deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-1424
Published: 2011-05-24
Description: The default configuration of ExShortcut\Web.config in EMC SourceOne Email Management before 6.6 SP1, when the Mobile Services component is used, does not properly set the localOnly attribute of the trace element, which allows remote authenticated users to obtain sensitive information via ASP.NET Application Tracing.
CVSS Score: 3.5 (LOW)
CWE: CWE-16
References: http://securityreason.com/securityalert/8258; http://www.securityfocus.com/archive/1/518003/100/0/threaded; http://securityreason.com/securityalert/8258
CVE: CVE-2011-1521
Published: 2011-05-24
Description: The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service (resource consumption) via a crafted URL, as demonstrated by the file:///etc/passwd and file:///dev/zero URLs.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-399
References: http://bugs.python.org/issue11662; http://hg.python.org/cpython/file/96a6c128822b/Misc/NEWS; http://hg.python.org/cpython/file/b2934d98dac1/Misc/NEWS
CVE: CVE-2011-1595
Published: 2011-05-24
Description: Directory traversal vulnerability in the disk_create function in disk.c in rdesktop before 1.7.0, when disk redirection is enabled, allows remote RDP servers to read or overwrite arbitrary files via a .. (dot dot) in a pathname.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061170.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061309.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061316.html
CVE: CVE-2011-1928
Published: 2011-05-24
Description: The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used.  NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=627182; http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html; http://mail-archives.apache.org/mod_mbox/httpd-announce/201105.mbox/%3C4DD55[PII_REDACTED]%40apache.org%3E
CVE: CVE-2011-1929
Published: 2011-05-24
Description: lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://dovecot.org/pipermail/dovecot/2011-May/059085.html; http://dovecot.org/pipermail/dovecot/2011-May/059086.html; http://hg.dovecot.org/dovecot-1.1/rev/3698dfe0f21c
CVE: CVE-2011-2166
Published: 2011-05-24
Description: script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allow remote authenticated users to bypass intended access restrictions by leveraging a script.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-16
References: http://dovecot.org/pipermail/dovecot/2011-May/059085.html; http://openwall.com/lists/oss-security/2011/05/18/4; http://rhn.redhat.com/errata/RHSA-2013-0520.html
CVE: CVE-2011-2167
Published: 2011-05-24
Description: script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://dovecot.org/pipermail/dovecot/2011-May/059085.html; http://openwall.com/lists/oss-security/2011/05/18/4; http://rhn.redhat.com/errata/RHSA-2013-0520.html
CVE: CVE-2011-2168
Published: 2011-05-24
Description: Multiple integer overflows in the glob implementation in libc in OpenBSD before 4.9 might allow context-dependent attackers to have an unspecified impact via a crafted string, related to the GLOB_APPEND and GLOB_DOOFFS flags, a different issue than CVE-2011-0418.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://securityreason.com/achievement_securityalert/97; http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/glob.c#rev1.35; http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/glob.c.diff?r1=1.34%3Br2=1.35%3Bf=h
CVE: CVE-2011-2169
Published: 2011-05-24
Description: Google Chrome OS before R12 0.12.433.38 Beta allows local users to gain privileges by creating a /var/lib/chromeos-aliases.conf file and placing commands in it.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2011/05/chrome-os-beta-channel-update_16.html; http://googlechromereleases.blogspot.com/2011/05/chrome-os-beta-channel-update_16.html
CVE: CVE-2011-2170
Published: 2011-05-24
Description: Google Chrome OS before R12 0.12.433.38 Beta, when Guest mode is enabled, does not prevent changes on the about:flags page, which has unspecified impact and local attack vectors.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2011/05/chrome-os-beta-channel-update_16.html; http://googlechromereleases.blogspot.com/2011/05/chrome-os-beta-channel-update_16.html
