deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-0301
Published: 2012-07-05
Description: Session fixation vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/54135; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120626_00; http://www.securityfocus.com/bid/54135
CVE: CVE-2012-0302
Published: 2012-07-05
Description: Cross-site scripting (XSS) vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/54134; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120626_00; http://www.securityfocus.com/bid/54134
CVE: CVE-2012-0303
Published: 2012-07-05
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Brightmail Control Center in Symantec Message Filter 6.3 allow remote attackers to hijack the authentication of arbitrary users for requests that (1) execute application commands or (2) create admin accounts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/54133; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120626_00; http://www.securityfocus.com/bid/54133
CVE: CVE-2012-2640
Published: 2012-07-05
Description: The NEC BIGLOBE Yome Collection application 1.8.3 and earlier for Android allows remote attackers to read the IMEI value from an SD card via a crafted application that lacks the READ_PHONE_STATE permission.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN05102851/995355/index.html; http://jvn.jp/en/jp/JVN05102851/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000064
CVE: CVE-2012-2641
Published: 2012-07-05
Description: Cross-site scripting (XSS) vulnerability in Zenphoto before 1.4.3 allows remote attackers to inject arbitrary web script or HTML by triggering improper interaction with an unspecified library.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN59842447/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000065; http://www.zenphoto.org/news/zenphoto-1.4.3
CVE: CVE-2012-2018
Published: 2012-07-05
Description: Cross-site scripting (XSS) vulnerability in HP Network Node Manager i (NNMi) 8.x, 9.0x, and 9.1x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03343724; http://www.securitytracker.com/id?1027215; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03343724
CVE: CVE-2012-3585
Published: 2012-07-05
Description: Heap-based buffer overflow in jpeg_ls.dll in the Jpeg_LS (aka JLS) plugin in the formats plugins in IrfanView PlugIns before 4.34 allows remote attackers to execute arbitrary code via a crafted JLS file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-06/0191.html; http://www.reactionpenetrationtesting.co.uk/Irfanview-JLS-Heap-Overflow.html; http://archives.neohapsis.com/archives/bugtraq/2012-06/0191.html
CVE: CVE-2012-2386
Published: 2012-07-07
Description: Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://0x1byte.blogspot.com/2011/04/php-phar-extension-heap-overflow.html; http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=158d8a6b088662ce9d31e0c777c6ebe90efdc854; http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
CVE: CVE-2012-2642
Published: 2012-07-07
Description: Cross-site scripting (XSS) vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2644.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN80835745/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000067; http://www.hazama.nu/pukiwiki/index.php?MT4i%2F3.1
CVE: CVE-2012-2643
Published: 2012-07-07
Description: Cross-site scripting (XSS) vulnerability in KENT-WEB YY-BOARD before 6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted form entry.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN03582364/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000068; http://www.kent-web.com/bbs/yybbs.html
CVE: CVE-2012-2644
Published: 2012-07-07
Description: Cross-site scripting (XSS) vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2642.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN79111101/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000069; http://www.hazama.nu/pukiwiki/index.php?MT4i%2F3.1
CVE: CVE-2012-3374
Published: 2012-07-07
Description: Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://hg.pidgin.im/pidgin/main/rev/ded93865ef42; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00009.html; http://rhn.redhat.com/errata/RHSA-2012-1102.html
CVE: CVE-2012-3372
Published: 2012-07-09
Description: The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities.  NOTE: the vendor disputes the significance of this issue because the appliance "does not allow import or export of the foresaid private key.
