deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-2351
Published: 2011-06-29
Description: Use-after-free vulnerability in Google Chrome before 12.0.742.112 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG use elements.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=85211; http://googlechromereleases.blogspot.com/2011/06/stable-channel-update_28.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-2470
Published: 2011-06-29
Description: Cross-site scripting (XSS) vulnerability in chat/base/admin/login.php in A Really Simple Chat (ARSC) 3.3-rc2 allows remote attackers to inject arbitrary web script or HTML via the arsc_message parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2011/06/02/1; http://www.openwall.com/lists/oss-security/2011/06/02/7; https://sourceforge.net/tracker/?func=detail&aid=3310673&group_id=32699&atid=406296
CVE: CVE-2009-5078
Published: 2011-06-30
Description: contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 launches the Ghostscript program without the -dSAFER option, which allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254
References: ftp://ftp.gnu.org/gnu/groff/groff-1.20.1-1.21.diff.gz; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=538338; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
CVE: CVE-2009-5079
Published: 2011-06-30
Description: The (1) gendef.sh, (2) doc/fixinfo.sh, and (3) contrib/gdiffmk/tests/runtests.in scripts in GNU troff (aka groff) 1.21 and earlier allow local users to overwrite arbitrary files via a symlink attack on a gro#####.tmp or /tmp/##### temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff; http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff.diff?r1=1.1%3Br2=1.2%3Bf=h; http://openwall.com/lists/oss-security/2009/08/14/4
CVE: CVE-2009-5080
Published: 2011-06-30
Description: The (1) contrib/eqn2graph/eqn2graph.sh, (2) contrib/grap2graph/grap2graph.sh, and (3) contrib/pic2graph/pic2graph.sh scripts in GNU troff (aka groff) 1.21 and earlier do not properly handle certain failed attempts to create temporary directories, which might allow local users to overwrite arbitrary files via a symlink attack on a file in a temporary directory, a different vulnerability than CVE-2004-1296.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff; http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff.diff?r1=1.1%3Br2=1.2%3Bf=h; http://openwall.com/lists/oss-security/2009/08/14/4
CVE: CVE-2009-5081
Published: 2011-06-30
Description: The (1) config.guess, (2) contrib/groffer/perl/groffer.pl, and (3) contrib/groffer/perl/roff2.pl scripts in GNU troff (aka groff) 1.21 and earlier use an insufficient number of X characters in the template argument to the tempfile function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file, a different vulnerability than CVE-2004-0969.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff; http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff.diff?r1=1.1%3Br2=1.2%3Bf=h; http://openwall.com/lists/oss-security/2009/08/14/4
CVE: CVE-2009-5082
Published: 2011-06-30
Description: The (1) configure and (2) config.guess scripts in GNU troff (aka groff) 1.20.1 on Openwall GNU/*/Linux (aka Owl) improperly create temporary files upon a failure of the mktemp function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff; http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff.diff?r1=1.1%3Br2=1.2%3Bf=h; http://openwall.com/lists/oss-security/2009/08/14/4
CVE: CVE-2011-2197
Published: 2011-06-30
Description: The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://groups.google.com/group/rubyonrails-security/msg/663b600d4471e0d4?dmode=source&output=gplain; http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html
CVE: CVE-2011-2366
Published: 2011-06-30
Description: Mozilla Gecko before 5.0, as used in Firefox before 5.0 and Thunderbird before 5.0, does not block use of a cross-domain image as a WebGL texture, which allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2011-March/030882.html; http://www.contextis.co.uk/resources/blog/webgl/
CVE: CVE-2011-2598
Published: 2011-06-30
Description: The WebGL implementation in Mozilla Firefox 4.x allows remote attackers to obtain screenshots of the windows of arbitrary desktop applications via vectors involving an SVG filter, an IFRAME element, and uninitialized data in graphics memory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://blog.mozilla.com/security/2011/06/16/webgl-graphics-memory-stealing-issue/; http://www.contextis.com/resources/blog/webgl2/; http://www.securityfocus.com/bid/48319
