deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-5166
Published: 2012-09-15
Description: Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string to the (1) USER, (2) PASS, (3) REIN, (4) QUIT, (5) PORT, (6) PASV, (7) TYPE, (8) STRU, (9) MODE, (10) RETR, (11) STOR, (12) APPE, (13) ALLO, (14) REST, (15) RNFR, (16) RNTO, (17) ABOR, (18) DELE, (19) CWD, (20) LIST, (21) NLST, (22) SITE, (23) STST, (24) HELP, (25) NOOP, (26) MKD, (27) RMD, (28) PWD, (29) CDUP, (30) STOU, (31) SNMT, (32) SYST, and (33) XPWD commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2011-09/0015.html; http://secunia.com/advisories/45907; http://www.exploit-db.com/exploits/17819
CVE: CVE-2011-5167
Published: 2012-09-15
Description: Heap-based buffer overflow in the SetDevNames method of the Tidestone Formula One ActiveX control (TTF16.ocx) 6.3.5 Build 1 in Oracle Hyperion Strategic Finance 12.x and possibly earlier allows remote attackers to execute arbitrary code via a long string to the DriverName parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://retrogod.altervista.org/9sg_ttf16.html; http://secunia.com/advisories/46764; http://www.exploit-db.com/exploits/18092
CVE: CVE-2011-5168
Published: 2012-09-15
Description: SQL injection vulnerability in user.php in Banana Dance before B.1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.bananadance.org/Program-News/Minor-Update-and-New-Theme; http://www.doyoubananadance.com/Program-News/Important-Notice-About-SQLi-Exploit; http://www.exploit-db.com/exploits/17919
CVE: CVE-2011-5169
Published: 2012-09-15
Description: SQL injection vulnerability in sgms/reports/scheduledreports/configure/scheduleProps.jsp in SonicWall ViewPoint 6.0 SP2 allows remote attackers to execute arbitrary SQL commands via the scheduleID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/519983/100/0/threaded; http://www.securityfocus.com/bid/49906; http://www.sonicwall.com/app/projects/file_downloader/document_lib.php?t=RN&id=379
CVE: CVE-2011-5170
Published: 2012-09-15
Description: Stack-based buffer overflow in Castillo Bueno Systems CCMPlayer 1.5 allows remote attackers to execute arbitrary code via a long track name in an m3u playlist.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/77453; http://www.exploit-db.com/exploits/18178; http://www.exploit-db.com/exploits/18195
CVE: CVE-2011-5171
Published: 2012-09-15
Description: Multiple stack-based buffer overflows in CyberLink Power2Go 7 (build 196) and 8 (build 1031) allow remote attackers to execute arbitrary code via the (1) src and (2) name parameters in a p2g project file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/77600; http://secunia.com/advisories/47145; http://www.exploit-db.com/exploits/18220
CVE: CVE-2011-5172
Published: 2012-09-15
Description: Stack-based buffer overflow in StoryBoard Quick 6 Build 3786, and possibly StoryBoard Artist and StoryBoard Studio, allows remote attackers to execute arbitrary code via a long string in the string element field in a frame xml file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/47045; http://www.exploit-db.com/exploits/18186; http://www.security-assessment.com/files/documents/advisory/Storyboard_Quick6-Stack_Buffer_Overflow.pdf
CVE: CVE-2011-5173
Published: 2012-09-15
Description: Buffer overflow in Bugbear Entertainment FlatOut 2005 allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the title field in a bed file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/18173; https://exchange.xforce.ibmcloud.com/vulnerabilities/71578; http://www.exploit-db.com/exploits/18173
CVE: CVE-2011-5174
Published: 2012-09-15
Description: Buffer overflow in Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) in Intel Q67 Express, C202, C204, C206 Chipsets, and Mobile Intel QM67, and QS67 Chipset before 2nd_gen_i5_i7_SINIT_51.BIN Express; Intel Q57, 3450 Chipsets and Mobile Intel QM57 and QS57 Express Chipset before i5_i7_DUAL_SINIT_51.BIN and i7_QUAD_SINIT_51.BIN; Mobile Intel GM45, GS45, and PM45 Express Chipset before GM45_GS45_PM45_SINIT_51.BIN; Intel Q35 Express Chipsets before Q35_SINIT_51.BIN; and Intel 5520, 5500, X58, and 7500 Chipsets before SINIT ACM 1.1 allows local users to bypass the Trusted Execution Technology protection mechanism and perform other unspecified SINIT ACM functions via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://osvdb.org/77554; http://secunia.com/advisories/47096; http://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00030&languageid=en-fr
CVE: CVE-2011-5175
Published: 2012-09-15
Description: SQL injection vulnerability in search.php in Banana Dance, possibly B.1.5 and earlier, allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/115772/Banana-Dance-CMS-B.2.1-XSS-SQL-Injection.html; http://www.bananadance.org/Program-News/Minor-Update-and-New-Theme; http://www.doyoubananadance.com/Program-News/Important-Notice-About-SQLi-Exploit
CVE: CVE-2011-5176
