deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-5286
Published: 2012-11-26
Description: Directory traversal vulnerability in Jstore (com_jstore) component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1010-exploits/joomlajstore-lfi.txt; http://www.securityfocus.com/bid/44053; http://packetstormsecurity.org/1010-exploits/joomlajstore-lfi.txt
CVE: CVE-2012-6045
Published: 2012-11-27
Description: Cross-site scripting (XSS) vulnerability in gb/user/index.php in Ramui Forum, possibly 1.0 Beta, allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112495/Ramui-Forum-Script-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/53411; https://exchange.xforce.ibmcloud.com/vulnerabilities/75440
CVE: CVE-2012-6046
Published: 2012-11-27
Description: Static code injection vulnerability in admin/banners.php in PHP Enter allows remote attackers to inject arbitrary PHP code into horad.php via the code parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/files/112536/PHP-Enter-Code-Injection.html; http://www.securityfocus.com/bid/53426; https://exchange.xforce.ibmcloud.com/vulnerabilities/75464
CVE: CVE-2012-6047
Published: 2012-11-27
Description: Cross-site request forgery (CSRF) vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that add a user to an arbitrary group via the users page in an adminpanel action to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.exploit-db.com/exploits/18850; http://www.exploit-db.com/exploits/18850
CVE: CVE-2012-6048
Published: 2012-11-27
Description: Guitar Pro 6.1.1 r10791 allows remote attackers to cause a denial of service (crash) via a long string in a gpx file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/18851; http://www.osvdb.org/81828; http://www.exploit-db.com/exploits/18851
CVE: CVE-2012-6049
Published: 2012-11-27
Description: Open Solution Quick.Cart 5.0 allows remote attackers to obtain sensitive information via (1) a long string or (2) invalid characters in a cookie, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://hauntit.blogspot.com/2012/03/en-quickcartv50-information-disclosure.html; http://packetstormsecurity.org/files/112242/Quick.Cart-5.0-Information-Disclosure.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/75204
CVE: CVE-2012-6050
Published: 2012-11-27
Description: The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consumption), read the router version, and possibly have other impacts via a request to download the router's DLLs or plugins, as demonstrated by roteros.dll.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-16
References: http://www.133tsec.com/2012/04/30/0day-ddos-mikrotik-server-side-ddos-attack/; http://www.exploit-db.com/exploits/18817; https://exchange.xforce.ibmcloud.com/vulnerabilities/75327
CVE: CVE-2012-4611
Published: 2012-11-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Adaptive Authentication On-Premise (AAOP) before 7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0096.html; http://osvdb.org/87876; http://packetstormsecurity.com/files/118381/RSA-Adaptive-Authentication-On-Premise-6.x-XSS.html
CVE: CVE-2012-4614
Published: 2012-11-27
Description: The default configuration of EMC Smarts Network Configuration Manager (NCM) before 9.1 does not require authentication for database access, which allows remote attackers to have an unspecified impact via a network session.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0095.html; http://osvdb.org/87877; http://secunia.com/advisories/51408
CVE: CVE-2012-4615
Published: 2012-11-27
Description: EMC Smarts Network Configuration Manager (NCM) before 9.1 uses a hardcoded encryption key for the storage of credentials, which allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0095.html; http://osvdb.org/87878; http://packetstormsecurity.org/files/118358/EMC-Smarts-Network-Configuration-Manager-Bypass.html
CVE: CVE-2011-5370
Published: 2012-11-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-5370.  Reason: This candidate is a duplicate of CVE-2012-5370.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2012-5370 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-5371
Published: 2012-11-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-5371.  Reason: This candidate is a duplicate of CVE-2012-5371.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2012-5371 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-5372
Published: 2012-11-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-5372.  Reason: This candidate is a duplicate of CVE-2012-5372.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2012-5372 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-5373
Published: 2012-11-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-5373.  Reason: This candidate is a duplicate of CVE-2012-5373.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2012-5373 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-4964
Published: 2012-11-28
Description: The Samsung printer firmware before 20121031 has a hardcoded read-write SNMP community, which makes it easier for remote attackers to obtain administrative access via an SNMP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/281284; http://www.kb.cert.org/vuls/id/281284
CVE: CVE-2012-5130
Published: 2012-11-28
Description: Skia, as used in Google Chrome before 23.0.1271.91, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00004.html; http://osvdb.org/87888
CVE: CVE-2012-5131
Published: 2012-11-28
Description: Google Chrome before 23.0.1271.91 on Mac OS X does not properly mitigate improper rendering behavior in the Intel GPU driver, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00004.html; http://osvdb.org/87883
CVE: CVE-2012-5132
Published: 2012-11-28
Description: Google Chrome before 23.0.1271.91 allows remote attackers to cause a denial of service (application crash) via a response with chunked transfer coding.
