deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2852
Published: 2012-08-06
Description: The PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, does not properly handle object linkage, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=134028; http://googlechromereleases.blogspot.com/2012/07/stable-channel-release.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15744
CVE: CVE-2012-2853
Published: 2012-08-06
Description: The webRequest API in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, does not properly interact with the Chrome Web Store, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=134101; http://googlechromereleases.blogspot.com/2012/07/stable-channel-release.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15439
CVE: CVE-2012-2854
Published: 2012-08-06
Description: Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows remote attackers to obtain potentially sensitive information about pointer values by leveraging access to a WebUI renderer process.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=134519; http://googlechromereleases.blogspot.com/2012/07/stable-channel-release.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15698
CVE: CVE-2012-2855
Published: 2012-08-06
Description: Use-after-free vulnerability in the PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=134888; http://googlechromereleases.blogspot.com/2012/07/stable-channel-release.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15038
CVE: CVE-2012-2856
Published: 2012-08-06
Description: The PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=134954; http://code.google.com/p/chromium/issues/detail?id=135264; http://googlechromereleases.blogspot.com/2012/07/stable-channel-release.html
CVE: CVE-2012-2857
Published: 2012-08-06
Description: Use-after-free vulnerability in the Cascading Style Sheets (CSS) DOM implementation in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=136235; http://googlechromereleases.blogspot.com/2012/07/stable-channel-release.html; http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html
CVE: CVE-2012-2858
Published: 2012-08-06
Description: Buffer overflow in the WebP decoder in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted WebP image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=136894; http://googlechromereleases.blogspot.com/2012/07/stable-channel-release.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15679
CVE: CVE-2012-2859
Published: 2012-08-06
Description: Google Chrome before 21.0.1180.57 on Linux does not properly handle tabs, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=137541; http://googlechromereleases.blogspot.com/2012/07/stable-channel-release.html; http://code.google.com/p/chromium/issues/detail?id=137541
CVE: CVE-2012-2860
Published: 2012-08-06
Description: The date-picker implementation in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=137671; http://googlechromereleases.blogspot.com/2012/07/stable-channel-release.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15709
CVE: CVE-2010-5137
Published: 2012-08-06
Description: wxBitcoin and bitcoind before 0.3.5 allow remote attackers to cause a denial of service (daemon crash) via a Bitcoin transaction containing an OP_LSHIFT script opcode.
CVSS Score: 5.0 (MEDIUM)
References: https://en.bitcoin.it/wiki/CVEs; https://en.bitcoin.it/wiki/CVEs
CVE: CVE-2010-5138
Published: 2012-08-06
Description: wxBitcoin and bitcoind 0.3.x allow remote attackers to cause a denial of service (electricity consumption) via a Bitcoin transaction containing multiple OP_CHECKSIG script opcodes.
CVSS Score: 5.0 (MEDIUM)
References: https://en.bitcoin.it/wiki/CVEs; https://en.bitcoin.it/wiki/CVEs
CVE: CVE-2010-5139
Published: 2012-08-06
Description: Integer overflow in wxBitcoin and bitcoind before 0.3.11 allows remote attackers to bypass intended economic restrictions and create many bitcoins via a crafted Bitcoin transaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: https://bitcointalk.org/index.php?topic=822.0; https://en.bitcoin.it/wiki/CVEs; https://bitcointalk.org/index.php?topic=822.0
CVE: CVE-2010-5140
Published: 2012-08-06
Description: wxBitcoin and bitcoind before 0.3.13 do not properly handle bitcoins associated with Bitcoin transactions that have zero confirmations, which allows remote attackers to cause a denial of service (invalid-transaction flood) by sending low-valued transactions without transaction fees.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.bitcoin.org/smf/index.php?topic=1306.0; https://en.bitcoin.it/wiki/CVEs; http://www.bitcoin.org/smf/index.php?topic=1306.0
CVE: CVE-2010-5141
Published: 2012-08-06
Description: wxBitcoin and bitcoind before 0.3.5 do not properly handle script opcodes in Bitcoin transactions, which allows remote attackers to spend bitcoins owned by other users via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://en.bitcoin.it/wiki/CVEs; https://en.bitcoin.it/wiki/CVEs
CVE: CVE-2011-4447
Published: 2012-08-06
Description: The "encrypt wallet" feature in wxBitcoin and bitcoind 0.4.x before 0.4.1, and 0.5.0rc, does not properly interact with the deletion functionality of BSDDB, which allows context-dependent attackers to obtain unencrypted private keys from Bitcoin wallet files by bypassing the BSDDB interface and reading entries that are marked for deletion.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://bitcoin.org/releases/2011/11/21/v0.5.0.html; https://bitcointalk.org/index.php?topic=51474.0; https://bitcointalk.org/index.php?topic=51604.0
CVE: CVE-2012-1014
Published: 2012-08-06
Description: The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x before 1.10.3 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a malformed AS-REQ request.
