deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-4275
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 before 03-00-08 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49144; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-014/index.html; http://secunia.com/advisories/49144
CVE: CVE-2012-4276
Published: 2012-08-13
Description: Unspecified vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 before 03-00-08 allows attackers to cause a denial of service via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/49144; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-014/index.html; http://secunia.com/advisories/49144
CVE: CVE-2012-4277
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in the smarty_function_html_options_optoutput function in distribution/libs/plugins/function.html_options.php in Smarty before 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://code.google.com/p/smarty-php/issues/detail?id=98&can=1; http://code.google.com/p/smarty-php/source/detail?r=4612; http://secunia.com/advisories/49164
CVE: CVE-2012-4278
Published: 2012-08-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) notes parameter to (a) admin/agenteditor.php; (2) title, (3) previewdesc, (4) fulldesc, or (5) notes parameter (b) to agentadmin.php or (c) in an addlisting action to agentadmin.php; or unspecified vectors to (d) admin/adminfeatures.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49132; http://www.exploit-db.com/exploits/18874; http://www.securityfocus.com/bid/53491
CVE: CVE-2012-4279
Published: 2012-08-13
Description: Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands via the (1) view parameter to agentdisplay.php or (2) edit parameter to admin/admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/49132; http://www.exploit-db.com/exploits/18874; http://www.securityfocus.com/bid/53491
CVE: CVE-2012-4280
Published: 2012-08-13
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack the authentication of administrators for requests that (1) add an agent via an addagent action or (2) modify an agent.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/49132; http://www.exploit-db.com/exploits/18874; http://www.securityfocus.com/bid/53491
CVE: CVE-2012-4281
Published: 2012-08-13
Description: Multiple SQL injection vulnerabilities in Travelon Express 6.2.2 allow remote attackers to execute arbitrary SQL commands via the hid parameter to (1) holiday.php or (2) holiday_book.php, (3) id parameter to pages.php, (4) fid parameter to admin/airline-edit.php, or (5) cid parameter to admin/customer-edit.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/49118; http://www.exploit-db.com/exploits/18871; http://www.osvdb.org/81882
CVE: CVE-2010-5096
Published: 2012-08-13
Description: Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in a (1) do_search action to search.php or (2) do_stuff action to private.php.  NOTE: the vendor disputes this issue, saying "Although this doesn't lead to an SQL injection, it does provide a general MyBB SQL error.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://dev.mybb.com/issues/1330; http://www.openwall.com/lists/oss-security/2012/03/23/4; http://www.openwall.com/lists/oss-security/2012/03/25/1
CVE: CVE-2012-2274
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in pivotx/ajaxhelper.php in PivotX 2.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the file parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://pivot-weblog.svn.sourceforge.net/viewvc/pivot-weblog?view=revision&revision=4145; http://pivot-weblog.svn.sourceforge.net/viewvc/pivot-weblog?view=revision&revision=4147; http://pivotx.net/page/security
CVE: CVE-2012-2330
Published: 2012-08-13
Description: The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://blog.nodejs.org/2012/05/04/version-0-6-17-stable/; http://secunia.com/advisories/49066; http://www.openwall.com/lists/oss-security/2012/05/08/4
CVE: CVE-2012-2331
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the serendipity[textarea] parameter.  NOTE: this issue might be resultant from cross-site request forgery (CSRF).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-05/0037.html; http://blog.s9y.org/archives/240-Serendipity-1.6.1-released.html; http://secunia.com/advisories/49009
CVE: CVE-2012-2332
Published: 2012-08-13
