deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-0722
Published: 2011-05-20
Description: FFmpeg before 0.5.4, as used in MPlayer and other products, allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a malformed RealMedia file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://ffmpeg.mplayerhq.hu/; http://www.debian.org/security/2011/dsa-2306; http://www.mandriva.com/security/advisories?name=MDVSA-2011:061
CVE: CVE-2011-0723
Published: 2011-05-20
Description: FFmpeg 0.5.x, as used in MPlayer and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed VC-1 file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://ffmpeg.mplayerhq.hu/; http://www.debian.org/security/2011/dsa-2306; http://www.mandriva.com/security/advisories?name=MDVSA-2011:061
CVE: CVE-2011-0959
Published: 2011-05-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to inject arbitrary web script or HTML via (1) the extn parameter to iptm/advancedfind.do, (2) the deviceInstanceName parameter to iptm/ddv.do, the (3) cmd or (4) group parameter to iptm/eventmon, the (5) clusterName or (6) deviceName parameter to iptm/faultmon/ui/dojo/Main/eventmon_wrapper.jsp, or the (7) ccmName or (8) clusterName parameter to iptm/logicalTopo.do, aka Bug ID CSCtn61716.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html; http://tools.cisco.com/security/center/viewAlert.x?alertId=23085; http://www.exploit-db.com/exploits/17304
CVE: CVE-2011-0960
Published: 2011-05-20
Description: Multiple SQL injection vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to execute arbitrary SQL commands via (1) the CCMs parameter to iptm/PRTestCreation.do or (2) the ccm parameter to iptm/TelePresenceReportAction.do, aka Bug ID CSCtn61716.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html; http://tools.cisco.com/security/center/viewAlert.x?alertId=23086; http://www.exploit-db.com/exploits/17304
CVE: CVE-2011-0961
Published: 2011-05-20
Description: Cross-site scripting (XSS) vulnerability in cwhp/device.center.do in the Help servlet in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the device parameter, aka Bug ID CSCto12704.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html; http://tools.cisco.com/security/center/viewAlert.x?alertId=23088; http://www.exploit-db.com/exploits/17304
CVE: CVE-2011-0962
Published: 2011-05-20
Description: Cross-site scripting (XSS) vulnerability in CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in the Common Services Device Center in Cisco Unified Operations Manager (CUOM) before 8.6 allows remote attackers to inject arbitrary web script or HTML via the tag parameter, aka Bug ID CSCto12712.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html; http://tools.cisco.com/security/center/viewAlert.x?alertId=23087; http://www.exploit-db.com/exploits/17304
CVE: CVE-2011-0966
Published: 2011-05-20
Description: Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, aka Bug ID CSCto35577.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html; http://tools.cisco.com/security/center/viewAlert.x?alertId=23089; http://www.exploit-db.com/exploits/17304
CVE: CVE-2011-1327
Published: 2011-05-20
Description: The Keystroke Encryption feature in Trend Micro Internet Security 2009 (aka Virus Buster 2009 and PC-cillin 2009) does not completely encrypt passwords, which allows local users to obtain sensitive information by leveraging a keylogger.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://esupport.trendmicro.co.jp/Pages/JP-2079186.aspx; http://jvn.jp/en/jp/JVN99175647/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000028
CVE: CVE-2011-1582
Published: 2011-05-20
Description: Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://mail-archives.apache.org/mod_mbox/www-announce/201105.mbox/%3C4DD26E30.2060103%40apache.org%3E; http://securityreason.com/securityalert/8256; http://svn.apache.org/viewvc?view=revision&revision=1100832
CVE: CVE-2011-1784
Published: 2011-05-20
Description: The pidfile_write function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666 permissions for the (1) keepalived.pid, (2) checkers.pid, and (3) vrrp.pid files in /var/run/, which allows local users to kill arbitrary processes by writing a PID to one of these files.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626281; http://lists.debian.org/debian-security/2011/05/msg00012.html; http://lists.debian.org/debian-security/2011/05/msg00013.html
CVE: CVE-2011-1838
Published: 2011-05-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in TemplateLogin.pm in TWiki before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via the origurl parameter to a (1) view script or (2) login script.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/44594; http://securityreason.com/securityalert/8257; http://securitytracker.com/id?1025542
CVE: CVE-2011-2020
Published: 2011-05-20
