV guest OS users to cause a denial of service (guest crash) by later triggering an exception that would normally be handled within Xen.
CVSS Score: 1.9 (LOW)
References: http://lists.xen.org/archives/html/xen-announce/2012-06/msg00003.html; http://secunia.com/advisories/55082; http://security.gentoo.org/glsa/glsa-201309-24.xml
CVE: CVE-2012-1598
Published: 2012-12-03
Description: Joomla! 1.5.x before 1.5.26 has unspecified impact and attack vectors related to "insufficient randomness" and a "password reset vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://developer.joomla.org/security/news/[PII_REDACTED]5-core-password-change.html; http://www.openwall.com/lists/oss-security/2012/03/29/5; http://www.openwall.com/lists/oss-security/2012/08/27/6
CVE: CVE-2012-1599
Published: 2012-12-03
Description: Joomla! 1.5.x before 1.5.26 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end information" via unknown vectors.  NOTE: this might be a duplicate of CVE-2012-1611.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://developer.joomla.org/security/news/[PII_REDACTED]6-core-information-disclosure.html; http://www.openwall.com/lists/oss-security/2012/03/29/5; http://developer.joomla.org/security/news/[PII_REDACTED]6-core-information-disclosure.html
CVE: CVE-2012-2934
Published: 2012-12-03
Description: Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not properly protect against a certain AMD processor bug, which allows local guest OS users to cause a denial of service (host hang) via sequential execution of instructions across a non-canonical boundary, a different vulnerability than CVE-2012-0217.
CVSS Score: 1.9 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html; http://lists.xen.org/archives/html/xen-announce/2012-06/msg00002.html
CVE: CVE-2012-3432
Published: 2012-12-03
Description: The handle_mmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service (guest OS crash) via unspecified operations on MMIO regions.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html
CVE: CVE-2012-5367
Published: 2012-12-03
Description: Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField parameter to (1) viewCustomers, (2) viewPayGrades, or (3) viewSystemUsers in symfony/web/index.php/admin/, as demonstrated using cross-site request forgery (CSRF) attacks.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0029.html; http://osvdb.org/86858; http://packetstormsecurity.org/files/117925/OrangeHRM-2.7.1-rc.1-Cross-Site-Request-Forgery-SQL-Injection.html
CVE: CVE-2012-5450
Published: 2012-12-03
Description: Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html; http://forum.cmsmadesimple.org/viewtopic.php?f=1&t=63545; http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html
CVE: CVE-2012-5534
Published: 2012-12-03
Description: The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://git.savannah.gnu.org/gitweb/?p=weechat.git%3Ba=commitdiff_plain%3Bh=efb795c74fe954b9544074aafcebb1be4452b03a; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093260.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093495.html
CVE: CVE-2012-5537
Published: 2012-12-03
Description: The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://drupal.org/node/1789274; http://drupal.org/node/1789284; http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE: CVE-2012-5538
Published: 2012-12-03
Description: Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has "Reference existing" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1789300; http://drupal.org/node/1789302; http://drupal.org/node/1789306
CVE: CVE-2012-5539
Published: 2012-12-03
Description: The Organic Groups (OG) module 7.x-1.x before 7.x-1.5 for Drupal does not properly maintain pending group memberships, which allows remote authenticated users to post to arbitrary groups by modifying their own account while a pending membership is waiting to be approved.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://drupal.org/node/1795906; http://drupal.org/node/1796036; http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE: CVE-2012-5540
Published: 2012-12-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Hostip module 6.x-2.x before 6.x-2.2 and 7.x-2.x before 7.x-2.2 for Drupal allow remote attackers with control of hostip.info to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1802046; http://drupal.org/node/1802048; http://drupal.org/node/1802218
CVE: CVE-2012-5541
Published: 2012-12-03
Description: Cross-site scripting (XSS) vulnerability in the Twitter Pull module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.0-rc3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "data coming from Twitter."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1801442; http://drupal.org/node/1801444; http://drupal.org/node/1802230
CVE: CVE-2012-5542
Published: 2012-12-03
Description: Cross-site request forgery (CSRF) vulnerability in the Commerce Extra Panes module 7.x-1.x before 7.x-1.1 in Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable a Commerce extra panes pane via unspecified vectors related to "the link to reorder items."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1802192; http://drupal.org/node/1802258; http://osvdb.org/85892
CVE: CVE-2012-5543
Published: 2012-12-03
Description: The Feeds module 7.x-2.x before 7.x-2.0-alpha6 for Drupal, when a field is mapped to the node's author, does not properly check permissions, which allows remote attackers to create arbitrary nodes via a crafted source feed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1808832; http://drupalcode.org/project/feeds.git/commitdiff/a538c20; http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE: CVE-2012-5544
Published: 2012-12-03
Description: The Mandrill module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users to obtain password reset links by reading the logs in the Mandrill dashboard.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://drupal.org/node/1807894; http://drupal.org/node/1808846; http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE: CVE-2012-5545
Published: 2012-12-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in the ShareThis module 7.x-2.x before 7.x-2.5 for Drupal allow remote authenticated users with the "administer sharethis" permission to inject arbitrary web script or HTML via unspecified vectors related to "JavaScript settings."
