deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-4881
Published: 2012-04-13
Description: The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 does not properly check return values from functions, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted HTTP request.
CVSS Score: 5.0 (MEDIUM)
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-01.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-01.pdf
CVE: CVE-2011-4882
Published: 2012-04-13
Description: The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 allows remote attackers to cause a denial of service (application exit) via an unspecified command in an HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-01.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-01.pdf
CVE: CVE-2011-4883
Published: 2012-04-13
Description: The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 does not properly validate values in HTTP requests, which allows remote attackers to cause a denial of service (resource consumption) via a crafted request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-01.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-01.pdf
CVE: CVE-2012-1805
Published: 2012-04-13
Description: Buffer overflow in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to execute arbitrary code via long strings in unspecified parameters.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/74875; http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf
CVE: CVE-2012-1806
Published: 2012-04-13
Description: The ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 supports a maximum password length of 8 bytes, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/74876; http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf
CVE: CVE-2012-1807
Published: 2012-04-13
Description: Cross-site scripting (XSS) vulnerability in the web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf
CVE: CVE-2012-1808
Published: 2012-04-13
Description: The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 does not require authentication, which allows remote attackers to perform unspecified functions via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/74878; http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf
CVE: CVE-2012-1809
Published: 2012-04-13
Description: The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf
CVE: CVE-2010-4666
Published: 2012-04-13
Description: Buffer overflow in libarchive 3.0 pre-release code allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CAB file, which is not properly handled during the reading of Huffman code data within LZX compressed data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/libarchive/source/detail?r=2842; https://bugzilla.redhat.com/show_bug.cgi?id=705849; http://code.google.com/p/libarchive/source/detail?r=2842
CVE: CVE-2011-1777
Published: 2012-04-13
Description: Multiple buffer overflows in the (1) heap_add_entry and (2) relocate_dir functions in archive_read_support_format_iso9660.c in libarchive through 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ISO9660 image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/libarchive/source/detail?r=3158; http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://secunia.com/advisories/48034
CVE: CVE-2011-1778
Published: 2012-04-13
Description: Buffer overflow in libarchive through 2.8.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TAR archive.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/libarchive/source/detail?r=3160; http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://secunia.com/advisories/48034
CVE: CVE-2011-1779
Published: 2012-04-13
Description: Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted (1) TAR archive or (2) ISO9660 image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/libarchive/source/detail?r=3038; https://bugzilla.redhat.com/show_bug.cgi?id=705849; http://code.google.com/p/libarchive/source/detail?r=3038
CVE: CVE-2012-0036
Published: 2012-04-13
Description: curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://curl.haxx.se/curl-url-sanitize.patch; http://curl.haxx.se/docs/adv_20120124.html; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
CVE: CVE-2012-1240
Published: 2012-04-16
Description: Cross-site scripting (XSS) vulnerability in the RECRUIT Dokodemo Rikunabi 2013 extension before 1.0.1 for Google Chrome allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN90055996/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000032; http://secunia.com/advisories/48813
CVE: CVE-2012-1241
Published: 2012-04-16
Description: GRScript18.dll before 1.2.2.0 in ActiveScriptRuby (ASR) before 1.8.7 does not properly restrict interaction with an Internet Explorer ActiveX environment, which allows remote attackers to execute arbitrary Ruby code via a crafted HTML document.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-list/47170; http://jvn.jp/en/jp/JVN33283707/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000031
CVE: CVE-2012-0942
Published: 2012-04-17
Description: Buffer overflow in rn5auth.dll in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to execute arbitrary code via crafted authentication credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://helixproducts.real.com/docs/security/SecurityUpdate04022012HS.pdf; http://www.securityfocus.com/bid/52929; http://www.securitytracker.com/id?1026898
CVE: CVE-2012-1923
Published: 2012-04-17
Description: RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x store passwords in cleartext under adm_b_db\users\, which allows local users to obtain sensitive information by reading a database.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0062.html; http://helixproducts.real.com/docs/security/SecurityUpdate04022012HS.pdf; http://secunia.com/secunia_research/2012-8/
CVE: CVE-2012-1984
Published: 2012-04-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://helixproducts.real.com/docs/security/SecurityUpdate04022012HS.pdf; http://www.securityfocus.com/bid/52929; http://www.securitytracker.com/id?1026898
CVE: CVE-2012-1985
Published: 2012-04-17
Description: Cross-site request forgery (CSRF) vulnerability in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to hijack the authentication of administrators for requests that cause a denial of service (stack consumption and daemon crash) via a malformed URL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://helixproducts.real.com/docs/security/SecurityUpdate04022012HS.pdf; http://www.securityfocus.com/bid/52929; http://www.securitytracker.com/id?1026898
