deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-4840
Published: 2011-09-27
Description: Multiple buffer overflows in the Syslog server in ManageEngine EventLog Analyzer 6.1 allow remote attackers to cause a denial of service (SysEvttCol.exe process crash) or possibly execute arbitrary code via a long Syslog PRI message header to UDP port (1) 513 or (2) 514. Fixed in 7.2 Build 7020.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.solutionary.com/index/SERT/Vuln-Disclosures/ManageEngine-Eventlog-Analyzer-Syslog-Renite-DoS-vuln.html; http://www.solutionary.com/index/SERT/Vuln-Disclosures/ManageEngine-Eventlog-Analyzer-Syslog-Renite-DoS-vuln.html
CVE: CVE-2010-4841
Published: 2011-09-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine EventLog Analyzer 6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) HOST_ID, (2) OS, (3) GROUP, (4) exportFile, (5) load, (6) type, or (7) tab parameter to INDEX.do, the (8) reported parameter to INDEX2.do, the (9) gId parameter to hostlist.do, the (10) newWindow parameter to globalSettings.do, or the (11) STATUS parameter to enableHost.do. Fixed in Build 9000.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.solutionary.com/index/SERT/Vuln-Disclosures/ManageEngine-XSS-vulnerabilities.html; http://www.solutionary.com/index/SERT/Vuln-Disclosures/ManageEngine-XSS-vulnerabilities.html
CVE: CVE-2011-3645
Published: 2011-09-27
Description: Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter to doccab/doclist.jsp, which leads to arbitrary permission changes; or (2) a modified UserIndex parameter to doccab/userprofile/editprofile.jsp, which selects the settings page of an arbitrary user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2011/Sep/283; http://securityreason.com/securityalert/8394; http://www.exploit-db.com/exploits/17897
CVE: CVE-2011-3684
Published: 2011-09-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in Tembria Server Monitor before 6.0.5 Build 2252 allow remote attackers to inject arbitrary web script or HTML via (1) the siteid parameter to logbook.asp, (2) the siteid parameter to monitor-events.asp, (3) the siteid parameter to reports-config-by-device.asp, (4) the siteid parameter to reports-config-by-monitor.asp, (5) the siteid parameter to reports-monitoring-queue.asp, (6) the action parameter to site-list.asp, the (7) siteid or (8) type parameter to event-history.asp, the (9) siteid or (10) type parameter to admin-history.asp, the (11) siteid or (12) id parameter to dashboard-view.asp, the (13) siteid or (14) dn parameter to device-events.asp, the (15) siteid or (16) submit parameter to device-finder.asp, the (17) siteid or (18) dn parameter to device-monitors.asp, the (19) siteid or (20) type parameter to device-views.asp, the (21) siteid or (22) type parameter to monitor-views.asp, the (23) siteid or (24) sel parameter to reports-list.asp, the (25) siteid, (26) action, or (27) sel parameter to monitor-list.asp, or the (28) siteid, (29) action, or (30) sel parameter to device-list.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.solutionary.com/index/SERT/Vuln-Disclosures/Tembria-Server-Monitor-XSS.html; http://www.solutionary.com/index/SERT/Vuln-Disclosures/Tembria-Server-Monitor-XSS.html
CVE: CVE-2011-3685
Published: 2011-09-27
