deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-5151
Published: 2012-09-06
Description: Untrusted search path vulnerability in ACDSee Picture Frame Manager 1.0 Build 81 allows local users to gain privileges via a Trojan horse ShellIntMgrPFMU.dll file in the current working directory, as demonstrated by a directory that contains a .jpg file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/43562; http://secunia.com/advisories/43562
CVE: CVE-2011-5152
Published: 2012-09-06
Description: Multiple untrusted search path vulnerabilities in ACDSee Photo Editor 2008 5.x build 291 allow local users to gain privileges via a Trojan horse (1) Wintab32.dll or (2) CV11-DialogEditor.dll file in the current working directory, as demonstrated by a directory that contains a .apd file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/43563; http://secunia.com/advisories/43563
CVE: CVE-2011-5153
Published: 2012-09-06
Description: Untrusted search path vulnerability in FotoSlate 4.0 Build 146 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .plp file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.3 (MEDIUM)
References: http://secunia.com/advisories/43564; http://secunia.com/advisories/43564
CVE: CVE-2011-5154
Published: 2012-09-06
Description: Multiple untrusted search path vulnerabilities in (1) SAPGui.exe and (2) BExAnalyzer.exe in SAP GUI 6.4 through 7.2 allow local users to gain privileges via a Trojan horse MFC80LOC.DLL file in the current working directory, as demonstrated by a directory that contains a .sap file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://dsecrg.com/pages/vul/show.php?id=314; http://secunia.com/advisories/43707; http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a
CVE: CVE-2011-5155
Published: 2012-09-06
Description: Untrusted search path vulnerability in Help & Manual 5.5.1 Build 1296 allows local users to gain privileges via a Trojan horse ijl15.dll file in the current working directory, as demonstrated by a directory that contains a .hmxz, .hmxp, .hmskin, .hmx, .hm3, .hpj, .hlp, or .chm file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.3 (MEDIUM)
References: http://secunia.com/advisories/44170; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5009.php; http://secunia.com/advisories/44170
CVE: CVE-2011-5156
Published: 2012-09-06
Description: Untrusted search path vulnerability in Effective File Search 6.7 allows local users to gain privileges via a Trojan horse ztvunrar36.dll file in the current working directory, as demonstrated by a directory that contains a .efs file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/45153; http://secunia.com/advisories/45153
CVE: CVE-2011-5157
Published: 2012-09-06
Description: Untrusted search path vulnerability in Attachmate Reflection before 14.1 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, a related issue to CVE-2011-0107. NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/46692; http://support.attachmate.com/techdocs/1708.html; http://www.securityfocus.com/bid/50496
CVE: CVE-2012-4754
Published: 2012-09-06
Description: Multiple untrusted search path vulnerabilities in MindManager 2012 10.0.493 allow local users to gain privileges via a Trojan horse (1) ssgp.dll or (2) dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .mmap file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.3 (MEDIUM)
References: http://secunia.com/advisories/47797; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5068.php; http://secunia.com/advisories/47797
CVE: CVE-2012-4755
Published: 2012-09-06
Description: Untrusted search path vulnerability in SciTools Understand before 2.6 build 600 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current working directory, as demonstrated by a directory that contains a .udb file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/47921; http://www.scitools.com/support/buildLogs/understand26_build_log.html; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5071.php
CVE: CVE-2012-4756
Published: 2012-09-06
Description: Multiple untrusted search path vulnerabilities in CyberLink LabelPrint 2.5.3602 allow local users to gain privileges via a Trojan horse (1) mfc71loc.dll or (2) mfc71enu.dll file in the current working directory, as demonstrated by a directory that contains a .lpp file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/49281; http://secunia.com/advisories/49281
CVE: CVE-2012-4757
Published: 2012-09-06
Description: Multiple untrusted search path vulnerabilities in CyberLink StreamAuthor 4.0 build 3308 allow local users to gain privileges via a Trojan horse (1) mfc71loc.dll or (2) mfc71enu.dll file in the current working directory, as demonstrated by a directory that contains a .sta or .stp file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/49290; http://secunia.com/advisories/49290