CVE: CVE-2012-2267
Published: 2012-04-17
Description: master.exe in the SNMP Master Agent in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to cause a denial of service (daemon crash) by establishing and closing a port-705 TCP connection, a different vulnerability than CVE-2012-1923.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://helixproducts.real.com/docs/security/SecurityUpdate04022012HS.pdf; http://secunia.com/secunia_research/2012-9/; http://www.securityfocus.com/bid/52929
CVE: CVE-2012-2268
Published: 2012-04-17
Description: master.exe in the SNMP Master Agent in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to cause a denial of service (unhandled exception and daemon crash) via a crafted Open-PDU request that triggers incorrect DisplayString processing, a different vulnerability than CVE-2012-1923.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://helixproducts.real.com/docs/security/SecurityUpdate04022012HS.pdf; http://secunia.com/secunia_research/2012-9/; http://www.securityfocus.com/bid/52929
CVE: CVE-2011-2478
Published: 2012-04-17
Description: Google SketchUp before 8 does not properly handle edge geometry in SketchUp (aka .SKP) files, which allows remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://support.google.com/sketchup/bin/static.py?hl=en&page=release_notes.cs&rd=1; http://technet.microsoft.com/en-us/security/msvr/msvr11-006; http://support.google.com/sketchup/bin/static.py?hl=en&page=release_notes.cs&rd=1
CVE: CVE-2012-1979
Published: 2012-04-17
Description: Cross-site scripting (XSS) vulnerability in starnet/index.php in SyndeoCMS 3.0.01 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the email parameter (aka Email address field) in an edit_user configuration action.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/80746; http://packetstormsecurity.org/files/111405/SyndeoCMS-3.0.01-Cross-Site-Scripting.html; http://www.exploit-db.com/exploits/18686/
CVE: CVE-2012-1180
Published: 2012-04-17
Description: Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-416
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077966.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076646.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076671.html
CVE: CVE-2012-1518
Published: 2012-04-17
Description: VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 use an incorrect ACL for the VMware Tools folder, which allows guest OS users to gain guest OS privileges via unspecified vectors.
CVSS Score: 8.3 (HIGH)
CWE: CWE-264
References: http://osvdb.org/81163; http://secunia.com/advisories/48782; http://www.securityfocus.com/bid/53006
CVE: CVE-2012-2089
Published: 2012-04-17
Description: Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079388.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079467.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079474.html
CVE: CVE-2011-4871
Published: 2012-04-18
Description: Open Automation Software OPC Systems.NET before 5.0 allows remote attackers to cause a denial of service via a malformed .NET RPC packet on TCP port 58723.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-012-01.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-012-01.pdf
CVE: CVE-2011-5086
Published: 2012-04-18
Description: https50.ocx in IP*Works! SSL in the server in Unitronics UniOPC before 2.0.0 does not properly implement an unspecified function, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.us-cert.gov/control_systems/pdf/ICSA-11-279-03A.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-11-279-03A.pdf
CVE: CVE-2011-5087
Published: 2012-04-18
Description: Unspecified vulnerability in AdAstrA TRACE MODE Data Center allows remote attackers to read arbitrary files via unknown vectors, as demonstrated by the GLEG Agora SCADA+ Exploit Pack for Immunity CANVAS.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/53160; http://www.us-cert.gov/control_systems/pdf/ICSA-11-096-01.pdf; http://www.securityfocus.com/bid/53160
CVE: CVE-2012-0135
Published: 2012-04-18
Description: Unspecified vulnerability in HP System Management Homepage (SMH) before 7.0 allows remote authenticated users to cause a denial of service via unknown vectors.
CVSS Score: 3.5 (LOW)
References: http://www.securityfocus.com/archive/1/522374; http://www.securitytracker.com/id?1026925; https://exchange.xforce.ibmcloud.com/vulnerabilities/74917
CVE: CVE-2012-0278
Published: 2012-04-18
Description: Heap-based buffer overflow in the FlashPix PlugIn before 4.3.4.0 for IrfanView might allow remote attackers to execute arbitrary code via a .fpx file containing a crafted FlashPix image that is not properly handled during decompression.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/48772; http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=41&Itemid=41; http://www.securityfocus.com/bid/53009
CVE: CVE-2012-0883
Published: 2012-04-18
Description: envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.
CVSS Score: 6.9 (MEDIUM)
References: http://article.gmane.org/gmane.comp.apache.devel/48158; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html
CVE: CVE-2012-1799
Published: 2012-04-18
Description: The web server on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 does not limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://osvdb.org/81033; http://support.automation.siemens.com/WW/view/en/59869684; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-268149.pdf
CVE: CVE-2012-1800
Published: 2012-04-18
Description: Stack-based buffer overflow in the Profinet DCP protocol implementation on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 allows remote attackers to cause a denial of service (device outage) or possibly execute arbitrary code via a crafted DCP frame.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/81034; http://support.automation.siemens.com/WW/view/en/59869684; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-268149.pdf
CVE: CVE-2012-1801
Published: 2012-04-18
Description: Multiple stack-based buffer overflows in (1) COM and (2) ActiveX controls in ABB WebWare Server, WebWare SDK, Interlink Module, S4 OPC Server, QuickTeach, RobotStudio S4, and RobotStudio Lite allow remote attackers to execute arbitrary code via crafted input data.