CVSS Score: 9.0 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2012-08/msg00016.html; http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt; http://www.debian.org/security/2012/dsa-2518
CVE: CVE-2012-1015
Published: 2012-08-06
Description: The kdc_handle_protected_negotiation function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x before 1.9.5, and 1.10.x before 1.10.3 attempts to calculate a checksum before verifying that the key type is appropriate for a checksum, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free, heap memory corruption, and daemon crash) via a crafted AS-REQ request.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2012-08/msg00016.html; http://rhn.redhat.com/errata/RHSA-2012-1131.html; http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt
CVE: CVE-2012-1909
Published: 2012-08-06
Description: The Bitcoin protocol, as used in bitcoind before 0.4.4, wxBitcoin, Bitcoin-Qt, and other programs, does not properly handle multiple transactions with the same identifier, which allows remote attackers to cause a denial of service (unspendable transaction) by leveraging the ability to create a duplicate coinbase transaction.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://r6.ca/blog/20120206T005236Z.html; http://sourceforge.net/mailarchive/forum.php?thread_name=CAPg%2BsBhmGHnMResVxPDZdfpmWTb9uqD0RrQD7oSXBQq7oHpm8g%40mail.gmail.com&forum_name=bitcoin-development; https://bitcointalk.org/index.php?topic=67738.0
CVE: CVE-2012-1910
Published: 2012-08-06
Description: Bitcoin-Qt 0.5.0.x before 0.5.0.5; 0.5.1.x, 0.5.2.x, and 0.5.3.x before 0.5.3.1; and 0.6.x before 0.6.0rc4 on Windows does not use MinGW multithread-safe exception handling, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted Bitcoin protocol messages.
CVSS Score: 7.5 (HIGH)
References: http://gavintech.blogspot.com/2012/03/full-disclosure-bitcoin-qt-on-windows.html; https://bitcointalk.org/index.php?topic=69120.0; https://en.bitcoin.it/wiki/CVEs
CVE: CVE-2012-2188
Published: 2012-08-06
Description: IBM Power Hardware Management Console (HMC) 7R3.5.0 before SP4, 7R7.1.0 and 7R7.2.0 before 7R7.2.0 SP3, and 7R7.3.0 before SP2, and Systems Director Management Console (SDMC) 6R7.3.0 before SP2, does not properly restrict the VIOS viosrvcmd command, which allows local users to gain privileges via vectors involving a (1) $ (dollar sign) or (2) & (ampersand) character.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_power_hmc_viosrvcmd_command_allows_elevated_privilege_on_vios_cve_2012_218825; http://www.ibm.com/support/docview.wss?uid=isg1MB03548; http://www.ibm.com/support/docview.wss?uid=isg1MB03550
CVE: CVE-2012-2459
Published: 2012-08-06
Description: Unspecified vulnerability in bitcoind and Bitcoin-Qt before 0.4.6, 0.5.x before 0.5.5, 0.6.0.x before 0.6.0.7, and 0.6.x before 0.6.2 allows remote attackers to cause a denial of service (block-processing outage and incorrect block count) via unknown behavior on a Bitcoin network.
CVSS Score: 5.0 (MEDIUM)
References: https://bitcointalk.org/?topic=81749; https://bugs.gentoo.org/show_bug.cgi?id=415973; https://en.bitcoin.it/wiki/CVEs
CVE: CVE-2012-3020
Published: 2012-08-06
Description: The Siemens Synco OZW Web Server devices OZW672.*, OZW772.*, and OZW775 with firmware before 4 have an unspecified default password, which makes it easier for remote attackers to obtain administrative access via a network session.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://support.automation.siemens.com/WW/view/en/41929231/130000; http://www.us-cert.gov/control_systems/pdf/ICSA-12-214-01.pdf; http://support.automation.siemens.com/WW/view/en/41929231/130000
CVE: CVE-2012-3408
Published: 2012-08-06
Description: lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
CVSS Score: 2.6 (LOW)
CWE: CWE-287
References: http://puppetlabs.com/security/cve/cve-2012-3408/; https://bugzilla.redhat.com/show_bug.cgi?id=839166; https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd
CVE: CVE-2012-3450
Published: 2012-08-06
Description: pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.