CVE: CVE-2012-4758
Published: 2012-09-06
Description: Multiple untrusted search path vulnerabilities in CyberLink PowerProducer 5.5.3.2325 allow local users to gain privileges via a Trojan horse (1) mfc71loc.dll or (2) mfc71enu.dll file in the current working directory, as demonstrated by a directory that contains a .ppp or .rdf file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/49295; http://secunia.com/advisories/49295
CVE: CVE-2012-4759
Published: 2012-09-06
Description: Untrusted search path vulnerability in facebook_plugin.fpi in the Facebook plug-in in Foxit Reader 5.3.1.0606 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .pdf file. NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0293.html; http://secunia.com/advisories/50348; http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0293.html
CVE: CVE-2012-2069
Published: 2012-09-06
Description: Cross-site request forgery (CSRF) vulnerability in the Wishlist module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.6 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences via the (1) wl_reveal or (2) q parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1483634; http://drupal.org/node/1483636; http://drupal.org/node/1492624
CVE: CVE-2012-2740
Published: 2012-09-06
Description: SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securitytracker.com/id?1027181; http://www.exploit-db.com/exploits/18639; http://www.openwall.com/lists/oss-security/2012/06/16/1
CVE: CVE-2012-2741
Published: 2012-09-06
Description: Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a reconcileusers action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securitytracker.com/id?1027181; http://www.exploit-db.com/exploits/18639; http://www.openwall.com/lists/oss-security/2012/06/16/1
CVE: CVE-2012-4864
Published: 2012-09-06
Description: Oreans WinLicense 2.1.8.0 allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted xml file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/files/111034; http://www.exploit-db.com/exploits/18637; http://www.securityfocus.com/bid/52650
CVE: CVE-2012-4865
Published: 2012-09-06
Description: Buffer overflow in Oreans Themida 2.1.8.0 allows remote attackers to execute arbitrary code via a crafted .TMD file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.org/files/111031; http://www.exploit-db.com/exploits/18636; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5079.php
CVE: CVE-2012-4866
Published: 2012-09-06
Description: Untrusted search path vulnerability in Xtreme RAT 3.5 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as the current working directory.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://packetstormsecurity.org/files/110949/Xtreme-RAT-DLL-Hijack.html; http://www.securityfocus.com/bid/52542; https://exchange.xforce.ibmcloud.com/vulnerabilities/74151
CVE: CVE-2012-4867
Published: 2012-09-06
Description: Directory traversal vulnerability in modules/com_vtiger_workflow/sortfieldsjson.php in vtiger CRM 5.1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the module_name parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/files/111075/Vtiger-5.1.0-Local-File-Inclusion.html; http://www.exploit-db.com/exploits/18635; http://packetstormsecurity.org/files/111075/Vtiger-5.1.0-Local-File-Inclusion.html
CVE: CVE-2012-4868
Published: 2012-09-06
Description: SQL injection vulnerability in news.php in the Kunena component 1.7.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://exploitsdownload.com/exploit/na/kunena-20-sql-injection; http://www.securityfocus.com/bid/52636; http://exploitsdownload.com/exploit/na/kunena-20-sql-injection
CVE: CVE-2012-4869
Published: 2012-09-06
Description: The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/files/111028/FreePBX-2.10.0-Remote-Command-Execution-XSS.html; http://seclists.org/fulldisclosure/2012/Mar/234; http://secunia.com/advisories/48463
CVE: CVE-2012-4870
Published: 2012-09-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) context parameter to panel/index_amp.php or (2) panel/dhtml/index.php; (3) clid or (4) clidname parameters to panel/flash/mypage.php; (5) PATH_INFO to admin/views/freepbx_reload.php; or (6) login parameter to recordings/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/111028/FreePBX-2.10.0-Remote-Command-Execution-XSS.html; http://seclists.org/fulldisclosure/2012/Mar/234; http://secunia.com/advisories/48463
CVE: CVE-2012-1107
Published: 2012-09-06
Description: The analyzeCurrent function in ape/apeproperties.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted sampleRate in an ape file, which triggers a divide-by-zero error.