Description: Cross-site scripting (XSS) vulnerability in TIBCO iProcess Engine before 11.1.3 and iProcess Workspace before 11.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/72553; http://secunia.com/advisories/44639; http://www.securityfocus.com/bid/47921
CVE: CVE-2011-2021
Published: 2011-05-20
Description: Session fixation vulnerability in TIBCO iProcess Engine before 11.1.3 and iProcess Workspace before 11.3.1 allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/72554; http://secunia.com/advisories/44639; http://www.securityfocus.com/bid/47921
CVE: CVE-2011-2147
Published: 2011-05-20
Description: Openswan 2.2.x does not properly restrict permissions for (1) /var/run/starter.pid, related to starter.c in the IPsec starter, and (2) /var/lock/subsys/ipsec, which allows local users to kill arbitrary processes by writing a PID to a file, or possibly bypass disk quotas by writing arbitrary data to a file, as demonstrated by files with 0666 permissions, a different vulnerability than CVE-2011-1784.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://lists.debian.org/debian-security/2011/05/msg00012.html; http://lists.debian.org/debian-security/2011/05/msg00013.html; http://lists.debian.org/debian-security/2011/05/msg00018.html
CVE: CVE-2011-2148
Published: 2011-05-20
Description: Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary commands via vectors involving a leading and trailing & (ampersand) character, and (1) an STTTState cookie, (2) the ctl00%24MPH%24txtAdminNewPassword_SettingText parameter, (3) the ctl00%24MPH%24txtSmarterLogDirectory parameter, (4) the ctl00%24MPH%24ucSiteSeoSearchEngineSettings%24chklistEngines_SettingCheckBox%2414 parameter, (5) the ctl00%24MPH%24ucSiteSeoSettings%24txtSeoMaxKeywords_SettingText parameter, or (6) the ctl00_MPH_grdLogLocations_HiddenLSR parameter, related to an "OS command injection" issue.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www.kb.cert.org/vuls/id/240150; http://www.kb.cert.org/vuls/id/MORO-8GYQR4; http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
CVE: CVE-2011-2149
Published: 2011-05-20
Description: Multiple SQL injection vulnerabilities in the SmarterTools SmarterStats 6.0 web server allow remote attackers to execute arbitrary SQL commands via certain parameters to (1) Admin/frmSite.aspx, (2) Default.aspx, (3) Services/SiteAdmin.asmx, or (4) Client/frmViewReports.aspx; certain cookies to (5) Services/SiteAdmin.asmx or (6) login.aspx; the Referer HTTP header to (7) Services/SiteAdmin.asmx or (8) login.aspx; or (9) the User-Agent HTTP header to Services/SiteAdmin.asmx.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/240150; http://www.kb.cert.org/vuls/id/MORO-8GYQR4; http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
CVE: CVE-2011-2150
Published: 2011-05-20
Description: The SmarterTools SmarterStats 6.0 web server does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error and daemon pause) via vectors involving (1) certain cookies in a SiteInfoLookup action to Admin/frmSites.aspx, or certain (2) cookies or (3) parameters to (a) Client/frmViewOverviewReport.aspx, (b) Client/frmViewReports.aspx, or (c) Services/SiteAdmin.asmx, as demonstrated by a ]]>> string, related to an "XML injection" issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/240150; http://www.kb.cert.org/vuls/id/MORO-8GYQR4; http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
CVE: CVE-2011-2151
Published: 2011-05-20
Description: The (1) Admin/frmEmailReportSettings.aspx, (2) Admin/frmGeneralSettings.aspx, (3) Admin/frmSite.aspx, (4) Client/frmUser.aspx, and (5) Login.aspx components in the SmarterTools SmarterStats 6.0 web server accept cleartext passwords, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/240150; http://www.kb.cert.org/vuls/id/MORO-8GYQR4; http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html
CVE: CVE-2011-2152
Published: 2011-05-20
Description: The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for (1) Client/frmViewReports.aspx or (2) UserControls/Popups/frmHelp.aspx, which makes it easier for remote attackers to obtain sensitive information by reading (a) web-server access logs or (b) web-server Referer logs, related to a "cross-domain Referer leakage" issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/240150; http://www.kb.cert.org/vuls/id/MORO-8GYQR4; http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
CVE: CVE-2011-2153
Published: 2011-05-20
Description: Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parameters in the query string, which makes it easier for context-dependent attackers to discover credentials by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, related to a "cross-domain Referer leakage" issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/240150; http://www.kb.cert.org/vuls/id/MORO-8GYQR4; http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