CVE: CVE-2011-2171
Published: 2011-05-24
Description: Unspecified vulnerability in the dbugs package in Google Chrome OS before R12 0.12.433.38 Beta has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2011/05/chrome-os-beta-channel-update_16.html; http://googlechromereleases.blogspot.com/2011/05/chrome-os-beta-channel-update_16.html
CVE: CVE-2010-4251
Published: 2011-05-26
Description: The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service (memory consumption) by sending a large amount of network traffic, as demonstrated by netperf UDP tests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8eae939f1400326b06d0c9afe53d2a484a326871; http://kerneltrap.org/mailarchive/linux-netdev/2010/3/3/6271093/thread; http://secunia.com/advisories/46397
CVE: CVE-2010-4805
Published: 2011-05-26
Description: The socket implementation in net/core/sock.c in the Linux kernel before 2.6.35 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service by sending a large amount of network traffic, related to the sk_add_backlog function and the sk_rmem_alloc socket field.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4251.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c377411f2494a931ff7facdbb3a6839b1266bcf6; http://kerneltrap.org/mailarchive/linux-netdev/2010/3/3/6271093/thread; http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35
CVE: CVE-2010-4806
Published: 2011-05-26
Description: The authoring tool in IBM Web Content Manager (WCM) 6.1.5, and 7.0.0.1 before CF003, allows remote authenticated users to bypass intended access restrictions on draft creation by leveraging certain resource editor privileges.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM26755; http://www.ibm.com/support/docview.wss?uid=swg24029452; http://www-01.ibm.com/support/docview.wss?uid=swg1PM26755
CVE: CVE-2010-4807
Published: 2011-05-26
Description: Race condition in IBM Web Content Manager (WCM) 7.0.0.1 before CF003 allows remote authenticated users to cause a denial of service (infinite recursive query) via unspecified vectors, related to a StackOverflowError exception.
CVSS Score: 3.5 (LOW)
CWE: CWE-362
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM36141; http://www.ibm.com/support/docview.wss?uid=swg24029452; http://www-01.ibm.com/support/docview.wss?uid=swg1PM36141
CVE: CVE-2011-1581
Published: 2011-05-26
Description: The bond_select_queue function in drivers/net/bonding/bond_main.c in the Linux kernel before 2.6.39, when a network device with a large number of receive queues is installed but the default tx_queues setting is used, does not properly restrict queue indexes, which allows remote attackers to cause a denial of service (BUG and system crash) or possibly have unspecified other impact by sending network traffic.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fd0e435b0fe85622f167b[PII_REDACTED]5a4856ac8; http://openwall.com/lists/oss-security/2011/04/13/16; http://openwall.com/lists/oss-security/2011/04/13/4
CVE: CVE-2011-1801
Published: 2011-05-26
Description: Unspecified vulnerability in Google Chrome before 11.0.696.71 allows remote attackers to bypass the pop-up blocker via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=72189; http://googlechromereleases.blogspot.com/2011/05/stable-channel-update_24.html; http://www.securityfocus.com/bid/47966
CVE: CVE-2011-1804
Published: 2011-05-26
Description: rendering/RenderBox.cpp in WebCore in WebKit before r86862, as used in Google Chrome before 11.0.696.71, does not properly render floats, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=82546; http://codereview.chromium.org/7050016; http://googlechromereleases.blogspot.com/2011/05/stable-channel-update_24.html
CVE: CVE-2011-1806
Published: 2011-05-26
Description: Google Chrome before 11.0.696.71 does not properly implement the GPU command buffer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=82873; http://googlechromereleases.blogspot.com/2011/05/stable-channel-update_24.html; http://www.securityfocus.com/bid/47964
CVE: CVE-2011-1807
Published: 2011-05-26
Description: Google Chrome before 11.0.696.71 does not properly handle blobs, which allows remote attackers to execute arbitrary code via unspecified vectors that trigger an out-of-bounds write.