CVSS Score: 4.3 (MEDIUM)
References: http://mail.kde.org/pipermail/taglib-devel/2012-March/002186.html; http://mail.kde.org/pipermail/taglib-devel/2012-March/002187.html; http://osvdb.org/79814
CVE: CVE-2012-1108
Published: 2012-09-06
Description: The parse function in ogg/xiphcomment.cpp in TagLib 1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted vendorLength field in an ogg file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://mail.kde.org/pipermail/taglib-devel/2012-March/002186.html; http://mail.kde.org/pipermail/taglib-devel/2012-March/002191.html; http://osvdb.org/79813
CVE: CVE-2012-1110
Published: 2012-09-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Etano 1.22 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) email, (3) email2, (4) f17_zip, or (5) agree parameter to join.php; (6) PATH_INFO, (7) st, (8) f17_city, (9) f17_country, (10) f17_state, (11) f17_zip, (12) f19, (13) wphoto, (14) search, or (15) v parameter to search.php; (16) PATH_INFO or (17) st parameter to photo_search.php; or (18) return parameter to photo_view.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0013.html; http://secunia.com/advisories/48165; http://www.openwall.com/lists/oss-security/2012/03/05/15
CVE: CVE-2012-1112
Published: 2012-09-06
Description: Directory traversal vulnerability in Open-Realty CMS 2.5.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the select_users_template parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0012.html; http://www.openwall.com/lists/oss-security/2012/03/05/14; http://www.openwall.com/lists/oss-security/2012/03/05/23
CVE: CVE-2012-1584
Published: 2012-09-06
Description: Integer overflow in the mid function in toolkit/tbytevector.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted file header field in a media file, which triggers a large memory allocation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://mail.kde.org/pipermail/taglib-devel/2012-March/002186.html; http://mail.kde.org/pipermail/taglib-devel/2012-March/002191.html; http://secunia.com/advisories/48211
CVE: CVE-2006-7247
Published: 2012-09-06
Description: SQL injection vulnerability in the Weblinks (com_weblinks) component for Joomla! and Mambo 1.0.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/20746; http://www.exploit-db.com/exploits/1922; http://www.openwall.com/lists/oss-security/2011/12/24/2
CVE: CVE-2012-0819
Published: 2012-09-06
Description: Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2012-0821.
CVSS Score: 5.0 (MEDIUM)
References: http://developer.joomla.org/security/news/[PII_REDACTED]1-core-information-disclosure; http://secunia.com/advisories/47753; http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html
CVE: CVE-2012-0820
Published: 2012-09-06
Description: Cross-site scripting (XSS) vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0822.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/news/[PII_REDACTED]2-core-xss-vulnerability; http://secunia.com/advisories/47753; http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html
CVE: CVE-2012-0821
Published: 2012-09-06
Description: Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2012-0819.
CVSS Score: 5.0 (MEDIUM)
References: http://developer.joomla.org/security/news/[PII_REDACTED]3-core-information-disclosure; http://secunia.com/advisories/47753; http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html
CVE: CVE-2012-0822
Published: 2012-09-06
Description: Cross-site scripting (XSS) vulnerability in Joomla! 1.6 and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0820.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/news/[PII_REDACTED]4-core-xss-vulnerability; http://secunia.com/advisories/47753; http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html
CVE: CVE-2012-0835
Published: 2012-09-06
Description: Unspecified vulnerability in Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain sensitive information via unknown vectors related to "administrator."
CVSS Score: 5.0 (MEDIUM)
References: http://developer.joomla.org/security/news/[PII_REDACTED]1-core-information-disclosure; http://secunia.com/advisories/47847; http://www.joomla.org/announcements/release-news/5410-joomla-251-released.html
CVE: CVE-2012-0836
Published: 2012-09-06
Description: Unspecified vulnerability in Joomla! 1.7.x before 1.7.5 allows attackers to read the error log via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://developer.joomla.org/security/news/[PII_REDACTED]1-core-information-disclosure; http://secunia.com/advisories/47847; http://www.joomla.org/announcements/release-news/5411-joomla-175-released.html
CVE: CVE-2012-0837
Published: 2012-09-06
Description: Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain the installation path via unspecified vectors related to "administrator."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://developer.joomla.org/security/news/[PII_REDACTED]1-core-information-disclosure; http://secunia.com/advisories/47847; http://www.joomla.org/announcements/release-news/5410-joomla-251-released.html
CVE: CVE-2012-1467
Published: 2012-09-06
Description: Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files via a .. (dot dot) in the param parameter to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431; https://www.htbridge.com/advisory/HTB23079; http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431
CVE: CVE-2012-1468
Published: 2012-09-06
Description: Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is not ".php", then accessing it via a direct request to the file in submission/original/ in the associated article directory, as demonstrated using .pHp, .asp, and other extensions.