Description: SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the serendipity[plugin_to_conf] parameter.  NOTE: this issue might be resultant from cross-site request forgery (CSRF).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-05/0037.html; http://blog.s9y.org/archives/240-Serendipity-1.6.1-released.html; http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-001.txt
CVE: CVE-2012-4282
Published: 2012-08-13
Description: SQL injection vulnerability in photo.php in Trombinoscope 3.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/112488/Trombinoscope-3.5-SQL-Injection.html; http://www.securityfocus.com/bid/53398; https://exchange.xforce.ibmcloud.com/vulnerabilities/75427
CVE: CVE-2012-4283
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in the Login With Ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://plugins.trac.wordpress.org/changeset/541069; http://secunia.com/advisories/49013; http://wordpress.org/extend/plugins/login-with-ajax/changelog/
CVE: CVE-2012-1835
Published: 2012-08-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0071.html; http://www.securityfocus.com/bid/52986; https://www.htbridge.com/advisory/HTB23082
CVE: CVE-2012-2096
Published: 2012-08-14
Description: The Fivestar module 6.x-1.x before 6.x-1.20 for Drupal does not properly validate voting data, which allows remote attackers to manipulate voting averages via a negative value in the vote parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://drupal.org/node/1528600; http://drupal.org/node/1528614; http://drupalcode.org/project/fivestar.git/commitdiff/75dba2c
CVE: CVE-2012-2097
Published: 2012-08-14
Description: Cross-site request forgery (CSRF) vulnerability in the Autosave module 6.x before 6.x-2.10 and 7.x-2.x before 7.x-2.0 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests involving "submitting saved results to a node."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1525998; http://drupal.org/node/1528864; http://drupal.org/node/1528906
CVE: CVE-2012-4324
Published: 2012-08-14
Description: Cross-site request forgery (CSRF) vulnerability in PHPJabbers Vacation Rental Script allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via a create action in the AdminUsers module to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/80948; http://packetstormsecurity.org/files/111564/Vacation-Rental-Listing-Cross-Site-Request-Forgery.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/74683
CVE: CVE-2012-4325
Published: 2012-08-14
Description: Cross-site request forgery (CSRF) vulnerability in upload/users.php in Utopia News Pro (UNP) 1.4.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/80986; http://www.exploit-db.com/exploits/18720; https://exchange.xforce.ibmcloud.com/vulnerabilities/74760
CVE: CVE-2012-4326
Published: 2012-08-14
Description: Cross-site request forgery (CSRF) vulnerability in commonsettings.php in AlstraSoft Site Uptime Enterprise, possibly 5.4, allows remote attackers to hijack the authentication of administrators.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/80947; http://packetstormsecurity.org/files/111563/AlstraSoft-Site-Uptime-Cross-Site-Request-Forgery.html; http://secunia.com/advisories/48707
CVE: CVE-2012-4327
Published: 2012-08-14
Description: Unspecified vulnerability in the Image News slider plugin before 3.3 for WordPress has unspecified impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-image-news-slider&old=529740&new_path=%2Fwp-image-news-slider&new=529740; http://secunia.com/advisories/48747; http://wordpress.org/extend/plugins/wp-image-news-slider/other_notes/
CVE: CVE-2011-5099
Published: 2012-08-14
Description: SQL injection vulnerability in helper/popup.php in the ccNewsletter (mod_ccnewsletter) component 1.0.7 through 1.0.9 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/112092/Joomla-CCNewsLetter-1.0.7-SQL-Injection.html; http://secunia.com/advisories/48934; http://www.chillcreations.com/blog/5-ccnewsletter-joomla-newsletter/274-ccnewsletter-1010-security-release.html
CVE: CVE-2012-2135
Published: 2012-08-14
Description: The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and crash) via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670389; http://bugs.python.org/issue14579; http://secunia.com/advisories/51087
CVE: CVE-2012-2141
Published: 2012-08-14
Description: Array index error in the handle_nsExtendOutput2Table function in agent/mibgroup/agent/extend.c in Net-SNMP 5.7.1 allows remote authenticated users to cause a denial of service (out-of-bounds read and snmpd crash) via an SNMP GET request for an entry not in the extension table.