Description: Tembria Server Monitor before 6.0.5 Build 2252 uses a substitution cipher to encrypt application credentials, which allows local users to obtain sensitive information by leveraging read access to (1) authentication.dat or (2) XML files in the Exports directory.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://www.solutionary.com/index/SERT/Vuln-Disclosures/Tembria-Server-Monitor-Weak-Xpto-Pwd-Storage.html; http://www.solutionary.com/index/SERT/Vuln-Disclosures/Tembria-Server-Monitor-Weak-Xpto-Pwd-Storage.html
CVE: CVE-2011-3686
Published: 2011-09-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in myAddressBook.asp in Sonexis ConferenceManager 9.2.11.0 and 9.3.14.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fname, (2) lname, (3) email_edit, (4) email, (5) email2, (6) email3, (7) sms, (8) sms_id, or (9) work parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.solutionary.com/index/SERT/Vuln-Disclosures/Sonexis-XSS-Vulnerabilities.html; http://www.solutionary.com/index/SERT/Vuln-Disclosures/Sonexis-XSS-Vulnerabilities.html
CVE: CVE-2011-3687
Published: 2011-09-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sonexis ConferenceManager 9.2.11.0 allow remote attackers to inject arbitrary web script or HTML via (1) the txtConferenceID parameter to HostLogin.asp, (2) the txtConferenceID parameter to ParticipantLogin.asp, (3) the acp parameter to ForgotPIN.asp, or the (4) Description, (5) title, or (6) Heading parameter to Error.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/8400; http://www.solutionary.com/index/SERT/Vuln-Disclosures/Sonexis-XSS-Vulnerabilities.html; http://securityreason.com/securityalert/8400
CVE: CVE-2011-3688
Published: 2011-09-27
Description: Multiple SQL injection vulnerabilities in Sonexis ConferenceManager 9.3.14.0 allow remote attackers to execute arbitrary SQL commands via (1) the g parameter to Conference/Audio/AudioResourceContainer.asp or (2) the txtConferenceID parameter to Login/HostLogin.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/8401; http://www.solutionary.com/index/SERT/Vuln-Disclosures/Sonexis-SQL-Injection.html; http://securityreason.com/securityalert/8401
CVE: CVE-2011-3689
Published: 2011-09-27
Description: Cross-site scripting (XSS) vulnerability in Licenses.html in Wibu-Systems CodeMeter WebAdmin 3.30 and 4.30 allows remote attackers to inject arbitrary web script or HTML via the BoxSerial parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.solutionary.com/index/SERT/Vuln-Disclosures/CodeMeter-WebAdmin.html; http://www.solutionary.com/index/SERT/Vuln-Disclosures/CodeMeter-WebAdmin.html
CVE: CVE-2011-3690
Published: 2011-09-27
Description: Untrusted search path vulnerability in PlotSoft PDFill PDF Editor 8.0 allows local users to gain privileges via a Trojan horse mfc70enu.dll or mfc80loc.dll in the current working directory.
CVSS Score: 9.3 (HIGH)
References: http://www.solutionary.com/index/SERT/Vuln-Disclosures/PDFill-Insecure-Library.html; http://www.solutionary.com/index/SERT/Vuln-Disclosures/PDFill-Insecure-Library.html
CVE: CVE-2011-3691
Published: 2011-09-27
Description: Untrusted search path vulnerability in Foxit Reader before 5.0.2.0718 allows local users to gain privileges via a Trojan horse dwmapi.dll, dwrite.dll, or msdrm.dll in the current working directory.
