deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-3912
Published: 2011-12-13
Description: Use-after-free vulnerability in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG filters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=102359; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14519
CVE: CVE-2011-3913
Published: 2011-12-13
Description: Use-after-free vulnerability in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to Range handling.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=103921; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3914
Published: 2011-12-13
Description: The internationalization (aka i18n) functionality in Google V8, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://code.google.com/p/chromium/issues/detail?id=104011; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14840
CVE: CVE-2011-3915
Published: 2011-12-13
Description: Buffer overflow in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to PDF fonts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://code.google.com/p/chromium/issues/detail?id=104529; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14569
CVE: CVE-2011-3916
Published: 2011-12-13
Description: Google Chrome before 16.0.912.63 does not properly handle PDF cross references, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=104959; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14315
CVE: CVE-2011-3917
Published: 2011-12-13
Description: Stack-based buffer overflow in FileWatcher in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://code.google.com/p/chromium/issues/detail?id=105162; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14847
CVE: CVE-2011-1508
Published: 2011-12-14
Description: Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, does not properly manage memory allocations for function pointers, which allows user-assisted remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Function Pointer Overwrite Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-091; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14816; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-091
CVE: CVE-2011-1983
Published: 2011-12-14
Description: Use-after-free vulnerability in Microsoft Office 2007 SP2 and SP3, Office 2010 Gold and SP1, and Office for Mac 2011 allows remote attackers to execute arbitrary code via a crafted Word document, aka "Word Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securitytracker.com/id?1026409; http://www.us-cert.gov/cas/techalerts/TA11-347A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-089
CVE: CVE-2011-1992
Published: 2011-12-14
Description: The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to read content from a different (1) domain or (2) zone via a "trial and error" attack, aka "XSS Filter Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.us-cert.gov/cas/techalerts/TA11-347A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-099; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14745
CVE: CVE-2011-2010
Published: 2011-12-14
Description: The Microsoft Office Input Method Editor (IME) for Simplified Chinese in Microsoft Pinyin IME 2010, Office Pinyin SimpleFast Style 2010, and Office Pinyin New Experience Style 2010 does not properly restrict access to configuration options, which allows local users to gain privileges via the Microsoft Pinyin (aka MSPY) IME toolbar, aka "Pinyin IME Elevation Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.us-cert.gov/cas/techalerts/TA11-347A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-088; http://www.us-cert.gov/cas/techalerts/TA11-347A.html
CVE: CVE-2011-2018
Published: 2011-12-14
Description: The kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, and Windows 7 Gold and SP1 does not properly initialize objects, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Exception Handler Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.us-cert.gov/cas/techalerts/TA11-347A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-098; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14635
CVE: CVE-2011-2019
Published: 2011-12-14
Description: Untrusted search path vulnerability in Microsoft Internet Explorer 9 on Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains an HTML file, aka "Internet Explorer Insecure Library Loading Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-426
References: http://www.us-cert.gov/cas/techalerts/TA11-347A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-099; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13884
CVE: CVE-2011-3396
Published: 2011-12-14
Description: Untrusted search path vulnerability in Microsoft PowerPoint 2007 SP2 and 2010 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "PowerPoint Insecure Library Loading Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.us-cert.gov/cas/techalerts/TA11-347A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-094; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14665
CVE: CVE-2011-3397
Published: 2011-12-14
Description: The Microsoft Time component in DATIME.DLL in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted web site that leverages an unspecified "binary behavior" in Internet Explorer, aka "Microsoft Time Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA11-347A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-090; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14735
CVE: CVE-2011-3400
Published: 2011-12-14
Description: Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 do not properly handle OLE objects in memory, which allows remote attackers to execute arbitrary code via a crafted object in a file, aka "OLE Property Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA11-347A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-093; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14668