Published: 2012-09-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in search.php in Banana Dance, possibly B.1.5 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) q or (2) category parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.bananadance.org/Program-News/Minor-Update-and-New-Theme; http://www.doyoubananadance.com/Program-News/Important-Notice-About-SQLi-Exploit; http://www.bananadance.org/Program-News/Minor-Update-and-New-Theme
CVE: CVE-2012-2275
Published: 2012-09-15
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2012-09/0023.html; http://gitorious.org/testlink-ga/testlink-code/commit/252788c2373e73173172ada9af661e[PII_REDACTED]; http://gitorious.org/testlink-ga/testlink-code/commit/2d4ac941314f8bda80e265c9de8bacf17d1cd3e6
CVE: CVE-2012-3233
Published: 2012-09-15
Description: Cross-site scripting (XSS) vulnerability in __swift/thirdparty/PHPExcel/PHPExcel/Shared/JAMA/docs/download.php in Kayako Fusion 4.40.1148, and possibly before 4.50.1581, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-09/0022.html; http://osvdb.org/85189; http://secunia.com/advisories/50366
CVE: CVE-2012-3458
Published: 2012-09-15
Description: Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/50226; http://secunia.com/advisories/50520; http://www.debian.org/security/2012/dsa-2541
CVE: CVE-2012-4336
Published: 2012-09-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Flogr 2.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO or (2) an arbitrary parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-09/0021.html; http://www.securityfocus.com/bid/55418; https://exchange.xforce.ibmcloud.com/vulnerabilities/78310
CVE: CVE-2012-4923
Published: 2012-09-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Endian Firewall 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) createrule parameter to dnat.cgi, (2) addrule parameter to dansguardian.cgi, or (3) PATH_INFO to openvpn_users.cgi.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/109942/Endian-UTM-Firewall-2.4.x-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/52076; http://www.vulnerability-lab.com/get_content.php?id=436
CVE: CVE-2012-4924
Published: 2012-09-15
Description: Buffer overflow in the CxDbgPrint function in the ipswcom.dll ActiveX component 1.0.0.1 for ASUS Net4Switch 1.0.0020 allows remote attackers to execute arbitrary code via a long parameter to the Alert method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://dsecrg.com/pages/vul/show.php?id=417; http://osvdb.org/79438; http://secunia.com/advisories/48125
CVE: CVE-2012-4925
Published: 2012-09-15
Description: Multiple SQL injection vulnerabilities in approve.php in Img Pals Photo Host 1.0 allow remote attackers to execute arbitrary SQL commands via the u parameter in a (1) app0 or (2) app1 action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0180.html; http://secunia.com/advisories/48182; http://www.exploit-db.com/exploits/18544
CVE: CVE-2012-4926
Published: 2012-09-15
Description: approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u parameter in an (1) app0 (disable) or (2) app1 (enable) action.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0180.html; http://www.exploit-db.com/exploits/18544; http://archives.neohapsis.com/archives/bugtraq/2012-02/0180.html
CVE: CVE-2012-4927
Published: 2012-09-15
Description: SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://freecode.com/projects/limesurvey/releases/342070; http://osvdb.org/79459; http://packetstormsecurity.org/files/110100/limesurvey-sql.txt
CVE: CVE-2012-4928
Published: 2012-09-15
Description: Cross-site scripting (XSS) vulnerability in ow_updates/index.php in Oxwall 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the plugin parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://advisories.ariko-security.com/2012/audyt_bezpieczenstwa_2m2.html; http://packetstormsecurity.org/files/110046/Oxwall-1.1.1-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/52125
CVE: CVE-2012-4929
Published: 2012-09-15
Description: The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.
CVSS Score: 2.6 (LOW)
CWE: CWE-310
References: http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/; http://code.google.com/p/chromium/issues/detail?id=139744; http://isecpartners.com/blog/2012/9/14/details-on-the-crime-attack.html
CVE: CVE-2012-4930
Published: 2012-09-15
Description: The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.
CVSS Score: 2.6 (LOW)
CWE: CWE-310
References: http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/; http://isecpartners.com/blog/2012/9/14/details-on-the-crime-attack.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html
CVE: CVE-2012-3051
Published: 2012-09-16
Description: Cisco NX-OS 5.2 and 6.1 on Nexus 7000 series switches allows remote attackers to cause a denial of service (process crash or packet loss) via a large number of ARP packets, aka Bug ID CSCtr44822.