CVSS Score: 6.0 (MEDIUM)
References: http://pkp.sfu.ca/ojs/RELEASE-2.3.7; http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431; https://www.htbridge.com/advisory/HTB23079
CVE: CVE-2012-1469
Published: 2012-09-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the (1) editor or (2) callback parameters to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/ibrowser.php in the iBrowser plugin, (3) authors[][url] parameter to index.php, or (4) Bio Statement or (5) Abstract of Submission fields to the stripUnsafeHtml function in lib/pkp/classes/core/String.inc.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0102.html; http://pkp.sfu.ca/ojs/RELEASE-2.3.7; http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431
CVE: CVE-2012-1611
Published: 2012-09-06
Description: Joomla! 2.5.x before 2.5.4 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end" information via unknown attack vectors.  NOTE: this might be a duplicate of CVE-2012-1599.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://developer.joomla.org/security/news/[PII_REDACTED]7-core-information-disclosure.html; http://secunia.com/advisories/48683; http://www.openwall.com/lists/oss-security/2012/04/03/3
CVE: CVE-2012-1612
Published: 2012-09-06
Description: Cross-site scripting (XSS) vulnerability in the update manager in Joomla! 2.5.x before 2.5.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/news/[PII_REDACTED]8-core-xss-vulnerability.html; http://secunia.com/advisories/48683; http://www.openwall.com/lists/oss-security/2012/04/03/3
CVE: CVE-2012-4871
Published: 2012-09-06
Description: Cross-site scripting (XSS) vulnerability in service/graph_html.php in the administrator panel in LiteSpeed Web Server 4.1.11 allows remote attackers to inject arbitrary web script or HTML via the gtitle parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://k1p0d.com/?p=25; http://packetstormsecurity.org/files/110974/LiteSpeed-4.1.11-Cross-Site-Scripting.html; http://secunia.com/advisories/48400
CVE: CVE-2012-4872
Published: 2012-09-06
Description: Cross-site scripting (XSS) vulnerability in Tickets/Submit in Kayako Fusion before 4.40.985 allows remote attackers to inject arbitrary web script or HTML via certain vectors, possibly a crafted ticket description.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48462; http://st2tea.blogspot.com/2012/03/kayako-fusion-cross-site-scripting.html; http://wiki.kayako.com/display/DOCS/4.40.985
CVE: CVE-2012-4873
Published: 2012-09-06
Description: Cross-site scripting (XSS) vulnerability in the file_download function in GNUBoard before 4.34.21 allows remote attackers to inject arbitrary web script or HTML via the filename parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48458; http://sir.co.kr/bbs/board.php?bo_table=g4_pds&wr_id=7156; http://www.exploit-db.com/exploits/18627
CVE: CVE-2012-4874
Published: 2012-09-06
Description: Unspecified vulnerability in the Another WordPress Classifieds Plugin before 2.0 for WordPress has unknown impact and attack vectors related to "image uploads."
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/80881; http://secunia.com/advisories/47335; http://wordpress.org/extend/plugins/another-wordpress-classifieds-plugin/changelog/
CVE: CVE-2012-4875
Published: 2012-09-06
Description: Heap-based buffer overflow in gdevwpr2.c in Ghostscript 9.04, when processing the OutputFile device parameter, allows user-assisted remote attackers to execute arbitrary code via a long file name in a PostScript document.  NOTE: as of 20120314, the developer was not able to reproduce the issue and disputed it
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://bugs.ghostscript.com/show_bug.cgi?id=692856; http://secunia.com/advisories/47855; http://www.securityfocus.com/bid/52864
CVE: CVE-2012-4876
Published: 2012-09-06
Description: Stack-based buffer overflow in the UltraMJCam ActiveX Control in TRENDnet SecurView TV-IP121WN Wireless Internet Camera allows remote attackers to execute arbitrary code via a long string to the OpenFileDlg method.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0152.html; http://osvdb.org/80661; http://retrogod.altervista.org/9sg_trendnet_adv.htm