CVE: CVE-2011-2154
Published: 2011-05-20
Description: login.aspx in the SmarterTools SmarterStats 6.0 web server does not include the HTTPOnly flag in a Set-Cookie header for the loginsettings cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/240150; http://www.kb.cert.org/vuls/id/MORO-8GYQR4; http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html
CVE: CVE-2011-2155
Published: 2011-05-20
Description: Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/240150; http://www.kb.cert.org/vuls/id/MORO-8GYQR4; http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html
CVE: CVE-2011-2156
Published: 2011-05-20
Description: The SmarterTools SmarterStats 6.0 web server allows remote attackers to obtain directory listings via a direct request for the (1) Admin/, (2) Admin/Defaults/, (3) Admin/GettingStarted/, (4) Admin/Popups/, (5) App_Themes/, (6) Client/, (7) Client/Popups/, (8) Services/, (9) Temp/, (10) UserControls/, (11) UserControls/PanelBarTemplates/, (12) UserControls/Popups/, (13) aspnet_client/, or (14) aspnet_client/system_web/ directory name, or (15) certain directory names under App_Themes/Default/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/240150; http://www.kb.cert.org/vuls/id/MORO-8GYQR4; http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
CVE: CVE-2011-2157
Published: 2011-05-20
Description: The (1) Admin/frmEmailReportSettings.aspx and (2) Admin/frmGeneralSettings.aspx components in the SmarterTools SmarterStats 6.0 web server generate web pages containing e-mail addresses, which allows remote attackers to obtain potentially sensitive information by reading the default values of form fields.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/240150; http://www.kb.cert.org/vuls/id/MORO-8GYQR4; http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
CVE: CVE-2011-2158
Published: 2011-05-20
Description: The SmarterTools SmarterStats 6.0 web server sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving (1) Admin/frmSite.aspx, (2) Admin/frmSites.aspx, (3) Admin/frmViewReports.aspx, (4) App_Themes/AboutThisFolder.txt, (5) Client/frmViewReports.aspx, (6) Temp/AboutThisFolder.txt, (7) default.aspx, (8) login.aspx, or (9) certain .jpg URIs under Temp/.  NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.
CVSS Score: 10.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/240150; http://www.kb.cert.org/vuls/id/MORO-8GYQR4; http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html
CVE: CVE-2011-2159
Published: 2011-05-20
Description: The SmarterTools SmarterStats 6.0 web server omits the Content-Type header for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving (1) Admin/Defaults/frmDefaultSiteSettings.aspx, (2) Admin/Defaults/frmServerDefaults.aspx, (3) Admin/frmReportSettings.aspx, (4) Admin/frmSite.aspx, (5) App_Themes/Default/ButtonBarIcons.xml, (6) App_Themes/Default/Skin.xml, (7) Client/frmImportSettings.aspx, (8) Client/frmSeoSettings.aspx, (9) Services/Web.config, (10) aspnet_client/system_web/4_0_30319/, (11) clientaccesspolicy.xml, (12) cloudscan.exe, (13) crossdomain.xml, or (14) sitemap.xml.  NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.
CVSS Score: 10.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/240150; http://www.kb.cert.org/vuls/id/MORO-8GYQR4; http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
CVE: CVE-2011-2160
Published: 2011-05-20
Description: The VC-1 decoding functionality in FFmpeg before 0.5.4, as used in MPlayer and other products, does not properly restrict read operations, which allows remote attackers to have an unspecified impact via a crafted VC-1 file, a related issue to CVE-2011-0723.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://ffmpeg.mplayerhq.hu/; http://www.securityfocus.com/bid/47956; http://ffmpeg.mplayerhq.hu/
CVE: CVE-2011-2161
Published: 2011-05-20
Description: The ape_read_header function in ape.c in libavformat in FFmpeg before 0.5.4, as used in MPlayer, VideoLAN VLC media player, and other products, allows remote attackers to cause a denial of service (application crash) via an APE (aka Monkey's Audio) file that contains a header but no frames.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://ffmpeg.mplayerhq.hu/; http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt; https://github.com/FFmpeg/FFmpeg/commit/8312e3fc9041027a33c8bc667bb99740fdf41dd5
CVE: CVE-2011-2162
Published: 2011-05-20
Description: Multiple unspecified vulnerabilities in FFmpeg 0.4.x through 0.6.x, as used in MPlayer 1.0 and other products, in Mandriva Linux 2009.0, 2010.0, and 2010.1; Corporate Server 4.0 (aka CS4.0); and Mandriva Enterprise Server 5 (aka MES5) have unknown impact and attack vectors, related to issues "originally discovered by Google Chrome developers."