CVE: CVE-2011-2599
Published: 2011-06-30
Description: Google Chrome 11 does not block use of a cross-domain image as a WebGL texture, which allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2011-March/030882.html; http://www.contextis.co.uk/resources/blog/webgl/; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14183
CVE: CVE-2011-2600
Published: 2011-06-30
Description: The GPU support functionality in Windows XP does not properly restrict rendering time, which allows remote attackers to cause a denial of service (system crash) via vectors involving WebGL and (1) shader programs or (2) complex 3D geometry, as demonstrated by using Mozilla Firefox or Google Chrome to visit the lots-of-polys-example.html test page in the Khronos WebGL SDK.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://www.contextis.com/resources/blog/webgl/; http://www.contextis.com/resources/blog/webgl/
CVE: CVE-2011-2601
Published: 2011-06-30
Description: The GPU support functionality in Mac OS X does not properly restrict rendering time, which allows remote attackers to cause a denial of service (desktop hang) via vectors involving WebGL and (1) shader programs or (2) complex 3D geometry, as demonstrated by using Mozilla Firefox or Google Chrome to visit the lots-of-polys-example.html test page in the Khronos WebGL SDK.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://www.contextis.com/resources/blog/webgl/; http://www.contextis.com/resources/blog/webgl/
CVE: CVE-2011-2602
Published: 2011-06-30
Description: The NVIDIA Geforce 310 driver 6.14.12.7061 on Windows XP SP3 allows remote attackers to cause a denial of service (system crash) via a crafted web page that is visited with Google Chrome or Mozilla Firefox, as demonstrated by the lots-of-polys-example.html test page in the Khronos WebGL SDK.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://www.contextis.com/resources/blog/webgl/; http://www.contextis.com/resources/blog/webgl2/; http://www.securityfocus.com/bid/48319
CVE: CVE-2011-2603
Published: 2011-06-30
Description: The NVIDIA 9400M driver 6.2.6 on Mac OS X 10.6.7 allows remote attackers to cause a denial of service (desktop hang) via a crafted web page that is visited with Google Chrome or Mozilla Firefox, as demonstrated by the lots-of-polys-example.html test page in the Khronos WebGL SDK.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://www.contextis.com/resources/blog/webgl/; http://www.contextis.com/resources/blog/webgl2/; http://www.securityfocus.com/bid/48319
CVE: CVE-2011-2604
Published: 2011-06-30
Description: The Intel G41 driver 6.14.10.5355 on Windows XP SP3 allows remote attackers to cause a denial of service (system crash) via a crafted web page that is visited with Google Chrome or Mozilla Firefox, as demonstrated by the lots-of-polys-example.html test page in the Khronos WebGL SDK.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://www.contextis.com/resources/blog/webgl/; http://www.contextis.com/resources/blog/webgl2/; http://www.securityfocus.com/bid/48319
CVE: CVE-2011-0083
Published: 2011-06-30
Description: Use-after-free vulnerability in the nsSVGPathSegList::ReplaceItem function in the implementation of SVG element lists in Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a user-supplied callback.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://secunia.com/advisories/45002; http://support.avaya.com/css/P8/documents/100144854
CVE: CVE-2011-0085
Published: 2011-06-30
Description: Use-after-free vulnerability in the nsXULCommandDispatcher function in Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code via a crafted XUL document that dequeues the current command updater.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://secunia.com/advisories/45002; http://support.avaya.com/css/P8/documents/100144854
CVE: CVE-2011-2362
Published: 2011-06-30
Description: Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not distinguish between cookies for two domain names that differ only in a trailing dot, which allows remote web servers to bypass the Same Origin Policy via Set-Cookie headers.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://secunia.com/advisories/45002; http://support.avaya.com/css/P8/documents/100144854
CVE: CVE-2011-2363
Published: 2011-06-30
Description: Use-after-free vulnerability in the nsSVGPointList::AppendElement function in the implementation of SVG element lists in Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a user-supplied callback.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://secunia.com/advisories/45002; http://support.avaya.com/css/P8/documents/100144854