CVSS Score: 9.3 (HIGH)
CWE: CWE-426
References: http://www.solutionary.com/index/SERT/Vuln-Disclosures/Foxit-Reader.html; http://www.solutionary.com/index/SERT/Vuln-Disclosures/Foxit-Reader.html
CVE: CVE-2011-3692
Published: 2011-09-27
Description: NetSaro Enterprise Messenger Server 2.0 stores cleartext console credentials in configuration.xml, which allows local users to obtain sensitive information by reading this file and performing a base64 decoding step.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://www.solutionary.com/index/SERT/Vuln-Disclosures/NetSaro-Enterprise-Messenger-Vulnerability.html; http://www.solutionary.com/index/SERT/Vuln-Disclosures/NetSaro-Enterprise-Messenger-Vulnerability.html
CVE: CVE-2011-3693
Published: 2011-09-27
Description: NetSaro Enterprise Messenger Server 2.0 allows local users to discover cleartext server credentials by reading the NetSaro.fdb file.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://www.solutionary.com/index/SERT/Vuln-Disclosures/NetSaro-Enterprise-Messenger-Vuln-Password.html; http://www.solutionary.com/index/SERT/Vuln-Disclosures/NetSaro-Enterprise-Messenger-Vuln-Password.html
CVE: CVE-2011-3694
Published: 2011-09-27
Description: The Server Administration Console in NetSaro Enterprise Messenger Server 2.0 allows remote attackers to read application source code by appending a %00 character to a URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.solutionary.com/index/SERT/Vuln-Disclosures/NetSaro-Enterprise-Messenger-Source-Code.html; http://www.solutionary.com/index/SERT/Vuln-Disclosures/NetSaro-Enterprise-Messenger-Source-Code.html
CVE: CVE-2011-3850
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the Atahualpa theme before 3.6.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/46297; https://sitewat.ch/en/Advisories/8; https://wpvulndb.com/vulnerabilities/9788
CVE: CVE-2011-3851
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://sitewat.ch/en/Advisories/9; https://sitewat.ch/en/Advisories/9
CVE: CVE-2011-3852
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://sitewat.ch/en/Advisories/10; https://sitewat.ch/en/Advisories/10
CVE: CVE-2011-3853
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the Hybrid theme before 0.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://sitewat.ch/en/Advisories/11; https://sitewat.ch/en/Advisories/11
CVE: CVE-2011-3854
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/46296; https://sitewat.ch/en/Advisories/12; http://secunia.com/advisories/46296
CVE: CVE-2011-3855
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://sitewat.ch/en/Advisories/13; https://sitewat.ch/en/Advisories/13
CVE: CVE-2011-3856
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://sitewat.ch/en/Advisories/14; https://sitewat.ch/en/Advisories/14
CVE: CVE-2011-3857
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://sitewat.ch/en/Advisories/15; https://sitewat.ch/en/Advisories/15
CVE: CVE-2011-3858
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://sitewat.ch/en/Advisories/16; https://sitewat.ch/en/Advisories/16
CVE: CVE-2011-3859
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://sitewat.ch/en/Advisories/17; https://sitewat.ch/en/Advisories/17
CVE: CVE-2011-3860
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/50334; https://sitewat.ch/en/Advisories/18; http://www.securityfocus.com/bid/50334
CVE: CVE-2011-3861
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://sitewat.ch/en/Advisories/19; https://sitewat.ch/en/Advisories/19
CVE: CVE-2011-3862
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/46295; https://sitewat.ch/en/Advisories/20; http://secunia.com/advisories/46295
CVE: CVE-2011-3863
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://sitewat.ch/en/Advisories/22; https://sitewat.ch/en/Advisories/22
CVE: CVE-2011-3864
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the The Erudite theme before 2.7.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://sitewat.ch/en/Advisories/23; https://sitewat.ch/en/Advisories/23
CVE: CVE-2011-3865
Published: 2011-09-28
Description: Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://sitewat.ch/en/Advisories/24; https://sitewat.ch/en/Advisories/24
CVE: CVE-2011-2372
Published: 2011-09-29
Description: Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent the starting of a download in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html; http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html; http://secunia.com/advisories/46315
CVE: CVE-2011-2995
Published: 2011-09-29
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html; http://secunia.com/advisories/46315; http://www.debian.org/security/2011/dsa-2312
CVE: CVE-2011-2996
Published: 2011-09-29
Description: Unspecified vulnerability in the plugin API in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html; http://www.mandriva.com/security/advisories?name=MDVSA-2011:139; http://www.mandriva.com/security/advisories?name=MDVSA-2011:140
CVE: CVE-2011-2997
Published: 2011-09-29
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html; http://secunia.com/advisories/46315; http://www.mandriva.com/security/advisories?name=MDVSA-2011:141
CVE: CVE-2011-2999
Published: 2011-09-29