CVSS Score: 6.1 (MEDIUM)
References: http://secunia.com/advisories/50671; http://www.cisco.com/en/US/docs/switches/datacenter/sw/5_x/nx-os/release/notes/52_nx-os_release_note.html; http://www.securityfocus.com/bid/55600
CVE: CVE-2012-3052
Published: 2012-09-16
Description: Untrusted search path vulnerability in Cisco VPN Client 5.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka Bug ID CSCua28747.
CVSS Score: 6.9 (MEDIUM)
References: http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/release/notes/anyconnect31rn.html; http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/release/notes/anyconnect31rn.html
CVE: CVE-2012-3060
Published: 2012-09-16
Description: Cisco Unity Connection (UC) 8.6, 9.0, and 9.5 allows remote attackers to cause a denial of service (CPU consumption) via malformed UDP packets, aka Bug ID CSCtz76269.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/web/software/282074295/93949/cucm-readme-862asu2-Rev2.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/78922; http://www.cisco.com/web/software/282074295/93949/cucm-readme-862asu2-Rev2.pdf
CVE: CVE-2012-3079
Published: 2012-09-16
Description: Cisco IOS 12.2 allows remote attackers to cause a denial of service (CPU consumption) by establishing many IPv6 neighbors, aka Bug ID CSCtn78957.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/release/notes/caveats_SXI_rebuilds.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/78921; http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/release/notes/caveats_SXI_rebuilds.html
CVE: CVE-2012-3088
Published: 2012-09-16
Description: Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495, and 3.2.x, does not check whether an HTTP request originally contains ScanSafe headers, which allows remote attackers to have an unspecified impact via a crafted request, aka Bug ID CSCua13166.
CVSS Score: 9.3 (HIGH)
References: http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/release/notes/anyconnect31rn.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/78920; http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/release/notes/anyconnect31rn.html
CVE: CVE-2012-3094
Published: 2012-09-16
Description: The VPN downloader in the download_install component in Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495 on Linux accepts arbitrary X.509 server certificates without user interaction, which allows remote attackers to obtain sensitive information via vectors involving an invalid certificate, aka Bug ID CSCua11967.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/release/notes/anyconnect31rn.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/78916; http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/release/notes/anyconnect31rn.html
CVE: CVE-2012-3096
Published: 2012-09-16
Description: Cisco Unity Connection (UC) 7.1, 8.0, and 8.5 allows remote authenticated users to cause a denial of service (resource consumption and administration outage) via extended use of the product, aka Bug ID CSCtd79132.
CVSS Score: 4.0 (MEDIUM)
References: http://www.cisco.com/en/US/docs/voice_ip_comm/connection/7x/release/notes/715cucrn.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/78915; http://www.cisco.com/en/US/docs/voice_ip_comm/connection/7x/release/notes/715cucrn.html
CVE: CVE-2012-3893
Published: 2012-09-16
Description: The FlexVPN implementation in Cisco IOS 15.2 and 15.3 allows remote authenticated users to cause a denial of service (spoke crash) via spoke-to-spoke traffic, aka Bug ID CSCtz02622.
CVSS Score: 6.3 (MEDIUM)
References: http://www.cisco.com/en/US/docs/ios/15_2s/release/notes/15_2s_caveats_15_2_4s.html; http://www.cisco.com/en/US/docs/ios/15_2s/release/notes/15_2s_caveats_15_2_4s.html
CVE: CVE-2012-3895
Published: 2012-09-16
Description: Cisco IOS 15.0 through 15.3 allows remote authenticated users to cause a denial of service (device crash) via an MVPNv6 update, aka Bug ID CSCty89224.