CVE: CVE-2011-3401
Published: 2011-12-14
Description: ENCDEC.DLL in Windows Media Player and Media Center in Microsoft Windows XP SP2 and SP3, Windows Vista SP2, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted .dvr-ms file, aka "Windows Media Player DVR-MS Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA11-347A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-092; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14281
CVE: CVE-2011-3403
Published: 2011-12-14
Description: Microsoft Excel 2003 SP3 and Office 2004 for Mac do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a crafted Excel spreadsheet, aka "Record Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA11-347A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-096; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14702
CVE: CVE-2011-3404
Published: 2011-12-14
Description: Microsoft Internet Explorer 6 through 9 does not properly use the Content-Disposition HTTP header to control rendering of the HTTP response body, which allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Content-Disposition Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-099; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14614; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-099
CVE: CVE-2011-3406
Published: 2011-12-14
Description: Buffer overflow in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote authenticated users to execute arbitrary code via a crafted query that leverages incorrect memory initialization, aka "Active Directory Buffer Overflow Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-125
References: http://www.us-cert.gov/cas/techalerts/TA11-347A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-095; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14037
CVE: CVE-2011-3408
Published: 2011-12-14
Description: Csrsrv.dll in the Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly check permissions for sending inter-process device-event messages from low-integrity processes to high-integrity processes, which allows local users to gain privileges via a crafted application, aka "CSRSS Local Privilege Elevation Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.us-cert.gov/cas/techalerts/TA11-347A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-097; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14598
CVE: CVE-2011-3410
Published: 2011-12-14
Description: Array index error in Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect handling of values in memory, aka "Publisher Out-of-bounds Array Index Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/361441; http://www.securitytracker.com/id?1026414; http://www.us-cert.gov/cas/techalerts/TA11-347A.html
CVE: CVE-2011-3411
Published: 2011-12-14
Description: Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect handling of values in memory, aka "Publisher Invalid Pointer Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.kb.cert.org/vuls/id/361441; http://www.securitytracker.com/id?1026414; http://www.us-cert.gov/cas/techalerts/TA11-347A.html
CVE: CVE-2011-3412
Published: 2011-12-14
Description: Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect memory handling, aka "Publisher Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.kb.cert.org/vuls/id/361441; http://www.securitytracker.com/id?1026414; http://www.us-cert.gov/cas/techalerts/TA11-347A.html
CVE: CVE-2011-3413
Published: 2011-12-14
Description: Microsoft PowerPoint 2007 SP2; Office 2008 for Mac; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; and PowerPoint Viewer 2007 SP2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an invalid OfficeArt record in a PowerPoint document, aka "OfficeArt Shape RCE Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA11-347A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-094; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14581
CVE: CVE-2011-4800
Published: 2011-12-14
Description: Directory traversal vulnerability in Serv-U FTP Server before 11.1.0.5 allows remote authenticated users to read and write arbitrary files, and list and create arbitrary directories, via a "..:/" (dot dot colon forward slash) in the (1) list, (2) put, or (3) get commands.
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0454.html; http://secunia.com/advisories/47021; http://www.exploit-db.com/exploits/18182
CVE: CVE-2011-4801
Published: 2011-12-14
Description: SQL injection vulnerability in akeyActivationLogin.do in Authenex Web Management Control in Authenex Strong Authentication System (ASAS) Server 3.1.0.2 and 3.1.0.3 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18117; http://www.foregroundsecurity.com/security-advisories/101-authenex-a-keyasas-web-management-control-3102-time-based-sql-injection; https://support.authenex.com/index.php?/Knowledgebase/Article/View/124/0/asas3103update2
CVE: CVE-2011-4802
Published: 2011-12-14
Description: Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b) user/group/index.php; the id parameter to (4) info.php, (5) perms.php, (6) param_ihm.php, (7) note.php, and (8) fiche.php in user/; and (9) rowid parameter to admin/boxes.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/77340; http://osvdb.org/77341; http://osvdb.org/77342
CVE: CVE-2011-4803
Published: 2011-12-14
Description: SQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18039; http://www.exploit-db.com/exploits/18039
CVE: CVE-2011-4804
Published: 2011-12-14
Description: Directory traversal vulnerability in the obSuggest (com_obsuggest) component before 1.8 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://foobla.com/news/latest/obsuggest-1.8-security-release.html; http://secunia.com/advisories/46844; http://www.securityfocus.com/bid/48944
CVE: CVE-2011-4805
Published: 2011-12-14