Description: Mozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before 6.0, and SeaMonkey before 2.3 do not properly handle "location" as the name of a frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, a different vulnerability than CVE-2010-0170.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html; http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html; http://secunia.com/advisories/46315
CVE: CVE-2011-3000
Published: 2011-09-29
Description: Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting attacks via crafted header values.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html; http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html; http://secunia.com/advisories/46315
CVE: CVE-2011-3001
Published: 2011-09-29
Description: Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent manual add-on installation in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that triggers an unspecified internal error.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html; http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html; http://secunia.com/advisories/46315
CVE: CVE-2011-3002
Published: 2011-09-29
Description: Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox before 7.0 and SeaMonkey before 2.4, does not validate the return value of a GrowAtomTable function call, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a memory-allocation error and a resulting buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.mandriva.com/security/advisories?name=MDVSA-2011:141; http://www.mozilla.org/security/announce/2011/mfsa2011-41.html; https://bugzilla.mozilla.org/show_bug.cgi?id=680840
CVE: CVE-2011-3003
Published: 2011-09-29
Description: Mozilla Firefox before 7.0 and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unspecified WebGL test case that triggers a memory-allocation error and a resulting out-of-bounds write operation.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.mandriva.com/security/advisories?name=MDVSA-2011:141; http://www.mozilla.org/security/announce/2011/mfsa2011-41.html; https://bugzilla.mozilla.org/show_bug.cgi?id=682335
CVE: CVE-2011-3004
Published: 2011-09-29
Description: The JSSubScriptLoader in Mozilla Firefox 4.x through 6 and SeaMonkey before 2.4 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping behavior.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.mandriva.com/security/advisories?name=MDVSA-2011:141; http://www.mozilla.org/security/announce/2011/mfsa2011-43.html; https://bugzilla.mozilla.org/show_bug.cgi?id=653926
CVE: CVE-2011-3005
Published: 2011-09-29
Description: Use-after-free vulnerability in Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OGG headers in a .ogg file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html; http://secunia.com/advisories/46315; http://secunia.com/advisories/49055
CVE: CVE-2011-3232
Published: 2011-09-29
Description: YARR, as used in Mozilla Firefox before 7.0, Thunderbird before 7.0, and SeaMonkey before 2.4, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted JavaScript.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html
CVE: CVE-2011-3504
Published: 2011-09-29
Description: The Matroska format decoder in FFmpeg before 0.8.3 does not properly allocate memory, which allows remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/45532; http://technet.microsoft.com/en-us/security/msvr/msvr11-011; http://ubuntu.com/usn/usn-1320-1
CVE: CVE-2011-3866
Published: 2011-09-29
Description: Mozilla Firefox before 7.0 and SeaMonkey before 2.4 do not properly restrict availability of motion data events, which makes it easier for remote attackers to read keystrokes by leveraging JavaScript code running in a background tab.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.mozilla.org/security/announce/2011/mfsa2011-45.html; http://www.usenix.org/events/hotsec11/tech/tech.html#Cai; https://bugzilla.mozilla.org/show_bug.cgi?id=682562
CVE: CVE-2011-3867
Published: 2011-09-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-2998.  Reason: This candidate is a duplicate of CVE-2011-2998.  Notes: All CVE users should reference CVE-2011-2998 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-2998
Published: 2011-09-30
Description: Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html; http://www.debian.org/security/2011/dsa-2312; http://www.debian.org/security/2011/dsa-2313
CVE: CVE-2011-3010
Published: 2011-09-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in TWiki before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the newtopic parameter in a WebCreateNewTopic action, related to the TWiki.WebCreateNewTopicTemplate topic; or (2) the query string to SlideShow.pm in the SlideShowPlugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2011-09/0142.html; http://develop.twiki.org/trac/changeset/21920; http://secunia.com/advisories/46123
CVE: CVE-2011-3369
Published: 2011-09-30
Description: The add_conversation function in conversations.c in EtherApe before 0.9.12 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RPC packet, related to the get_rpc function in decode_proto.c.
CVSS Score: 5.0 (MEDIUM)
References: http://etherape.sourceforge.net/NEWS.html; http://secunia.com/advisories/45989; http://sourceforge.net/tracker/?func=detail&aid=3309061&group_id=2712&atid=102712