CVSS Score: 3.5 (LOW)
References: http://rhn.redhat.com/errata/RHSA-2013-0124.html; http://secunia.com/advisories/48938; http://secunia.com/advisories/59974
CVE: CVE-2012-2151
Published: 2012-08-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in SPIP 1.9.x before 1.9.2.o, 2.0.x before 2.0.18, and 2.1.x before 2.1.13 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.rezo.net/archives/spip-en.mbox/U5QUZ6WJRAJC7H5BR7W5SQG6WCD3PXL7/; http://secunia.com/advisories/48939; http://www.debian.org/security/2012/dsa-2461
CVE: CVE-2012-2208
Published: 2012-08-14
Description: Directory traversal vulnerability in upgrade.php in Piwigo before 2.3.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0196.html; http://piwigo.org/bugs/view.php?id=2607; http://piwigo.org/forum/viewtopic.php?id=19173
CVE: CVE-2012-2209
Published: 2012-08-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) section parameter in the configuration module, (2) installstatus parameter in the languages_new module, or (3) theme parameter in the theme module.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0196.html; http://piwigo.org/bugs/view.php?id=2607; http://piwigo.org/forum/viewtopic.php?id=19173
CVE: CVE-2012-2298
Published: 2012-08-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) "user names in page titles" and (2) "autocomplete callbacks."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1547352; http://drupal.org/node/1547660; http://drupalcode.org/project/realname.git/commitdiff/41786d0
CVE: CVE-2012-2299
Published: 2012-08-14
Description: The Ubercart module 6.x-2.x before 6.x-2.8 and 7.x-3.x before 7.x-3.1 for Drupal stores passwords for new customers in plaintext during checkout, which allows local users to obtain sensitive information by reading from the database.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://drupal.org/node/1547506; http://drupal.org/node/1547508; http://drupal.org/node/1547674
CVE: CVE-2012-2300
Published: 2012-08-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart module 6.x-2.x before 6.x-2.8 and 7.x-3.x before 7.x-3.1 for Drupal allow remote authenticated users with the administer product classes permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1547506; http://drupal.org/node/1547508; http://drupal.org/node/1547674
CVE: CVE-2012-2304
Published: 2012-08-14
Description: The Linkit module 7.x-2.x before 7.x-2.3 for Drupal, when using an entity access module, does not check permissions when searching for entities, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1547716; http://drupal.org/node/1547738; http://secunia.com/advisories/48900
CVE: CVE-2012-4328
Published: 2012-08-14
Description: Unspecified vulnerability in the MAPI in vBulletin Suite 4.1.2 through 4.1.12, Forum 4.1.2 through 4.1.12, and the MAPI plugin 1.4.3 for vBulletin 3.x has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/81474; http://secunia.com/advisories/48917; http://www.securityfocus.com/bid/53226
CVE: CVE-2012-4329
Published: 2012-08-14
Description: The Samsung D6000 TV and possibly other products allow remote attackers to cause a denial of service (continuous restart) via a crafted controller name.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/samsux_1-adv.txt; http://archives.neohapsis.com/archives/bugtraq/2012-04/0142.html; http://www.exploit-db.com/exploits/18751
CVE: CVE-2012-4330
Published: 2012-08-14
Description: The Samsung D6000 TV and possibly other products allows remote attackers to cause a denial of service (crash) via a long string in certain fields, as demonstrated by the MAC address field, possibly a buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/samsux_1-adv.txt; http://archives.neohapsis.com/archives/bugtraq/2012-04/0142.html; http://www.exploit-db.com/exploits/18751
CVE: CVE-2012-4331
Published: 2012-08-14
Description: Multiple unspecified vulnerabilities in SPIP before 1.9.2.o, 2.0.x before 2.0.18, and 2.1.x before 2.1.13 have unknown impact and attack vectors that are not related to cross-site scripting (XSS), different vulnerabilities than CVE-2012-2151.
