deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-0887
Published: 2013-02-23
Description: The developer-tools process in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict privileges during interaction with a connected server, which has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=170836
CVE: CVE-2013-0888
Published: 2013-02-23
Description: Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to a "user gesture check for dangerous file downloads."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=170666
CVE: CVE-2013-0889
Published: 2013-02-23
Description: Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly enforce a user gesture requirement before proceeding with a file download, which might make it easier for remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=170569
CVE: CVE-2013-0890
Published: 2013-02-23
Description: Multiple unspecified vulnerabilities in the IPC layer in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allow remote attackers to cause a denial of service (memory corruption) or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=169966
CVE: CVE-2013-0891
Published: 2013-02-23
Description: Integer overflow in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a blob.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=169685
CVE: CVE-2013-0892
Published: 2013-02-23
Description: Multiple unspecified vulnerabilities in the IPC layer in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=164946
CVE: CVE-2013-0893
Published: 2013-02-23
Description: Race condition in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to media.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=168570
CVE: CVE-2013-0894
Published: 2013-02-23
Description: Buffer overflow in the vorbis_parse_setup_hdr_floors function in the Vorbis decoder in vorbisdec.c in libavcodec in FFmpeg through 1.1.3, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds array access) or possibly have unspecified other impact via vectors involving a zero value for a bark map size.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://git.chromium.org/gitweb/?p=chromium/deps/ffmpeg.git%3Ba=commit%3Bh=e1e70d9bb9852b7d099379afc95531a632a20ba5; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=2c16bf2de07c68513072bf3cc96401d2c6291a3e; http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
CVE: CVE-2013-0895
Published: 2013-02-23
Description: Google Chrome before 25.0.1364.97 on Linux, and before 25.0.1364.99 on Mac OS X, does not properly handle pathnames during copy operations, which might make it easier for remote attackers to execute arbitrary programs via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=167840
CVE: CVE-2013-0896
Published: 2013-02-23
Description: Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly manage memory during message handling for plug-ins, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=166708
CVE: CVE-2013-0897
Published: 2013-02-23
Description: Off-by-one error in the PDF functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service via a crafted document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-193
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=165537
CVE: CVE-2013-0898
Published: 2013-02-23
Description: Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=164643
CVE: CVE-2013-0899
Published: 2013-02-23
Description: Integer overflow in the padding implementation in the opus_packet_parse_impl function in src/opus_decoder.c in Opus before 1.0.2, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a long packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-190
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; http://opus-codec.org/downloads/
CVE: CVE-2013-0900
Published: 2013-02-23
Description: Race condition in the International Components for Unicode (ICU) functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://jvn.jp/en/jp/JVN70739377/index.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html
CVE: CVE-2013-2268
Published: 2013-02-23
Description: Unspecified vulnerability in the MathML implementation in WebKit in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, has unknown impact and remote attack vectors, related to a "high severity security issue."
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16329; http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
CVE: CVE-2012-0439
Published: 2013-02-24
Description: An ActiveX control in gwcls1.dll in the client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code via (1) a pointer argument to the SetEngine method or (2) an XPItem pointer argument to an unspecified method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.novell.com/support/kb/doc.php?id=7011688; http://www.zerodayinitiative.com/advisories/ZDI-13-008/; https://bugzilla.novell.com/show_bug.cgi?id=712144
CVE: CVE-2013-0804
Published: 2013-02-24
Description: The client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www.novell.com/support/kb/doc.php?id=7011687; https://bugzilla.novell.com/show_bug.cgi?id=792535; https://www.htbridge.com/advisory/HTB23131
CVE: CVE-2012-4704
Published: 2013-02-24
Description: Array index error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via a crafted packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-050-01A; http://ics-cert.us-cert.gov/advisories/ICSA-13-050-01A
CVE: CVE-2012-4705
Published: 2013-02-24
Description: Directory traversal vulnerability in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors involving a crafted pathname.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-050-01A; http://ics-cert.us-cert.gov/advisories/ICSA-13-050-01A
CVE: CVE-2012-4706