CVSS Score: 2.6 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00021.html; http://seclists.org/bugtraq/2012/Jun/60; http://www.debian.org/security/2012/dsa-2527
CVE: CVE-2012-3789
Published: 2012-08-06
Description: Unspecified vulnerability in bitcoind and Bitcoin-Qt before 0.4.7rc3, 0.5.x before 0.5.6rc3, 0.6.0.x before 0.6.0.9rc1, and 0.6.x before 0.6.3rc1 allows remote attackers to cause a denial of service (process hang) via unknown behavior on a Bitcoin network.
CVSS Score: 5.0 (MEDIUM)
References: https://en.bitcoin.it/wiki/CVEs; https://en.bitcoin.it/wiki/CVEs
CVE: CVE-2012-3864
Published: 2012-08-06
Description: Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html; http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html; http://puppetlabs.com/security/cve/cve-2012-3864/
CVE: CVE-2012-3865
Published: 2012-08-06
Description: Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html; http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html; http://puppetlabs.com/security/cve/cve-2012-3865/
CVE: CVE-2012-3866
Published: 2012-08-06
Description: lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html; http://puppetlabs.com/security/cve/cve-2012-3866/; http://secunia.com/advisories/50014
CVE: CVE-2012-3867
Published: 2012-08-06
Description: lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html; http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html; http://puppetlabs.com/security/cve/cve-2012-3867/
CVE: CVE-2012-4142
Published: 2012-08-06
Description: Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, ignores some characters in HTML documents in unspecified circumstances, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.opera.com/docs/changelogs/mac/1166/; http://www.opera.com/docs/changelogs/mac/1201/; http://www.opera.com/docs/changelogs/unix/1201/
CVE: CVE-2012-4143
Published: 2012-08-06
Description: Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, allows user-assisted remote attackers to trick users into downloading and executing arbitrary files via a small window for the download dialog, a different vulnerability than CVE-2012-1924.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.opera.com/docs/changelogs/mac/1166/; http://www.opera.com/docs/changelogs/mac/1201/; http://www.opera.com/docs/changelogs/unix/1201/
CVE: CVE-2012-4144
Published: 2012-08-06
Description: Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, does not properly escape characters in DOM elements, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted HTML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.opera.com/docs/changelogs/mac/1166/; http://www.opera.com/docs/changelogs/mac/1201/; http://www.opera.com/docs/changelogs/unix/1201/
CVE: CVE-2012-4145
Published: 2012-08-06
Description: Unspecified vulnerability in Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, has unknown impact and attack vectors, related to a "low severity issue."
CVSS Score: 10.0 (HIGH)
References: http://www.opera.com/docs/changelogs/mac/1166/; http://www.opera.com/docs/changelogs/mac/1201/; http://www.opera.com/docs/changelogs/unix/1201/
CVE: CVE-2012-4146
Published: 2012-08-06
Description: Opera before 12.01 allows remote attackers to cause a denial of service (application crash) via a crafted web site, as demonstrated by the Lenovo "Shop now" page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.opera.com/docs/changelogs/mac/1201/; http://www.opera.com/docs/changelogs/unix/1201/; http://www.opera.com/docs/changelogs/windows/1201/
CVE: CVE-2012-1338
Published: 2012-08-06
Description: Cisco IOS 15.0 and 15.1 on Catalyst 3560 and 3750 series switches allows remote authenticated users to cause a denial of service (device reload) by completing local web authentication quickly, aka Bug ID CSCts88664.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-362
References: http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/15.0_1_se/release/notes/OL25302.html; http://www.securitytracker.com/id?1027349; http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/15.0_1_se/release/notes/OL25302.html
CVE: CVE-2012-1339
Published: 2012-08-06
Description: The Fabric Interconnect component in Cisco Unified Computing System (UCS) 2.0 allows remote attackers to cause a denial of service (process crash) via an attempted SSH session, aka Bug ID CSCtt94543.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.cisco.com/en/US/docs/unified_computing/ucs/release/notes/OL_25363.html; http://www.securitytracker.com/id?1027350; http://www.cisco.com/en/US/docs/unified_computing/ucs/release/notes/OL_25363.html
