deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-1068
Published: 2011-02-23
Description: Microsoft Windows Azure Software Development Kit (SDK) 1.3.x before 1.3.20121.1237, when Full IIS and a Web Role are used with an ASP.NET application, does not properly support the use of cookies for maintaining state, which allows remote attackers to obtain potentially sensitive information by reading an encrypted cookie and performing unspecified other steps.
CVSS Score: 2.6 (LOW)
CWE: CWE-20
References: http://blogs.msdn.com/b/windowsazure/archive/2011/02/03/windows-azure-software-development-kit-sdk-refresh-released.aspx; http://secunia.com/advisories/43237; http://blogs.msdn.com/b/windowsazure/archive/2011/02/03/windows-azure-software-development-kit-sdk-refresh-released.aspx
CVE: CVE-2007-1783
Published: 2011-02-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-1685.  Reason: This candidate is a duplicate of CVE-2007-1685.  Notes: All CVE users should reference CVE-2007-1685 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-0452
Published: 2011-02-24
Description: Untrusted search path vulnerability in the script function in Lunascape before 6.4.3 allows local users to gain privileges via a Trojan horse executable file in the current working directory.
CVSS Score: 6.2 (MEDIUM)
References: http://jvn.jp/en/jp/JVN38362957/; http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000012.html; http://lunapedia.lunascape.jp/index.php?title=Lunascape6#2011.2F02.2F18_ver_6.4.3
CVE: CVE-2011-1011
Published: 2011-02-24
Description: The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0585.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056227.html; http://openwall.com/lists/oss-security/2011/02/23/1
CVE: CVE-2011-0372
Published: 2011-02-25
Description: The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote attackers to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31640.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml; http://www.securitytracker.com/id?1025112; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml
CVE: CVE-2011-0373
Published: 2011-02-25
Description: The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31685.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml; http://www.securitytracker.com/id?1025112; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml
CVE: CVE-2011-0374
Published: 2011-02-25
Description: The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31659.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml; http://www.securitytracker.com/id?1025112; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml
CVE: CVE-2011-0375
Published: 2011-02-25
Description: The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.6.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCth24671.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml; http://www.securitytracker.com/id?1025112; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml
CVE: CVE-2011-0376
Published: 2011-02-25
Description: The TFTP implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x, 1.6.0, and 1.6.1 allows remote attackers to obtain sensitive information via a GET request, aka Bug ID CSCte43876.
CVSS Score: 10.0 (HIGH)
CWE: CWE-200
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml; http://www.securitytracker.com/id?1025112; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml
CVE: CVE-2011-0377
Published: 2011-02-25
Description: Cisco TelePresence endpoint devices with software 1.2.x through 1.6.x allow remote attackers to cause a denial of service (service crash) via a malformed SOAP request in conjunction with a spoofed TelePresence Manager that supplies an invalid IP address, aka Bug ID CSCth03605.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml; http://www.securitytracker.com/id?1025112; https://exchange.xforce.ibmcloud.com/vulnerabilities/65616
CVE: CVE-2011-0378
Published: 2011-02-25
Description: The XML-RPC implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote attackers to execute arbitrary commands via a TCP request, related to a "command injection vulnerability," aka Bug ID CSCtb52587.
CVSS Score: 8.3 (HIGH)
CWE: CWE-78
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml; http://www.securitytracker.com/id?1025112; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml
CVE: CVE-2011-0379
Published: 2011-02-25
Description: Buffer overflow on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 1.6.x; Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x; Cisco TelePresence endpoint devices with software 1.2.x through 1.6.x; and Cisco TelePresence Manager 1.2.x, 1.3.x, 1.4.x, 1.5.x, and 1.6.2 allows remote attackers to execute arbitrary code via a crafted Cisco Discovery Protocol packet, aka Bug IDs CSCtd75769, CSCtd75766, CSCtd75754, and CSCtd75761.