Published: 2013-02-24
Description: Integer signedness error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to cause a denial of service via a crafted packet that triggers a heap-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-050-01A; http://ics-cert.us-cert.gov/advisories/ICSA-13-050-01A
CVE: CVE-2012-4707
Published: 2013-02-24
Description: 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors that trigger an out-of-bounds memory access.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-050-01A; http://ics-cert.us-cert.gov/advisories/ICSA-13-050-01A
CVE: CVE-2012-4708
Published: 2013-02-24
Description: Stack-based buffer overflow in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via a crafted packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-050-01A; http://ics-cert.us-cert.gov/advisories/ICSA-13-050-01A
CVE: CVE-2012-6273
Published: 2013-02-24
Description: SQL injection vulnerability in BigAntSoft BigAnt IM Message Server allows remote attackers to execute arbitrary SQL commands via an SHU (aka search user) request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/990652; http://www.kb.cert.org/vuls/id/990652
CVE: CVE-2012-6274
Published: 2013-02-24
Description: BigAntSoft BigAnt IM Message Server does not require authentication for file uploading, which allows remote attackers to create arbitrary files under AntServer\DocData\Public via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/990652; http://www.kb.cert.org/vuls/id/990652
CVE: CVE-2012-6275
Published: 2013-02-24
Description: Multiple stack-based buffer overflows in AntDS.exe in BigAntSoft BigAnt IM Message Server allow remote attackers to have an unspecified impact via (1) the filename header in an SCH request or (2) the userid component in a DUPF request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/990652; http://www.kb.cert.org/vuls/id/990652
CVE: CVE-2013-0108
Published: 2013-02-24
Description: An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1, and R410.2; ComfortPoint Open Manager (aka CPO-M) Station R100; and HMIWeb Browser client packages allows remote attackers to execute arbitrary code via a crafted HTML document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://ics-cert.us-cert.gov/pdf/ICSA-13-053-02.pdf; http://ics-cert.us-cert.gov/pdf/ICSA-13-053-02.pdf
CVE: CVE-2013-0113
Published: 2013-02-24
Description: Nuance PDF Reader 7.0 and PDF Viewer Plus 7.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/248449; http://www.kb.cert.org/vuls/id/248449
CVE: CVE-2013-0118
Published: 2013-02-24
Description: CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://www.kb.cert.org/vuls/id/583564; http://www.kb.cert.org/vuls/id/BLUU-949PQL; http://www.kb.cert.org/vuls/id/583564
CVE: CVE-2013-0120
Published: 2013-02-24
Description: The web interface on Dell PowerConnect 6248P switches allows remote attackers to cause a denial of service (device crash) via a malformed request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/160460; http://www.kb.cert.org/vuls/id/160460
CVE: CVE-2013-0785
Published: 2013-02-24
Description: Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before 4.2.5, and 4.3.x and 4.4.x before 4.4rc2 allows remote attackers to inject arbitrary web script or HTML via the id parameter in conjunction with an invalid value of the format parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.bugzilla.org/security/3.6.12/; http://www.mandriva.com/security/advisories?name=MDVSA-2013:066; https://bugzilla.mozilla.org/show_bug.cgi?id=842038
CVE: CVE-2013-0786
Published: 2013-02-24
Description: The Bugzilla::Search::build_subselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different error messages for invalid product queries depending on whether a product exists, which allows remote attackers to discover private product names by using debug mode for a query.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.bugzilla.org/security/3.6.12/; http://www.mandriva.com/security/advisories?name=MDVSA-2013:066; https://bugzilla.mozilla.org/show_bug.cgi?id=824399
CVE: CVE-2012-5624
Published: 2013-02-24
Description: The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain sensitive information via a file: URL to a QML application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2013-01/msg00034.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00045.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00048.html
CVE: CVE-2012-6093
Published: 2013-02-24
Description: The QSslSocket::sslErrors function in Qt before 4.6.5, 4.7.x before 4.7.6, 4.8.x before 4.8.5, when using certain versions of openSSL, uses an "incompatible structure layout" that can read memory from the wrong location, which causes Qt to report an incorrect error when certificate validation fails and might cause users to make unsafe security decisions to accept a certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=697582; http://lists.opensuse.org/opensuse-updates/2013-01/msg00086.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00089.html
CVE: CVE-2012-6128
Published: 2013-02-24
Description: Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service (application crash) via a long (1) hostname, (2) path, or (3) cookie list in a response.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://git.infradead.org/users/dwmw2/openconnect.git/commitdiff/26f752c3dbf69227679fc6bebb4ae071aecec491; http://lists.opensuse.org/opensuse-updates/2013-06/msg00115.html; http://www.debian.org/security/2013/dsa-2623
CVE: CVE-2013-0219
Published: 2013-02-24
Description: System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files.