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1808760; http://drupal.org/node/1808856; http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE: CVE-2012-5547
Published: 2012-12-03
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable a server via a server action or (2) enable a search index via an enable index action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1815124; http://drupal.org/node/1815770; http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE: CVE-2012-5548
Published: 2012-12-03
Description: Cross-site scripting (XSS) vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1822066; http://www.openwall.com/lists/oss-security/2012/11/20/4; http://drupal.org/node/1822066
CVE: CVE-2012-5549
Published: 2012-12-03
Description: Cross-site request forgery (CSRF) vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1822066; http://www.openwall.com/lists/oss-security/2012/11/20/4; http://drupal.org/node/1822066
CVE: CVE-2012-5550
Published: 2012-12-03
Description: SQL injection vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/1822066; http://www.openwall.com/lists/oss-security/2012/11/20/4; http://drupal.org/node/1822066
CVE: CVE-2012-5551
Published: 2012-12-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in the MailChimp module 7.x-2.x before 7.x-2.7 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) a predictable "webhook URL key" and (2) improper sanitization of "Webhook variables from POST requests."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1821330; http://drupal.org/node/1822166; http://www.openwall.com/lists/oss-security/2012/11/20/4
CVE: CVE-2012-5552
Published: 2012-12-03
Description: The Password policy module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to obtain password hashes by sniffing the network, related to "client-side password history checks."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://drupal.org/node/1828130; http://drupal.org/node/1828142; http://drupal.org/node/1828340
CVE: CVE-2012-5553
Published: 2012-12-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in the OM Maximenu module 6.x-1.x before 6.x-1.44 and 7.x-1.x before 7.x-1.44 for Drupal allow remote authenticated users with the "administer OM Maximenu" permission to inject arbitrary web script or HTML via the (1) Menu Title (2) Link Title, (3) Path Query, (4) Anchor, or (5) vocabulary names.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1834046; http://drupal.org/node/1834048; http://drupal.org/node/1834866
CVE: CVE-2012-5554
Published: 2012-12-03
Description: The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://drupal.org/node/1768632; http://drupal.org/node/1774252; http://drupal.org/node/1834868
CVE: CVE-2012-5556
Published: 2012-12-03
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the RESTful Web Services (RESTWS) module 7.x-1.x before 7.x-1.1 and 7.x-2.x before 7.x-2.0-alpha3 for Drupal allow remote attackers to hijack the authentication of arbitrary users via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1840722; http://drupal.org/node/1840728; http://drupal.org/node/1840740
CVE: CVE-2012-5557
Published: 2012-12-03
Description: The User Read-Only module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, does not properly assign roles when there are more than three roles on the site and certain unspecified configurations, which might allow remote authenticated users to gain privileges by performing certain operations, as demonstrated by changing a password.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://drupal.org/node/1840038; http://drupal.org/node/1840054; http://drupal.org/node/1840886
CVE: CVE-2012-5559
Published: 2012-12-03
Description: Cross-site scripting (XSS) vulnerability in the page manager node view task in the Chaos tool suite (ctools) module 6.x-1.x before 6.x-1.10 for Drupal allows remote authenticated users with permissions to submit or edit nodes to inject arbitrary web script or HTML via the page title.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1840992; http://drupal.org/node/1841030; http://secunia.com/advisories/51259
CVE: CVE-2012-5569
Published: 2012-12-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via a (1) page title or (2) crafted email message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1808852; http://www.openwall.com/lists/oss-security/2012/11/20/4; http://www.openwall.com/lists/oss-security/2012/11/27/2
CVE: CVE-2012-5858
Published: 2012-12-03
Description: Samsung Kies Air 2.1.207051 and 2.1.210161 relies on the IP address for authentication, which allows remote man-in-the-middle attackers to read arbitrary phone contents by spoofing or controlling the IP address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0061.html; http://packetstormsecurity.org/files/118154/Kies-Air-Denial-Of-Service-Authorization-Bypass.html; http://www.securityfocus.com/bid/56560
CVE: CVE-2012-5859
Published: 2012-12-03
Description: Samsung Kies Air 2.1.207051 and 2.1.210161 allows remote attackers to cause a denial of service (crash) via a crafted request to www/apps/KiesAir/jws/ssd.php.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0061.html; http://packetstormsecurity.org/files/118154/Kies-Air-Denial-Of-Service-Authorization-Bypass.html; http://www.securityfocus.com/bid/56560