CVSS Score: 10.0 (HIGH)
CWE: CWE-787
References: http://code.google.com/p/chromium/issues/detail?id=82903; http://googlechromereleases.blogspot.com/2011/05/stable-channel-update_24.html; http://www.securityfocus.com/bid/47963
CVE: CVE-2011-2172
Published: 2011-05-26
Description: Cross-site scripting (XSS) vulnerability in the search center in IBM WebSphere Portal 7.0.0.1 before CF004 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/72500; http://secunia.com/advisories/44700; http://www-01.ibm.com/support/docview.wss?uid=swg1PM36644
CVE: CVE-2011-2173
Published: 2011-05-26
Description: The implementation of OutputMediator objects in IBM WebSphere Portal 6.0.1.7, and 7.0.0.1 before CF002, allows remote authenticated users to cause a denial of service (memory consumption) via requests.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM33432; http://www.ibm.com/support/docview.wss?uid=swg24029452; https://exchange.xforce.ibmcloud.com/vulnerabilities/67687
CVE: CVE-2010-2246
Published: 2011-05-26
Description: feh before 1.8, when the --wget-timestamp option is enabled, might allow remote attackers to execute arbitrary commands via shell metacharacters in a URL.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: http://derf.homelinux.org/git/feh/plain/ChangeLog; http://openwall.com/lists/oss-security/2010/06/25/4; http://openwall.com/lists/oss-security/2010/06/28/4
CVE: CVE-2011-1758
Published: 2011-05-26
Description: The krb5_save_ccname_done function in providers/krb5/krb5_auth.c in System Security Services Daemon (SSSD) 1.5.x before 1.5.7, when automatic ticket renewal and offline authentication are configured, uses a pathname string as a password, which allows local users to bypass Kerberos authentication by listing the /tmp directory to obtain the pathname.
CVSS Score: 3.7 (LOW)
CWE: CWE-287
References: http://git.fedorahosted.org/git/?p=sssd.git%3Ba=commit%3Bh=fffdae81651b460f3d2c119c56d5caa09b4de42a; http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059532.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059619.html
CVE: CVE-2011-1775
Published: 2011-05-26
Description: The CSecurityTLS::processMsg function in common/rfb/CSecurityTLS.cxx in the vncviewer component in TigerVNC 1.1beta1 does not properly verify the server's X.509 certificate, which allows man-in-the-middle attackers to spoof a TLS VNC server via an arbitrary certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060567.html; http://openwall.com/lists/oss-security/2011/05/06/2; http://openwall.com/lists/oss-security/2011/05/09/7
CVE: CVE-2011-0546
Published: 2011-05-31
Description: Symantec Backup Exec 11.0, 12.0, 12.5, 13.0, and 13.0 R2 does not validate identity information sent between the media server and the remote agent, which allows man-in-the-middle attackers to execute NDMP commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8507&w=2; http://secunia.com/advisories/44698; http://securityreason.com/securityalert/8300
CVE: CVE-2011-0628
Published: 2011-05-31
Description: Integer overflow in Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows remote attackers to execute arbitrary code via ActionScript that improperly handles a long array object.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=908; http://www.adobe.com/support/security/bulletins/apsb11-12.html; http://www.securityfocus.com/bid/47961
CVE: CVE-2011-0766
Published: 2011-05-31
Description: The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://secunia.com/advisories/44709; http://www.kb.cert.org/vuls/id/178990; http://www.securityfocus.com/bid/47980
CVE: CVE-2011-0943
Published: 2011-05-31
Description: Cisco IOS XR 3.8.3, 3.8.4, and 3.9.1 allows remote attackers to cause a denial of service (NetIO process restart or device reload) via a crafted IPv4 packet, aka Bug ID CSCth44147.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f18e.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f18e.shtml
CVE: CVE-2011-0949
Published: 2011-05-31
Description: Cisco IOS XR 3.6.x, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 does not properly remove sshd_lock files from /tmp/, which allows remote attackers to cause a denial of service (disk consumption) by making many SSHv1 connections, aka Bug ID CSCtd64417.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f18f.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f18f.shtml
CVE: CVE-2011-1213
Published: 2011-05-31
Description: Integer underflow in lzhsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted header in a .lzh attachment that triggers a stack-based buffer overflow, aka SPR PRAD88MJ2W.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=904; http://secunia.com/advisories/44624; http://securityreason.com/securityalert/8285
CVE: CVE-2011-1214
Published: 2011-05-31
Description: Stack-based buffer overflow in rtfsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted link in a .rtf attachment, aka SPR PRAD8823JQ.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=905; http://secunia.com/advisories/44624; http://www.ibm.com/support/docview.wss?uid=swg21500034