CVE: CVE-2011-2364
Published: 2011-06-30
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.6.x before 3.6.18 and Thunderbird before 3.1.11 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2365.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://secunia.com/advisories/45002; http://support.avaya.com/css/P8/documents/100144854
CVE: CVE-2011-2365
Published: 2011-06-30
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.6.x before 3.6.18 and Thunderbird before 3.1.11 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2364.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://secunia.com/advisories/45002; http://support.avaya.com/css/P8/documents/100144854
CVE: CVE-2011-2367
Published: 2011-06-30
Description: The WebGL implementation in Mozilla Firefox 4.x through 4.0.1 does not properly restrict read operations, which allows remote attackers to obtain sensitive information from GPU memory associated with an arbitrary process, or cause a denial of service (application crash), via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://www.mozilla.org/security/announce/2011/mfsa2011-26.html; https://bugzilla.mozilla.org/show_bug.cgi?id=656752
CVE: CVE-2011-2368
Published: 2011-06-30
Description: The WebGL implementation in Mozilla Firefox 4.x through 4.0.1 does not properly restrict write operations, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://www.mozilla.org/security/announce/2011/mfsa2011-26.html; https://bugzilla.mozilla.org/show_bug.cgi?id=657201
CVE: CVE-2011-2369
Published: 2011-06-30
Description: Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 4.0.1 allows remote attackers to inject arbitrary web script or HTML via an SVG element containing an HTML-encoded entity.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://www.mozilla.org/security/announce/2011/mfsa2011-27.html; https://bugzilla.mozilla.org/show_bug.cgi?id=650001
CVE: CVE-2011-2370
Published: 2011-06-30
Description: Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall functionality, which allows remote attackers to trigger an installation dialog for a (1) add-on or (2) theme via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://www.mozilla.org/security/announce/2011/mfsa2011-28.html; https://bugzilla.mozilla.org/show_bug.cgi?id=645699
CVE: CVE-2011-2371
Published: 2011-06-30
Description: Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code via vectors involving a long JavaScript Array object.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://secunia.com/advisories/45002; http://securityreason.com/securityalert/8472
CVE: CVE-2011-2373
Published: 2011-06-30
Description: Use-after-free vulnerability in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14, when JavaScript is disabled, allows remote attackers to execute arbitrary code via a crafted XUL document.
CVSS Score: 7.6 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://secunia.com/advisories/45002; http://support.avaya.com/css/P8/documents/100144854
CVE: CVE-2011-2374
Published: 2011-06-30
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://secunia.com/advisories/45002; http://support.avaya.com/css/P8/documents/100144854
CVE: CVE-2011-2375
Published: 2011-06-30
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 5.0 and Thunderbird through 3.1.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://support.avaya.com/css/P8/documents/100144854; http://support.avaya.com/css/P8/documents/100145333; http://www.mandriva.com/security/advisories?name=MDVSA-2011:111
CVE: CVE-2011-2376
Published: 2011-06-30
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.18 and Thunderbird before 3.1.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://secunia.com/advisories/45002; http://support.avaya.com/css/P8/documents/100144854
CVE: CVE-2011-2377
Published: 2011-06-30
Description: Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a multipart/x-mixed-replace image.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html; http://secunia.com/advisories/45002; http://support.avaya.com/css/P8/documents/100144854
CVE: CVE-2011-2605
Published: 2011-06-30
Description: CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \n (newline) character, which is not properly handled in a JavaScript "document.cookie =" expression, a different vulnerability than CVE-2011-2374.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://www.mozilla.org/security/announce/2011/mfsa2011-19.html; http://www.redhat.com/support/errata/RHSA-2011-0885.html; http://www.redhat.com/support/errata/RHSA-2011-0886.html