CVSS Score: 3.7 (LOW)
CWE: CWE-264
References: http://git.fedorahosted.org/cgit/sssd.git/commit/?id=020bf88fd1c5bdac8fc671b37c7118f5378c7047; http://git.fedorahosted.org/cgit/sssd.git/commit/?id=3843b284cd3e8f88327772ebebc7249990fd87b9; http://git.fedorahosted.org/cgit/sssd.git/commit/?id=94cbf1cfb0f88c967f1fb0a4cf[PII_REDACTED]8e4a
CVE: CVE-2013-0220
Published: 2013-02-24
Description: The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to cause a denial of service (out-of-bounds read, crash, and restart) via a crafted SSSD packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://git.fedorahosted.org/cgit/sssd.git/commit/?id=2bd514cfde1938b1e245af11c9b548d58d49b325; http://git.fedorahosted.org/cgit/sssd.git/commit/?id=30e2585dd46b62aa3a4abdf6de3f40a20e1743ab; http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098434.html
CVE: CVE-2013-0247
Published: 2013-02-24
Description: OpenStack Keystone Essex 2012.1.3 and earlier, Folsom 2012.2.3 and earlier, and Grizzly grizzly-2 and earlier allows remote attackers to cause a denial of service (disk consumption) via many invalid token requests that trigger excessive generation of log entries.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098906.html; http://rhn.redhat.com/errata/RHSA-2013-0253.html; http://www.securityfocus.com/bid/57747
CVE: CVE-2012-5337
Published: 2013-02-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in jforum.page in JForum 2.1.9 allow remote attackers to inject arbitrary web script or HTML via the (1) action, (2) match_type, (3) sort_by, or (4) start parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.zerodaylab.com/zdl-advisories/2012-5337.html; http://www.zerodaylab.com/zdl-advisories/2012-5337.html
CVE: CVE-2012-2697
Published: 2013-02-24
Description: Unspecified vulnerability in autofs, as used in Red Hat Enterprise Linux (RHEL) 5, allows local users to cause a denial of service (autofs crash and delayed mounts) or prevent "mount expiration" via unspecified vectors related to "using an LDAP-based automount map."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://rhn.redhat.com/errata/RHSA-2013-0132.html; http://www.osvdb.org/89878
CVE: CVE-2012-5646
Published: 2013-02-24
Description: node-util/www/html/restorer.php in the Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to execute arbitrary commands via a crafted uuid in the PATH_INFO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2013-0148.html; http://www.osvdb.org/89431; http://www.securityfocus.com/bid/57189
CVE: CVE-2012-5647
Published: 2013-02-24
Description: Open redirect vulnerability in node-util/www/html/restorer.php in Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the PATH_INFO.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2013-0148.html; http://www.osvdb.org/89430; http://www.securityfocus.com/bid/57189
CVE: CVE-2012-6121
Published: 2013-02-24
Description: Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2013-02/msg00051.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html; http://sourceforge.net/news/?group_id=139281&id=310213
CVE: CVE-2013-0212
Published: 2013-02-24
Description: store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2013-0209.html; http://secunia.com/advisories/51957; http://secunia.com/advisories/51990
CVE: CVE-2012-5658
Published: 2013-02-24
Description: rhc-chk.rb in Red Hat OpenShift Origin before 1.1, when -d (debug mode) is used, outputs the password and other sensitive information in cleartext, which allows context-dependent attackers to obtain sensitive information, as demonstrated by including log files or Bugzilla reports in support channels.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2013-0220.html; https://bugzilla.redhat.com/show_bug.cgi?id=889062; http://rhn.redhat.com/errata/RHSA-2013-0220.html
CVE: CVE-2012-6072
Published: 2013-02-24
Description: CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2013-0220.html; http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb; https://bugzilla.redhat.com/show_bug.cgi?id=890607
CVE: CVE-2012-6073
Published: 2013-02-24
Description: Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2013-0220.html; http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb; http://www.openwall.com/lists/oss-security/2012/12/28/1