CVSS Score: 10.0 (HIGH)
References: http://www.mandriva.com/security/advisories?name=MDVSA-2011:059; http://www.mandriva.com/security/advisories?name=MDVSA-2011:060; http://www.mandriva.com/security/advisories?name=MDVSA-2011:061
CVE: CVE-2011-2163
Published: 2011-05-20
Description: Unspecified vulnerability in Virtualization Manager 1.2.2 in IBM Systems Director 1.2.2 has unknown impact and attack vectors.
CVSS Score: 9.3 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=nas7057acf6c8f05fa568625787e0059fb36; http://www.vupen.com/english/advisories/2011/1256; https://exchange.xforce.ibmcloud.com/vulnerabilities/67516
CVE: CVE-2011-2164
Published: 2011-05-20
Description: Multiple unspecified vulnerabilities in Adobe Photoshop before 12.0.4 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://blogs.adobe.com/jnack/2011/05/photoshop-12-0-4-update-for-cs5-arrives.html; http://secunia.com/advisories/44419; http://securitytracker.com/id?1025483
CVE: CVE-2009-5024
Published: 2011-05-23
Description: ViewVC before 1.1.11 allows remote attackers to bypass the cvsdb row_limit configuration setting, and consequently conduct resource-consumption attacks, via the limit parameter, as demonstrated by a "query revision history" request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://openwall.com/lists/oss-security/2011/05/19/1; http://openwall.com/lists/oss-security/2011/05/19/9; http://viewvc.tigris.org/issues/show_bug.cgi?id=433
CVE: CVE-2011-1575
Published: 2011-05-23
Description: The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-399
References: http://archives.pureftpd.org/archives.cgi?100:mss:3906:201103:cpeojfkblajnpinkeadd; http://archives.pureftpd.org/archives.cgi?100:mss:3910:201103:cpeojfkblajnpinkeadd; http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
CVE: CVE-2011-1765
Published: 2011-05-23
Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .shtml at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578 and CVE-2011-1587.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060435.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060496.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060507.html
CVE: CVE-2011-1766
Published: 2011-05-23
Description: includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060435.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060496.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060507.html
CVE: CVE-2011-1920
Published: 2011-05-23
Description: The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_depend##### temporary file, related to (1) bsd.lib.mk and (2) bsd.prog.mk.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626673; http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.lib.mk.diff?r1=1.239&r2=1.240&f=h; http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.prog.mk.diff?r1=1.192&r2=1.193&f=h
CVE: CVE-2011-1926
Published: 2011-05-23
Description: The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-264
References: http://bugzilla.cyrusimap.org/show_bug.cgi?id=3423; http://bugzilla.cyrusimap.org/show_bug.cgi?id=3424; http://git.cyrusimap.org/cyrus-imapd/patch/?id=523a91a5e86c8b9a27a138f04a3e3f2d8786f162
CVE: CVE-2011-2165
Published: 2011-05-23
Description: The STARTTLS implementation in WatchGuard XCS 9.0 and 9.1 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/44753; http://www.kb.cert.org/vuls/id/555316; http://www.kb.cert.org/vuls/id/MAPG-8D9M75
CVE: CVE-2011-0418
Published: 2011-05-24
Description: The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/glob.c#rev1.28; http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/glob.c.diff?r1=1.27&r2=1.28&f=h; http://securityreason.com/achievement_securityalert/97
CVE: CVE-2011-1328
Published: 2011-05-24
Description: SQL injection vulnerability in RADVISION iVIEW Suite before 7.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN77697803/995139/index.html; http://jvn.jp/en/jp/JVN77697803/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000030