CVE: CVE-2011-2606
Published: 2011-06-30
Description: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Rational Team Concert (RTC) 3.0 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Work Item 165511.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/44926; http://www.ibm.com/support/docview.wss?uid=swg1PM40308; http://www.osvdb.org/73198
CVE: CVE-2011-2607
Published: 2011-06-30
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert (RTC) 3.0 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Work Item 165513.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/44926; http://www.ibm.com/support/docview.wss?uid=swg1PM40311; http://www.osvdb.org/73198
CVE: CVE-2011-1337
Published: 2011-07-01
Description: Opera before 11.50 allows remote attackers to cause a denial of service (disk consumption) via invalid URLs that trigger creation of error pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://jvn.jp/en/jp/JVN47757122/index.html; http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000049.html; http://secunia.com/advisories/45060
CVE: CVE-2011-1514
Published: 2011-07-01
Description: The inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request containing crafted parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182; http://secunia.com/advisories/45100; http://www.coresecurity.com/content/HP-Data-Protector-multiple-vulnerabilities
CVE: CVE-2011-1515
Published: 2011-07-01
Description: The inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to cause a denial of service (daemon exit) via a request containing crafted parameters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182; http://secunia.com/advisories/45100; http://www.coresecurity.com/content/HP-Data-Protector-multiple-vulnerabilities
CVE: CVE-2011-1865
Published: 2011-07-01
Description: Multiple stack-based buffer overflows in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allow remote attackers to execute arbitrary code via a request containing crafted parameters.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182; http://secunia.com/advisories/45100; http://securityreason.com/securityalert/8288
CVE: CVE-2011-1866
Published: 2011-07-01
Description: Buffer overflow in omniinet.exe in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to execute arbitrary code via a crafted request, related to the EXEC_CMD functionality.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182; http://secunia.com/advisories/45100; http://securityreason.com/securityalert/8289
CVE: CVE-2011-2608
Published: 2011-07-01
Description: ovbbccb.exe 6.20.50.0 and other versions in HP OpenView Performance Agent 4.70 and 5.0; and Operations Agent 11.0, 8.60.005, 8.60.006, 8.60.007, 8.60.008, 8.60.501, and 8.53; allows remote attackers to delete arbitrary files via a full pathname in the File field in a Register command.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/ovbbccb_1-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2504&w=2; http://secunia.com/advisories/45079
CVE: CVE-2011-2609
Published: 2011-07-01
Description: Opera before 11.50 does not properly restrict data: URIs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/45060; http://www.opera.com/docs/changelogs/mac/1150/; http://www.opera.com/docs/changelogs/unix/1150/
CVE: CVE-2011-2610
Published: 2011-07-01
Description: Unspecified vulnerability in Opera before 11.50 has unknown impact and attack vectors, related to a "moderately severe issue."
CVSS Score: 10.0 (HIGH)
References: http://www.opera.com/docs/changelogs/mac/1150/; http://www.opera.com/docs/changelogs/unix/1150/; http://www.opera.com/docs/changelogs/windows/1150/
CVE: CVE-2011-2611
Published: 2011-07-01
Description: Unspecified vulnerability in the printing functionality in Opera before 11.50 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web page.
CVSS Score: 4.3 (MEDIUM)
References: http://www.opera.com/docs/changelogs/mac/1150/; http://www.opera.com/docs/changelogs/unix/1150/; http://www.opera.com/docs/changelogs/windows/1150/
CVE: CVE-2011-2612
Published: 2011-07-01
Description: Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by progorod.ru.
CVSS Score: 5.0 (MEDIUM)
References: http://www.opera.com/docs/changelogs/mac/1150/; http://www.opera.com/docs/changelogs/unix/1150/; http://www.opera.com/docs/changelogs/windows/1150/