CVSS Score: 7.9 (HIGH)
CWE: CWE-119
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e11d.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14e.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14f.shtml
CVE: CVE-2011-0380
Published: 2011-02-25
Description: Cisco TelePresence Manager 1.2.x through 1.6.x allows remote attackers to bypass authentication and invoke arbitrary methods via a malformed SOAP request, aka Bug ID CSCtc59562.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14f.shtml; http://www.securityfocus.com/bid/46526; http://www.securitytracker.com/id?1025111
CVE: CVE-2011-0381
Published: 2011-02-25
Description: Cisco TelePresence Manager 1.2.x through 1.6.x allows remote attackers to perform unspecified actions and consequently execute arbitrary code via a crafted request to the Java RMI interface, related to a "command injection vulnerability," aka Bug ID CSCtf97085.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14f.shtml; http://www.securityfocus.com/bid/46526; http://www.securitytracker.com/id?1025111
CVE: CVE-2011-0382
Published: 2011-02-25
Description: The CGI subsystem on Cisco TelePresence Recording Server devices with software 1.6.x before 1.6.2 allows remote attackers to execute arbitrary commands via a request to TCP port 443, related to a "command injection vulnerability," aka Bug ID CSCtf97221.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e11d.shtml; http://www.securityfocus.com/bid/46522; http://www.securitytracker.com/id?1025114
CVE: CVE-2011-0383
Published: 2011-02-25
Description: The Java Servlet framework on Cisco TelePresence Recording Server devices with software 1.6.x before 1.6.2 and Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x does not require administrative authentication for unspecified actions, which allows remote attackers to execute arbitrary code via a crafted request, aka Bug IDs CSCtf42005 and CSCtf42008.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e11d.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14e.shtml; http://www.securityfocus.com/bid/46519
CVE: CVE-2011-0384
Published: 2011-02-25
Description: The Java Servlet framework on Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x does not require administrative authentication for unspecified actions, which allows remote attackers to execute arbitrary code via a crafted request, aka Bug ID CSCtf01253.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14e.shtml; http://www.securityfocus.com/bid/46520; http://www.securitytracker.com/id?1025113
CVE: CVE-2011-0385
Published: 2011-02-25
Description: The administrative web interface on Cisco TelePresence Recording Server devices with software 1.6.x and Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x allows remote attackers to create or overwrite arbitrary files, and possibly execute arbitrary code, via a crafted request, aka Bug IDs CSCth85786 and CSCth61065.
CVSS Score: 10.0 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e11d.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14e.shtml; http://www.securitytracker.com/id?1025113
CVE: CVE-2011-0386
Published: 2011-02-25
Description: The XML-RPC implementation on Cisco TelePresence Recording Server devices with software 1.6.x and 1.7.x before 1.7.1 allows remote attackers to overwrite files and consequently execute arbitrary code via a malformed request, aka Bug ID CSCti50739.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e11d.shtml; http://www.securityfocus.com/bid/46522; http://www.securitytracker.com/id?1025114
CVE: CVE-2011-0387
Published: 2011-02-25
Description: The administrative web interface on Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x allows remote authenticated users to cause a denial of service or have unspecified other impact via vectors involving access to a servlet, aka Bug ID CSCtf97164.
CVSS Score: 8.0 (HIGH)
CWE: CWE-264
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14e.shtml; http://www.securityfocus.com/bid/46520; http://www.securitytracker.com/id?1025113
CVE: CVE-2011-0388
Published: 2011-02-25
Description: Cisco TelePresence Recording Server devices with software 1.6.x and Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x do not properly restrict remote access to the Java servlet RMI interface, which allows remote attackers to cause a denial of service (memory consumption and web outage) via multiple crafted requests, aka Bug IDs CSCtg35830 and CSCtg35825.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e11d.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14e.shtml; http://www.securityfocus.com/bid/46523
CVE: CVE-2011-0389
Published: 2011-02-25
Description: Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x allow remote attackers to cause a denial of service (process crash) via a crafted Real-Time Transport Control Protocol (RTCP) UDP packet, aka Bug ID CSCth60993.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14e.shtml; http://www.securityfocus.com/bid/46520; http://www.securitytracker.com/id?1025113
CVE: CVE-2011-0390
Published: 2011-02-25
Description: The XML-RPC implementation on Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x, 1.1.x, 1.5.x, 1.6.x, and 1.7.0 allows remote attackers to cause a denial of service (process crash) via a crafted request, aka Bug ID CSCtj44534.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14e.shtml; http://www.securityfocus.com/bid/46520; http://www.securitytracker.com/id?1025113