CVE: CVE-2012-1340
Published: 2012-08-06
Description: The Fibre Channel over IP (FCIP) implementation in Cisco MDS NX-OS 4.2 and 5.2 on MDS 9000 series switches allows remote attackers to cause a denial of service (module reload) via a crafted FCIP header, aka Bug ID CSCtn93151.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.cisco.com/en/US/docs/switches/datacenter/mds9000/sw/5_2/release/notes/nx-os/mds_nxos_rel_notes_522.html; http://www.securitytracker.com/id?1027348; http://www.cisco.com/en/US/docs/switches/datacenter/mds9000/sw/5_2/release/notes/nx-os/mds_nxos_rel_notes_522.html
CVE: CVE-2012-1342
Published: 2012-08-06
Description: Cisco Carrier Routing System (CRS) 3.9, 4.0, and 4.1 allows remote attackers to bypass ACL entries via fragmented packets, aka Bug ID CSCtj10975.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-863
References: http://www.cisco.com/cisco/software/release.html?mdfid=279506669&catid=268437899&flowid=1915&reltype=all&relind=AVAILABLE&release=3.9.2&softwareid=280867577; http://www.cisco.com/cisco/software/release.html?mdfid=279506669&catid=268437899&flowid=1915&reltype=all&relind=AVAILABLE&release=3.9.2&softwareid=280867577
CVE: CVE-2012-2469
Published: 2012-08-06
Description: Cisco NX-OS 4.2, 5.0, 5.1, and 5.2 on Nexus 7000 series switches, when the High Availability (HA) policy is configured for Reset, allows remote attackers to cause a denial of service (device reset) via a malformed Cisco Discovery Protocol (CDP) packet, aka Bug IDs CSCtk34535 and CSCtk19132.
CVSS Score: 7.8 (HIGH)
References: http://www.4salesbyself.com/troubleshooting-random-nexus-reboots.aspx; http://www.cisco.com/en/US/docs/switches/datacenter/sw/5_x/nx-os/release/notes/52_nx-os_release_note.html; http://www.securitytracker.com/id?1027352
CVE: CVE-2012-2472
Published: 2012-08-06
Description: Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 and 8.4, when SIP inspection is enabled, create many identical pre-allocated secondary pinholes, which might allow remote attackers to cause a denial of service (CPU consumption) via crafted SIP traffic, aka Bug ID CSCtz63143.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/docs/security/asa/asa84/release/notes/asarn84.html; http://www.cisco.com/en/US/docs/security/asa/asa84/release/notes/asarn84.html
CVE: CVE-2012-2474
Published: 2012-08-06
Description: Memory leak on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 through 8.4 allows remote authenticated users to cause a denial of service (memory consumption and blank response page) by using the clientless WebVPN feature, aka Bug ID CSCth34278.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.cisco.com/web/software/280775065/45357/ASA-825-Interim-Release-Notes.html; http://www.cisco.com/web/software/280775065/45357/ASA-825-Interim-Release-Notes.html
CVE: CVE-2012-2490
Published: 2012-08-06
Description: Cisco IP Communicator 8.6 allows man-in-the-middle attackers to modify the Certificate Trust List via unspecified vectors, aka Bug ID CSCtz01471.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.cisco.com/en/US/docs/voice_ip_comm/cipc/8_5/english/release_notes/CIPC8x_RN.html; http://www.cisco.com/en/US/docs/voice_ip_comm/cipc/8_5/english/release_notes/CIPC8x_RN.html
CVE: CVE-2012-2498
Published: 2012-08-06
Description: Cisco AnyConnect Secure Mobility Client 3.0 through 3.0.08066 does not ensure that authentication makes use of a legitimate certificate, which allows user-assisted man-in-the-middle attackers to spoof servers via a crafted certificate, aka Bug ID CSCtz29197.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/release/notes/anyconnect30rn.html; http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/release/notes/anyconnect30rn.html
CVE: CVE-2012-2499
Published: 2012-08-06
Description: The IPsec implementation in Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 does not verify the certificate name in an X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate, aka Bug ID CSCtz26985.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/release/notes/anyconnect30rn.html; http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/release/notes/anyconnect30rn.html