CVSS Score: 6.3 (MEDIUM)
References: http://www.cisco.com/en/US/docs/ios/15_2s/release/notes/15_2s_caveats_15_2_2s.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/78872; http://www.cisco.com/en/US/docs/ios/15_2s/release/notes/15_2s_caveats_15_2_2s.html
CVE: CVE-2012-3899
Published: 2012-09-16
Description: sensorApp on Cisco IPS 4200 series sensors 6.0, 6.2, and 7.0 does not properly allocate memory, which allows remote attackers to cause a denial of service (memory corruption and process crash, and traffic-inspection outage) via network traffic, aka Bug ID CSCtn23051.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.cisco.com/web/software/282549758/51927/IPS-6_2-4-E4-readme.txt; http://www.cisco.com/web/software/282549758/51927/IPS-6_2-4-E4-readme.txt
CVE: CVE-2012-3901
Published: 2012-09-16
Description: The updateTime function in sensorApp on Cisco IPS 4200 series sensors 7.0 and 7.1 allows remote attackers to cause a denial of service (process crash and traffic-inspection outage) via network traffic, aka Bug ID CSCta96144.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.cisco.com/en/US/docs/security/ips/7.0/release/notes/22789_01.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/78870; http://www.cisco.com/en/US/docs/security/ips/7.0/release/notes/22789_01.html
CVE: CVE-2012-3908
Published: 2012-09-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the ISE Administrator user interface (aka the Apache Tomcat interface) on Cisco Identity Services Engine (ISE) 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the authentication of administrators, aka Bug ID CSCty46684.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://en.securitylab.ru/lab/; http://secunia.com/advisories/50680; http://www.cisco.com/en/US/docs/security/ise/1.1/release_notes/ise1.1_rn.html
CVE: CVE-2012-3915
Published: 2012-09-16
Description: The DMVPN tunnel implementation in Cisco IOS 15.2 allows remote attackers to cause a denial of service (persistent IKE state) via a large volume of hub-to-spoke traffic, aka Bug ID CSCtq39602.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.cisco.com/en/US/docs/ios/15_2s/release/notes/15_2s_caveats_15_2_2s.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/78809; http://www.cisco.com/en/US/docs/ios/15_2s/release/notes/15_2s_caveats_15_2_2s.html
CVE: CVE-2012-3919
Published: 2012-09-16
Description: The Cisco Application Control Engine (ACE) module 3.0 for Cisco Catalyst switches and Cisco routers does not properly monitor Load Balancer (LB) queues, which allows remote attackers to cause a denial of service (incorrect memory access and module reboot) via application traffic, aka Bug ID CSCtw70879.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA2_3_x/Release/Note/RACEA2_3_X.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/78808; http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA2_3_x/Release/Note/RACEA2_3_X.html
CVE: CVE-2012-3923
Published: 2012-09-16
Description: The SSLVPN implementation in Cisco IOS 12.4, 15.0, 15.1, and 15.2, when DTLS is not enabled, does not properly handle certain outbound ACL configurations, which allows remote authenticated users to cause a denial of service (device crash) via a session involving a PPP over ATM (PPPoA) interface, aka Bug ID CSCte41827.
CVSS Score: 3.5 (LOW)
References: http://www.cisco.com/en/US/docs/ios/15_2m_and_t/release/notes/152-1TCAVS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/78670; http://www.cisco.com/en/US/docs/ios/15_2m_and_t/release/notes/152-1TCAVS.html
CVE: CVE-2012-3924
Published: 2012-09-16
Description: The SSLVPN implementation in Cisco IOS 15.1 and 15.2, when DTLS is enabled, does not properly handle certain outbound ACL configurations, which allows remote authenticated users to cause a denial of service (device crash) via a session involving a PPP over ATM (PPPoA) interface, aka Bug ID CSCty97961.
CVSS Score: 3.5 (LOW)
References: http://www.cisco.com/en/US/docs/ios/15_2m_and_t/release/notes/152-1TCAVS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/78672; http://www.cisco.com/en/US/docs/ios/15_2m_and_t/release/notes/152-1TCAVS.html
CVE: CVE-2012-2575
Published: 2012-09-17
Description: Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/20363/; http://www.exploit-db.com/exploits/20363/
CVE: CVE-2012-2995
Published: 2012-09-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro InterScan Messaging Security Suite 7.1-Build_Win32_1394 allow remote attackers to inject arbitrary web script or HTML via (1) the wrsApprovedURL parameter to addRuleAttrWrsApproveUrl.imss or (2) the src parameter to initUpdSchPage.imss.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/50620; http://www.kb.cert.org/vuls/id/471364; http://www.securitytracker.com/id?1027544
CVE: CVE-2012-2996
Published: 2012-09-17
Description: Cross-site request forgery (CSRF) vulnerability in saveAccountSubTab.imss in Trend Micro InterScan Messaging Security Suite 7.1-Build_Win32_1394 allows remote attackers to hijack the authentication of administrators for requests that create admin accounts via a saveAuth action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/50620; http://www.kb.cert.org/vuls/id/471364; http://www.securitytracker.com/id?1027544
CVE: CVE-2010-4822
Published: 2012-09-17
Description: core/model/MySQLDatabase.php in SilverStripe 2.4.x before 2.4.4, when the site is running in "live mode," allows remote attackers to obtain the SQL queries for a page via the showqueries and ajax parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4; http://open.silverstripe.org/changeset/114783; http://secunia.com/advisories/42346
CVE: CVE-2010-4823
Published: 2012-09-17
Description: Cross-site scripting (XSS) vulnerability in the httpError method in sapphire/core/control/RequestHandler.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when custom error handling is not used, allows remote attackers to inject arbitrary web script or HTML via "missing URL actions."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4; http://open.silverstripe.org/changeset/114444; http://secunia.com/advisories/42346
CVE: CVE-2010-4824
Published: 2012-09-17
Description: SQL injection vulnerability in the augmentSQL method in core/model/Translatable.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when the Translatable extension is enabled, allows remote attackers to execute arbitrary SQL commands via the locale parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10; http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4; http://open.silverstripe.org/changeset/114515