CVSS Score: 7.7 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/48693; http://www.securityfocus.com/bid/52888; http://www.us-cert.gov/control_systems/pdf/ICSA-12-095-01A.pdf
CVE: CVE-2012-1802
Published: 2012-04-18
Description: Buffer overflow in the embedded web server on the Siemens Scalance X Industrial Ethernet switch X414-3E before 3.7.1, X308-2M before 3.7.2, X-300EEC before 3.7.2, XR-300 before 3.7.2, and X-300 before 3.7.2 allows remote attackers to cause a denial of service (device reboot) or possibly execute arbitrary code via a malformed URL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://osvdb.org/81032; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-130874.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-04.pdf
CVE: CVE-2012-1993
Published: 2012-04-18
Description: Unspecified vulnerability in HP System Management Homepage (SMH) before 7.0 allows local users to modify data or obtain sensitive information via unknown vectors.
CVSS Score: 3.2 (LOW)
References: http://www.securityfocus.com/archive/1/522374; http://www.securitytracker.com/id?1026925; https://exchange.xforce.ibmcloud.com/vulnerabilities/74918
CVE: CVE-2011-5088
Published: 2012-04-18
Description: The GENESIS32 IcoSetServer ActiveX control in ICONICS GENESIS32 9.21 and BizViz 9.21 configures the trusted zone on the basis of user input, which allows remote attackers to execute arbitrary code via a crafted web site, related to a "Workbench32/WebHMI component SetTrustedZone Policy vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.us-cert.gov/control_systems/pdf/ICSA-11-182-01.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-11-182-01.pdf
CVE: CVE-2011-5089
Published: 2012-04-18
Description: Buffer overflow in the Security Login ActiveX controls in ICONICS GENESIS32 8.05, 9.0, 9.1, and 9.2 and BizViz 8.05, 9.0, 9.1, and 9.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long password.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/control_systems/pdf/ICSA-11-182-02.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/74932; http://www.us-cert.gov/control_systems/pdf/ICSA-11-182-02.pdf
CVE: CVE-2012-0253
Published: 2012-04-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Demand Media Pluck SiteLife before 5.0.13 allow remote attackers to inject arbitrary web script or HTML via (1) the jsonRequest parameter to Direct/Process, the (2) r or (3) cb parameter to Direct/jsonp.htm, or (4) the cb parameter to sys/jsonp.app/.htm.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48778; http://www.kb.cert.org/vuls/id/400619; http://www.kb.cert.org/vuls/id/MAPG-8Q6JEG
CVE: CVE-2012-2110
Published: 2012-04-19
Description: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-04/0209.html; http://cvs.openssl.org/chngview?cn=22431; http://cvs.openssl.org/chngview?cn=22434
CVE: CVE-2012-0134
Published: 2012-04-19
Description: Unspecified vulnerability in HP OpenVMS 7.3-2 on the Alpha platform, 8.3 and 8.4 on the Alpha and IA64 platforms, and 8.3-1h1 on the IA64 platform allows local users to cause a denial of service via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://www.securityfocus.com/archive/1/522386; http://www.securitytracker.com/id?1026935; http://www.securityfocus.com/archive/1/522386
CVE: CVE-2012-2396
Published: 2012-04-19
Description: VideoLAN VLC media player 2.0.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted MP4 file.
CVSS Score: 4.3 (MEDIUM)
References: http://www.exploit-db.com/exploits/18757/; https://exchange.xforce.ibmcloud.com/vulnerabilities/75038; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15615
CVE: CVE-2012-0406
Published: 2012-04-20
Description: The DPA_Utilities.cProcessAuthenticationData function in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an AUTHENTICATECONNECTION command that (1) lacks a password field or (2) has an empty password.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://aluigi.altervista.org/adv/dpa_1-adv.txt; http://www.exploit-db.com/exploits/18688/; http://www.securityfocus.com/archive/1/522408/30/0/threaded
CVE: CVE-2012-0407
Published: 2012-04-20
Description: Integer overflow in the DPA_Utilities library in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (infinite loop) via a negative 64-bit value in a certain size field.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/dpa_1-adv.txt; http://www.exploit-db.com/exploits/18688/; http://www.securityfocus.com/archive/1/522408/30/0/threaded
CVE: CVE-2012-2273
Published: 2012-04-20
Description: Comodo Internet Security before 5.10[PII_REDACTED] on Windows 7 x64 allows local users to cause a denial of service (system crash) via a crafted 32-bit Portable Executable (PE) file with a kernel ImageBase value.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0139.html; http://secunia.com/advisories/48928; http://www.comodo.com/home/download/release-notes.php?p=anti-malware
CVE: CVE-2012-2236
Published: 2012-04-20
Description: SQL injection vulnerability in users.php in PHP Gift Registry 1.5.5 allows remote authenticated users to execute arbitrary SQL commands via the userid parameter in an edit action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0110.html; http://archives.neohapsis.com/archives/bugtraq/2012-04/0110.html