CVSS Score: 10.0 (HIGH)
References: http://archives.rezo.net/archives/spip-en.mbox/U5QUZ6WJRAJC7H5BR7W5SQG6WCD3PXL7/; http://www.securitytracker.com/id?1026970; http://archives.rezo.net/archives/spip-en.mbox/U5QUZ6WJRAJC7H5BR7W5SQG6WCD3PXL7/
CVE: CVE-2012-4332
Published: 2012-08-14
Description: The ShareYourCart plugin 1.7.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors related to the SDK.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/48960; http://wordpress.org/extend/plugins/shareyourcart/changelog/; http://www.securityfocus.com/bid/53241
CVE: CVE-2012-4333
Published: 2012-08-14
Description: Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0 ActiveX controls in Samsung NET-i viewer 1.37.120316 allow remote attackers to execute arbitrary code via a long string in the fname parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/48966; http://www.exploit-db.com/exploits/18765; http://www.securityfocus.com/bid/53193
CVE: CVE-2012-4334
Published: 2012-08-14
Description: The ConnectDDNS method in the (1) STWConfigNVR 1.1.13.15 and (2) STWConfig 1.1.14.13 ActiveX controls in Samsung NET-i viewer 1.37.120316 allows remote attackers to execute arbitrary code via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/48965; http://www.exploit-db.com/exploits/18765; http://www.securityfocus.com/bid/53193
CVE: CVE-2012-4335
Published: 2012-08-14
Description: Samsung NET-i viewer 1.37.120316 allows remote attackers to cause a denial of service (infinite loop) via a negative size value in a TCP request to (1) NiwMasterService or (2) NiwStorageService.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/48825; http://www.exploit-db.com/exploits/18765; http://www.securityfocus.com/bid/53193
CVE: CVE-2012-2070
Published: 2012-08-14
Description: Cross-site scripting (XSS) vulnerability in the MultiBlock module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the administer blocks permission to inject arbitrary web script or HTML via the block title.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1505410; http://drupal.org/node/1505414; http://drupal.org/node/1506390
CVE: CVE-2012-2071
Published: 2012-08-14
Description: Cross-site scripting (XSS) vulnerability in the Contact Forms module 6.x-1.x before 6.x-1.13 for Drupal when the core contact form is enabled, allows remote authenticated users with the administer site-wide contact form permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1506330; http://drupal.org/node/1506404; http://osvdb.org/80674
CVE: CVE-2012-2072
Published: 2012-08-14
Description: Cross-site scripting (XSS) vulnerability in the Share Buttons (AddToAny) module 6.x-3.x before 6.x-3.4 for Drupal allows remote authenticated users with the administer addtoany permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1083664; http://drupal.org/node/1506412; http://osvdb.org/80675
CVE: CVE-2012-2073
Published: 2012-08-14
Description: The Bundle copy module 7.x-1.x before 7.x-1.1 for Drupal does not check for the "use PHP for settings" permission while importing settings, which allows remote authenticated users with certain permissions to execute arbitrary PHP code via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1506166; http://drupal.org/node/1506420; http://drupalcode.org/project/bundle_copy.git/commit/299bdca
CVE: CVE-2012-2074
Published: 2012-08-14
Description: Unspecified vulnerability in certain default views in the Ubercart Views module 6.x before 6.x-3.2 for Drupal allows remote attackers to obtain sensitive information via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://drupal.org/node/1505210; http://drupal.org/node/1506428; http://osvdb.org/80677
CVE: CVE-2012-2075
Published: 2012-08-14
Description: Cross-site scripting (XSS) vulnerability in the Contact Save module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the access site-wide contact form permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1506438; http://drupal.org/node/953788; http://drupalcode.org/project/contact_save.git/commit/0654894
CVE: CVE-2012-2076
Published: 2012-08-14
Description: Cross-site scripting (XSS) vulnerability in the administration forms in the ShareThis module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with administer sharethis permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1504746; http://drupal.org/node/1506448; http://drupalcode.org/project/sharethis.git/commit/11f247a
CVE: CVE-2012-2077
Published: 2012-08-14
Description: Cross-site request forgery (CSRF) vulnerability in the ShareThis module 7.x-2.x before 7.x-2.3 for Drupal allows remote attackers to hijack the authentication of users with administer sharethis permissions via unknown vectors "outside of the Form API."
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1504746; http://drupal.org/node/1506448; http://drupalcode.org/project/sharethis.git/commit/11f247a
CVE: CVE-2012-2080
Published: 2012-08-14
Description: Cross-site request forgery (CSRF) vulnerability in the Node Limit Number module before 6.x-1.2 for Drupal allows remote attackers to hijack the authentication of users with the administer node limitnumber permission for requests that delete limits.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1506594; http://drupal.org/node/1506728; http://drupalcode.org/project/node_limitnumber.git/commit/90f0d3a
CVE: CVE-2012-2081
Published: 2012-08-14
Description: The Organic Groups (OG) module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access, which allows remote attackers to obtain sensitive information such as private group titles via a request through the Views module.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1507328; http://drupal.org/node/1507446; http://osvdb.org/80678
CVE: CVE-2012-2082
Published: 2012-08-14
Description: Cross-site scripting (XSS) vulnerability in the Chaos tool suite (aka CTools) module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the post comments permission to inject arbitrary web script or HTML via a user signature.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1507412; http://drupal.org/node/1507466; http://drupalcode.org/project/ctools.git/commit/755b3c4