Description: Cross-site scripting (XSS) vulnerability in pubDBLogon.jsp in SAP Crystal Report Server 2008 allows remote attackers to inject arbitrary web script or HTML via the service parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dsecrg.com/pages/vul/show.php?id=333; http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a; http://www.securityfocus.com/archive/1/520560/100/0/threaded
CVE: CVE-2011-4806
Published: 2011-12-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in main.php in phpAlbum 0.4.1.16 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) var1 and (2) keyword parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/18045; http://www.exploit-db.com/exploits/18045
CVE: CVE-2011-4807
Published: 2011-12-14
Description: Directory traversal vulnerability in main.php in phpAlbum 0.4.1.16 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the var1 parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/18045; http://www.exploit-db.com/exploits/18045
CVE: CVE-2011-4808
Published: 2011-12-14
Description: SQL injection vulnerability in the HM Community (com_hmcommunity) component before 1.01 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a fnd_home action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://joomlaextensions.co.in/index.php?option=com_jeshop&view=category_detail&Itemid=118&id=38; http://secunia.com/advisories/46656; http://www.exploit-db.com/exploits/18050
CVE: CVE-2011-4809
Published: 2011-12-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in the HM Community (com_hmcommunity) component before 1.01 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) language[], (2) university[], (3) persent[], (4) company_name[], (5) designation[], (6) music[], (7) books[], (8) movies[], (9) games[], (10) syp[], (11) ft[], and (12) fa[] parameters in a save task for a profile to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://joomlaextensions.co.in/index.php?option=com_jeshop&view=category_detail&Itemid=118&id=38; http://secunia.com/advisories/46656; http://www.exploit-db.com/exploits/18050
CVE: CVE-2011-4810
Published: 2011-12-14
Description: Multiple directory traversal vulnerabilities in WHMCompleteSolution (WHMCS) 3.x and 4.x allow remote attackers to read arbitrary files via the templatefile parameter to (1) submitticket.php and (2) downloads.php, and (3) the report parameter to admin/reports.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/18088; http://www.exploit-db.com/exploits/18088
CVE: CVE-2011-4811
Published: 2011-12-14
Description: SQL injection vulnerability in pokaz_podkat.php in BestShopPro allows remote attackers to execute arbitrary SQL commands via the str parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18063; http://www.exploit-db.com/exploits/18063
CVE: CVE-2011-4812
Published: 2011-12-14
Description: Cross-site scripting (XSS) vulnerability in nowosci.php in BestShopPro allows remote attackers to inject arbitrary web script or HTML via the str parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/46662; http://www.exploit-db.com/exploits/18063; http://www.osvdb.org/76880
CVE: CVE-2011-4813
Published: 2011-12-14
Description: Directory traversal vulnerability in clientarea.php in WHMCompleteSolution (WHMCS) 3.x.x allows remote attackers to read arbitrary files via an invalid action and a ../ (dot dot slash) in the templatefile parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/18081; http://www.exploit-db.com/exploits/18081
CVE: CVE-2011-4814
Published: 2011-12-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) admin/boxes.php, (3) comm/clients.php, (4) commande/index.php; and the optioncss parameter to (5) admin/ihm.php and (6) user/home.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.osvdb.org/77339; http://www.securityfocus.com/archive/1/520619/100/0/threaded; http://www.securityfocus.com/bid/50777
CVE: CVE-2011-2463
Published: 2011-12-14
Description: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving the cfform tag.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.adobe.com/support/security/bulletins/apsb11-29.html; http://www.securitytracker.com/id?1026405; http://www.adobe.com/support/security/bulletins/apsb11-29.html
CVE: CVE-2011-2741
Published: 2011-12-14
Description: EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly implement Device Recovery and Device Identification, which might allow remote attackers to bypass intended security restrictions on a (1) previously non-registered device or (2) registered device by sending unspecified "data elements."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/520850; http://www.securitytracker.com/id?1026420; http://www.securityfocus.com/archive/1/520850
CVE: CVE-2011-2742
Published: 2011-12-14
Description: EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly perform forensic evaluation upon receipt of device tokens from mobile apps, which might allow remote attackers to bypass intended application restrictions via a mobile device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/520850; http://www.securitytracker.com/id?1026420; http://www.securityfocus.com/archive/1/520850
CVE: CVE-2011-4368
Published: 2011-12-14
Description: Cross-site scripting (XSS) vulnerability in Remote Development Services (RDS) in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.adobe.com/support/security/bulletins/apsb11-29.html; http://www.securitytracker.com/id?1026405; http://www.adobe.com/support/security/bulletins/apsb11-29.html
CVE: CVE-2010-1680
Published: 2011-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2010.  Notes: none
CVE: CVE-2011-4339
Published: 2011-12-15
Description: ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this file.
CVSS Score: 3.6 (LOW)
CWE: CWE-732
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071575.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071580.html; http://openwall.com/lists/oss-security/2011/12/13/1