CVSS Score: 7.4 (HIGH)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2012-07/0021.html; http://blog.cyberoam.com/2012/07/ssl-bridging-cyberoam-approach/; http://www.theregister.co.uk/2012/07/07/cyberoam_tor_ssl_spying_flap/
CVE: CVE-2012-3863
Published: 2012-07-09
Description: channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a provisional response to a SIP reINVITE request, which allows remote authenticated users to cause a denial of service (RTP port exhaustion) via sessions that lack final responses.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://downloads.asterisk.org/pub/security/AST-2012-010.html; http://secunia.com/advisories/50687; http://secunia.com/advisories/50756
CVE: CVE-2012-2446
Published: 2012-07-09
Description: Cross-site scripting (XSS) vulnerability in tools/local_lookup.php in the WebAdmin Portal in Netsweeper allows remote attackers to inject arbitrary web script or HTML via the group parameter in a lookup action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://infosec42.blogspot.com/2012/07/cve-2012-2446-cve-2012-2447-cve-2012.html; http://www.kb.cert.org/vuls/id/763795; http://infosec42.blogspot.com/2012/07/cve-2012-2446-cve-2012-2447-cve-2012.html
CVE: CVE-2012-2447
Published: 2012-07-09
Description: Cross-site request forgery (CSRF) vulnerability in accountmgr/adminupdate.php in the WebAdmin Portal in Netsweeper allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via an add action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://infosec42.blogspot.com/2012/07/cve-2012-2446-cve-2012-2447-cve-2012.html; http://www.kb.cert.org/vuls/id/763795; http://infosec42.blogspot.com/2012/07/cve-2012-2446-cve-2012-2447-cve-2012.html
CVE: CVE-2012-3859
Published: 2012-07-09
Description: Unspecified vulnerability in the WebAdmin Portal in Netsweeper has unknown impact and attack vectors, a different vulnerability than CVE-2012-2446 and CVE-2012-2447.
CVSS Score: 10.0 (HIGH)
References: http://infosec42.blogspot.com/2012/07/cve-2012-2446-cve-2012-2447-cve-2012.html; http://infosec42.blogspot.com/2012/07/cve-2012-2446-cve-2012-2447-cve-2012.html
CVE: CVE-2012-1493
Published: 2012-07-09
Description: F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html; http://www.theregister.co.uk/2012/06/13/f5_kit_metasploit_exploit/; https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/f5_bigip_known_privkey.rb
CVE: CVE-2012-2138
Published: 2012-07-09
Description: The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://mail-archives.apache.org/mod_mbox/www-announce/201207.mbox/%3CCAEWfVJ=PwoQmwJg0KmbrC17Gw51kgfKRsqgy=4RpMQsdGh0bVg%40mail.gmail.com%3E; http://svn.apache.org/viewvc?view=revision&revision=1352865; https://issues.apache.org/jira/browse/SLING-2517
CVE: CVE-2012-2970
Published: 2012-07-09
Description: The Synel SY-780/A Time & Attendance terminal allows remote attackers to cause a denial of service (device hang) via network traffic to port (1) 1641, (2) 3734, or (3) 3735.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.kb.cert.org/vuls/id/154307; http://www.kb.cert.org/vuls/id/154307
CVE: CVE-2012-3238
Published: 2012-07-09
Description: Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gateway before 8.305 allows remote attackers to inject arbitrary web script or HTML via the "Comment (optional)" field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-06/0206.html; http://security.inshell.net/advisory/27; http://www.astaro.com/en-uk/blog/up2date/8305
CVE: CVE-2012-3812
Published: 2012-07-09
Description: Double free vulnerability in apps/app_voicemail.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones allows remote authenticated users to cause a denial of service (daemon crash) by establishing multiple voicemail sessions and accessing both the Urgent mailbox and the INBOX mailbox.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://downloads.asterisk.org/pub/security/AST-2012-011.html; http://secunia.com/advisories/50687; http://secunia.com/advisories/50756
CVE: CVE-2012-0175
Published: 2012-07-10
Description: The Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted name for a (1) file or (2) directory, aka "Command Injection Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-192A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-048; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14897
CVE: CVE-2012-1522
Published: 2012-07-10
Description: Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Cached Object Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-192A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-044; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15464
CVE: CVE-2012-1524
Published: 2012-07-10
Description: Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Attribute Remove Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-192A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-044; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15595
CVE: CVE-2012-1854
Published: 2012-07-10
Description: Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.us-cert.gov/cas/techalerts/TA12-192A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14950
CVE: CVE-2012-1859
Published: 2012-07-10
Description: Cross-site scripting (XSS) vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "XSS scriptresx.ashx Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.us-cert.gov/cas/techalerts/TA12-192A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15589
CVE: CVE-2012-1860
Published: 2012-07-10