CVE: CVE-2011-1215
Published: 2011-05-31
Description: Stack-based buffer overflow in mw8sr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted link in a Microsoft Office document attachment, aka SPR PRAD8823ND.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=906; http://secunia.com/advisories/44624; http://www.ibm.com/support/docview.wss?uid=swg21500034
CVE: CVE-2011-1216
Published: 2011-05-31
Description: Stack-based buffer overflow in assr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via crafted tag data in an Applix spreadsheet attachment, aka SPR PRAD8823A7.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=907; http://secunia.com/advisories/44624; http://www.ibm.com/support/docview.wss?uid=swg21500034
CVE: CVE-2011-1217
Published: 2011-05-31
Description: Buffer overflow in kpprzrdr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted .prz attachment.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/44624; http://www.ibm.com/support/docview.wss?uid=swg21500034; http://www.securityfocus.com/bid/47962
CVE: CVE-2011-1218
Published: 2011-05-31
Description: Buffer overflow in kvarcve.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted .zip attachment, aka SPR PRAD8E3NSP. NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/44624; http://www.ibm.com/support/docview.wss?uid=swg21500034; http://www.securityfocus.com/bid/47962
CVE: CVE-2011-1329
Published: 2011-05-31
Description: WalRack 1.x before 1.1.9 and 2.x before 2.0.7 does not properly restrict file uploads, which allows remote attackers to execute arbitrary PHP code via vectors involving a double extension, as demonstrated by a .php.zzz file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://digit.que.ne.jp/work/index.cgi?WalRack; http://digit.que.ne.jp/work/index.cgi?WalRack2; http://jvn.jp/en/jp/JVN46984044/54827/index.html
CVE: CVE-2011-1485
Published: 2011-05-31
Description: Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058752.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059859.html; http://secunia.com/advisories/48817
CVE: CVE-2011-1486
Published: 2011-05-31
Description: libvirtd in libvirt before 0.9.0 does not use thread-safe error reporting, which allows remote attackers to cause a denial of service (crash) by causing multiple threads to report errors at the same time.
CVSS Score: 3.3 (LOW)
CWE: CWE-399
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=f44bfb7fb978c9313ce050a1c4149bf04aa0a670; http://secunia.com/advisories/44459; http://securitytracker.com/id?1025477
CVE: CVE-2011-1512
Published: 2011-05-31
Description: Heap-based buffer overflow in xlssr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a malformed BIFF record in a .xls Excel spreadsheet attachment, aka SPR PRAD8E3HKR.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/44624; http://securityreason.com/securityalert/8263; http://www.coresecurity.com/content/LotusNotes-XLS-viewer-heap-overflow
CVE: CVE-2011-1645
Published: 2011-05-31
Description: The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote attackers to read the backup configuration file, and consequently execute arbitrary code, via unspecified vectors, aka Bug ID CSCtn23871.
CVSS Score: 9.3 (HIGH)
CWE: CWE-16
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f190.shtml; http://www.securityfocus.com/bid/47988; http://www.securitytracker.com/id?1025565
CVE: CVE-2011-1646
Published: 2011-05-31
Description: The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote authenticated users to execute arbitrary commands via the (1) ping test parameter or (2) traceroute test parameter, aka Bug ID CSCtn23871.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f190.shtml; http://www.securitytracker.com/id?1025565; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f190.shtml
CVE: CVE-2011-1647
Published: 2011-05-31
Description: The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote attackers to read the private key for the admin SSL certificate via unspecified vectors, aka Bug ID CSCtn23871.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f190.shtml; http://www.securityfocus.com/bid/47985; http://www.securitytracker.com/id?1025565
CVE: CVE-2011-1649
Published: 2011-05-31
Description: The Internet Streamer application in Cisco Content Delivery System (CDS) with software 2.5.7, 2.5.8, and 2.5.9 before build 126 allows remote attackers to cause a denial of service (Web Engine crash) via a crafted URL, aka Bug IDs CSCtg67333 and CSCth25341.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f18b.shtml; http://www.securitytracker.com/id?1025564; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f18b.shtml
CVE: CVE-2011-1651
Published: 2011-05-31
Description: Cisco IOS XR 3.9.x and 4.0.x before 4.0.3 and 4.1.x before 4.1.1, when an SPA interface processor is installed, allows remote attackers to cause a denial of service (device reload) via a crafted IPv4 packet, aka Bug ID CSCto45095.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f191.shtml; http://www.securitytracker.com/id?1025567; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f191.shtml