CVE: CVE-2011-0391
Published: 2011-02-25
Description: Cisco TelePresence Recording Server devices with software 1.6.x allow remote attackers to cause a denial of service (thread consumption and device outage) via a malformed request, related to an "ad hoc recording" issue, aka Bug ID CSCtf97205.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e11d.shtml; http://www.securityfocus.com/bid/46522; http://www.securitytracker.com/id?1025114
CVE: CVE-2011-0392
Published: 2011-02-25
Description: Cisco TelePresence Recording Server devices with software 1.6.x do not require authentication for an XML-RPC interface, which allows remote attackers to perform unspecified actions via a session on TCP port 8080, aka Bug ID CSCtg35833.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e11d.shtml; http://www.securityfocus.com/bid/46522; http://www.securitytracker.com/id?1025114
CVE: CVE-2011-0393
Published: 2011-02-25
Description: Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.0 before 7.0(8.12), 7.1 and 7.2 before 7.2(5.2), 8.0 before 8.0(5.21), 8.1 before 8.1(2.49), 8.2 before 8.2(3.6), and 8.3 before 8.3(2.7) and Cisco PIX Security Appliances 500 series devices, when transparent firewall mode is configured but IPv6 is not configured, allow remote attackers to cause a denial of service (packet buffer exhaustion and device outage) via IPv6 traffic, aka Bug ID CSCtj04707.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/43488; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14d.shtml; http://www.securitytracker.com/id?1025108
CVE: CVE-2011-0394
Published: 2011-02-25
Description: Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.0 before 7.0(8.11), 7.1 and 7.2 before 7.2(5.1), 8.0 before 8.0(5.19), 8.1 before 8.1(2.47), 8.2 before 8.2(2.19), and 8.3 before 8.3(1.8); Cisco PIX Security Appliances 500 series devices; and Cisco Firewall Services Module (aka FWSM) 3.1 before 3.1(20), 3.2 before 3.2(20), 4.0 before 4.0(15), and 4.1 before 4.1(5) allow remote attackers to cause a denial of service (device reload) via a malformed Skinny Client Control Protocol (SCCP) message, aka Bug IDs CSCtg69457 and CSCtl84952.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/43453; http://secunia.com/advisories/43488; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e148.shtml
CVE: CVE-2011-0395
Published: 2011-02-25
Description: Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.0 before 8.0(5.20), 8.1 before 8.1(2.48), 8.2 before 8.2(3), and 8.3 before 8.3(2.1), when the RIP protocol and the Cisco Phone Proxy functionality are configured, allow remote attackers to cause a denial of service (device reload) via a RIP update, aka Bug ID CSCtg66583.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/43488; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14d.shtml; http://www.securitytracker.com/id?1025108
CVE: CVE-2011-0396
Published: 2011-02-25
Description: Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.0 before 8.0(5.23), 8.1 before 8.1(2.49), 8.2 before 8.2(4.1), and 8.3 before 8.3(2.13), when a Certificate Authority (CA) is configured, allow remote attackers to read arbitrary files via unspecified vectors, aka Bug ID CSCtk12352.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/43488; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14d.shtml; http://www.securitytracker.com/id?1025108
CVE: CVE-2011-1100
Published: 2011-02-25
Description: Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) findfid, (2) id, (3) selectfcat, (4) selectfmon, or (5) selectftag parameter in an images action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/16160; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4992.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/65474
CVE: CVE-2011-0037
Published: 2011-02-25
Description: Microsoft Malware Protection Engine before 1.1.6603.0, as used in Microsoft Malicious Software Removal Tool (MSRT), Windows Defender, Security Essentials, Forefront Client Security, Forefront Endpoint Protection 2010, and Windows Live OneCare, allows local users to gain privileges via a crafted value of an unspecified user registry key.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/43468; http://securitytracker.com/id?1025117; http://www.microsoft.com/technet/security/advisory/2491888.mspx
CVE: CVE-2011-0926
Published: 2011-02-25
Description: A certain ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) does not properly verify the signature of an unspecified downloaded program, which allows remote attackers to execute arbitrary code by spoofing the CSD installation process, a different vulnerability than CVE-2010-0589.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/8105; http://www.securityfocus.com/archive/1/516647/100/0/threaded; http://www.securityfocus.com/bid/46536
CVE: CVE-2011-1036
Published: 2011-02-25
Description: The XML Security Database Parser class in the XMLSecDB ActiveX control in the HIPSEngine component in the Management Server before 8.1.0.88, and the client before 1.6.450, in CA Host-Based Intrusion Prevention System (HIPS) 8.1, as used in CA Internet Security Suite (ISS) 2010, allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via vectors involving the SetXml and Save methods.