Description: Microsoft Office SharePoint Server 2007 SP2 and SP3, SharePoint Server 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 do not properly check permissions for search scopes, which allows remote authenticated users to obtain sensitive information or cause a denial of service (data modification) by changing a parameter in a search-scope URL, aka "SharePoint Search Scope Vulnerability."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15265; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050
CVE: CVE-2012-1861
Published: 2012-07-10
Description: Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "SharePoint Script in Username Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.us-cert.gov/cas/techalerts/TA12-192A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15544
CVE: CVE-2012-1862
Published: 2012-07-10
Description: Open redirect vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "SharePoint URL Redirection Vulnerability."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15657; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050
CVE: CVE-2012-1863
Published: 2012-07-10
Description: Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "SharePoint Reflected List Parameter Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.us-cert.gov/cas/techalerts/TA12-192A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15689
CVE: CVE-2012-1870
Published: 2012-07-10
Description: The CBC mode in the TLS protocol, as used in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and other products, allows remote web servers to obtain plaintext data by triggering multiple requests to a third-party HTTPS server and sniffing the network during the resulting HTTPS session, aka "TLS Protocol Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.us-cert.gov/cas/techalerts/TA12-192A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-049; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15644
CVE: CVE-2012-1890
Published: 2012-07-10
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle keyboard-layout files, which allows local users to gain privileges via a crafted application, aka "Keyboard Layout Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/cas/techalerts/TA12-192A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-047; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15416
CVE: CVE-2012-1891
Published: 2012-07-10
Description: Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary code via crafted XML data that triggers access to an uninitialized object in memory, aka "ADO Cachesize Heap Overflow RCE Vulnerability."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-908
References: http://www.us-cert.gov/cas/techalerts/TA12-192A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-045; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14783
CVE: CVE-2012-1893
Published: 2012-07-10
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate callback parameters during creation of a hook procedure, which allows local users to gain privileges via a crafted application, aka "Win32k Incorrect Type Handling Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/cas/techalerts/TA12-192A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-047; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15654
CVE: CVE-2012-1894
Published: 2012-07-10
Description: Microsoft Office for Mac 2011 uses world-writable permissions for the "Applications/Microsoft Office 2011/" directory and certain other directories, which allows local users to gain privileges by placing a Trojan horse executable file in one of these directories, aka "Office for Mac Improper Folder Permissions Vulnerability."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://www.us-cert.gov/cas/techalerts/TA12-192A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-051; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15602
CVE: CVE-2012-2019
Published: 2012-07-11
Description: Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1325.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03397769; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03397769
CVE: CVE-2012-2020
Published: 2012-07-11
Description: Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1326.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03397769; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03397769
CVE: CVE-2011-4298
Published: 2012-07-11
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=48346fb11f8ced06a05c0618b02a3a925b34ec59; http://moodle.org/mod/forum/discuss.php?d=188309; https://bugzilla.redhat.com/show_bug.cgi?id=747444
CVE: CVE-2011-4299
Published: 2012-07-11
Description: Cross-site scripting (XSS) vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=a459fd90625ae44d7b3ac10b65da2dc631a418e7; http://moodle.org/mod/forum/discuss.php?d=188310; https://bugzilla.redhat.com/show_bug.cgi?id=747444
CVE: CVE-2011-4300
Published: 2012-07-11
Description: The file_browser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=f6b07c4da54a9db24723beb147e8a19a3d487e00; http://moodle.org/mod/forum/discuss.php?d=188311; https://bugzilla.redhat.com/show_bug.cgi?id=747444
CVE: CVE-2011-4301
Published: 2012-07-11
Description: The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the values of constant fields.
CVSS Score: 5.0 (MEDIUM)
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=f1f70bd4dde6cd1ea4bdb8ab28fa3d36a53b89d8; http://moodle.org/mod/forum/discuss.php?d=188313; https://bugzilla.redhat.com/show_bug.cgi?id=747444