CVSS Score: 8.8 (HIGH)
References: http://secunia.com/advisories/43377; http://secunia.com/advisories/43490; http://securityreason.com/securityalert/8106
CVE: CVE-2010-4227
Published: 2011-02-25
Description: The xdrDecodeString function in XNFS.NLM in Novell Netware 6.5 before SP8 allows remote attackers to cause a denial of service (abend) or execute arbitrary code via a crafted, signed value in a NFS RPC request to port UDP 1234, leading to a stack-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=1z3z-OsVCiE~; http://secunia.com/advisories/43431; http://securityreason.com/securityalert/8104
CVE: CVE-2011-0332
Published: 2011-02-25
Description: Integer overflow in Foxit Reader before 4.3.1.0218 and Foxit Phantom before 2.3.3.1112 allows remote attackers to execute arbitrary code via crafted ICC chunks in a PDF file, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/43329; http://secunia.com/advisories/43440; http://secunia.com/secunia_research/2011-14/
CVE: CVE-2011-0717
Published: 2011-02-25
Description: Session fixation vulnerability in Red Hat Network (RHN) Satellite Server 5.4 allows remote attackers to hijack web sessions via unspecified vectors related to Spacewalk.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/43487; http://www.redhat.com/support/errata/RHSA-2011-0300.html; http://www.securityfocus.com/bid/46528
CVE: CVE-2011-0718
Published: 2011-02-25
Description: Red Hat Network (RHN) Satellite Server 5.4 does not use a time delay after a failed login attempt, which makes it easier for remote attackers to conduct brute force password guessing attacks.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/43487; http://www.redhat.com/support/errata/RHSA-2011-0300.html; http://www.securityfocus.com/bid/46528
CVE: CVE-2011-1018
Published: 2011-02-25
Description: logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstrated via a crafted username to a Samba server.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055579.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055585.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055617.html
CVE: CVE-2011-1101
Published: 2011-02-25
Description: Multiple unspecified vulnerabilities in a third-party component of the Citrix Licensing Administration Console 11.6, formerly License Management Console, allow remote attackers to (1) access unauthorized "license administration functionality" or (2) cause a denial of service via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/43459; http://support.citrix.com/article/CTX128167; http://www.securityfocus.com/bid/46529
CVE: CVE-2011-1102
Published: 2011-02-25
Description: Cross-site scripting (XSS) vulnerability in the WebReporting module in F-Secure Policy Manager 7.x, 8.00 before hotfix 2, 8.1x before hotfix 3 on Windows and hotfix 2 on Linux, and 9.00 before hotfix 4 on Windows and hotfix 2 on Linux, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/43049; http://www.f-secure.com/en_EMEA/support/security-advisory/fsc-2011-2.html; http://www.securityfocus.com/bid/46547
CVE: CVE-2011-1103
Published: 2011-02-25
Description: The WebReporting module in F-Secure Policy Manager 7.x, 8.00 before hotfix 2, 8.1x before hotfix 3 on Windows and hotfix 2 on Linux, and 9.00 before hotfix 4 on Windows and hotfix 2 on Linux, allows remote attackers to obtain sensitive information via a request to an invalid report, which reveals the installation path in an error message, as demonstrated with requests to (1) report/infection-table.html or (2) report/productsummary-table.html.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/43049; http://www.f-secure.com/en_EMEA/support/security-advisory/fsc-2011-2.html; http://www.securitytracker.com/id?1025124
CVE: CVE-2011-0925
Published: 2011-02-28
Description: The CSDWebInstallerCtrl ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) allows remote attackers to download an unintended Cisco program onto a client machine, and execute this program, by identifying a Cisco program with a Cisco digital signature and then renaming this program to inst.exe, a different vulnerability than CVE-2010-0589 and CVE-2011-0926.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/8108; http://www.securityfocus.com/archive/1/516648/100/0/threaded; http://www.securityfocus.com/bid/46538