CVSS Score: 5.0 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00004.html; http://osvdb.org/87887
CVE: CVE-2012-5133
Published: 2012-11-28
Description: Use-after-free vulnerability in Google Chrome before 23.0.1271.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG filters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00004.html; http://www.securityfocus.com/bid/56684
CVE: CVE-2012-5134
Published: 2012-11-28
Description: Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.gnome.org/browse/libxml2/commit/?id=6a36fbe3b3e001a8a840b5c1fdd81cefc9947f0d; http://googlechromereleases.blogspot.com/2012/11/stable-channel-update.html; http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html
CVE: CVE-2012-5135
Published: 2012-11-28
Description: Use-after-free vulnerability in Google Chrome before 23.0.1271.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to printing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00004.html; http://osvdb.org/87886
CVE: CVE-2012-5136
Published: 2012-11-28
Description: Google Chrome before 23.0.1271.91 does not properly perform a cast of an unspecified variable during handling of the INPUT element, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted HTML document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00004.html; http://osvdb.org/87885
CVE: CVE-2012-2739
Published: 2012-11-28
Description: Oracle Java SE before 7 Update 6, and OpenJDK 7 before 7u6 build 12 and 8 before build 39, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.html; http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.html; http://www.kb.cert.org/vuls/id/903934
CVE: CVE-2012-5370
Published: 2012-11-28
Description: JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4838.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://2012.appsec-forum.ch/conferences/#c17; http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf; http://rhn.redhat.com/errata/RHSA-2013-0533.html
CVE: CVE-2012-5371
Published: 2012-11-28
Description: Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against a variant of the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4815.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://2012.appsec-forum.ch/conferences/#c17; http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf; http://secunia.com/advisories/51253
CVE: CVE-2012-5372
Published: 2012-11-28
Description: Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://2012.appsec-forum.ch/conferences/#c17; http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf; http://www.ocert.org/advisories/ocert-2012-001.html
CVE: CVE-2012-5373
Published: 2012-11-28
Description: Oracle Java SE 7 and earlier, and OpenJDK 7 and earlier, computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm, a different vulnerability than CVE-2012-2739.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://2012.appsec-forum.ch/conferences/#c17; http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf; http://www.ocert.org/advisories/ocert-2012-001.html
CVE: CVE-2012-6051
Published: 2012-11-28
Description: Google CityHash computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://2012.appsec-forum.ch/conferences/#c17; http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf; http://code.google.com/p/cityhash/source/browse/trunk/NEWS
CVE: CVE-2012-3271
Published: 2012-11-29
Description: Unspecified vulnerability on the HP Integrated Lights-Out 3 (aka iLO3) with firmware before 1.50 and Integrated Lights-Out 4 (aka iLO4) with firmware before 1.13 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03515413; http://secunia.com/advisories/51378; http://www.securityfocus.com/bid/56597
CVE: CVE-2012-4841
Published: 2012-11-29
Description: Unspecified vulnerability in Tivoli Endpoint Manager for Remote Control Broker 8.2 before 8.2.1-TIV-TEMRC821-IF0002 allows remote attackers to cause a denial of service (resource consumption) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg21616746; http://www.securityfocus.com/bid/56649; https://exchange.xforce.ibmcloud.com/vulnerabilities/79125
CVE: CVE-2012-5530
Published: 2012-11-29
Description: The (1) pcmd and (2) pmlogger init scripts in Performance Co-Pilot (PCP) before 3.6.10 allow local users to overwrite arbitrary files via a symlink attack on a /var/tmp/##### temporary file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00024.html; http://www.securityfocus.com/bid/56656; https://bugzilla.novell.com/show_bug.cgi?id=782967
CVE: CVE-2012-4220
Published: 2012-11-30
Description: diagchar_core.c in the Qualcomm Innovation Center (QuIC) Diagnostics (aka DIAG) kernel-mode driver for Android 2.3 through 4.2 allows attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via an application that uses crafted arguments in a local diagchar_ioctl call.
CVSS Score: 6.8 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/702452; https://www.codeaurora.org/projects/security-advisories/multiple-issues-diagkgsl-system-call-handling-cve-2012-4220-cve-2012; http://www.kb.cert.org/vuls/id/702452
CVE: CVE-2012-4221
Published: 2012-11-30
Description: Integer overflow in diagchar_core.c in the Qualcomm Innovation Center (QuIC) Diagnostics (aka DIAG) kernel-mode driver for Android 2.3 through 4.2 allows attackers to execute arbitrary code or cause a denial of service via an application that uses crafted arguments in a local diagchar_ioctl call.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://www.kb.cert.org/vuls/id/702452; https://www.codeaurora.org/projects/security-advisories/multiple-issues-diagkgsl-system-call-handling-cve-2012-4220-cve-2012; http://www.kb.cert.org/vuls/id/702452
CVE: CVE-2012-4222
Published: 2012-11-30
Description: drivers/gpu/msm/kgsl.c in the Qualcomm Innovation Center (QuIC) Graphics KGSL kernel-mode driver for Android 2.3 through 4.2 allows attackers to cause a denial of service (NULL pointer dereference) via an application that uses crafted arguments in a local kgsl_ioctl call.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/702452; https://www.codeaurora.org/projects/security-advisories/multiple-issues-diagkgsl-system-call-handling-cve-2012-4220-cve-2012; http://www.kb.cert.org/vuls/id/702452
CVE: CVE-2012-5174
Published: 2012-11-30
Description: The KYOCERA AH-K3001V, AH-K3002V, WX300K, WX310K, WX320K, and WX320KR devices allow remote attackers to cause a denial of service (persistent reboot) via an e-mail message in an invalid format.
CVSS Score: 7.8 (HIGH)
References: http://jvn.jp/en/jp/JVN83907168/361447/index.html; http://jvn.jp/en/jp/JVN83907168/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000105
CVE: CVE-2012-4557
Published: 2012-11-30
Description: The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://httpd.apache.org/security/vulnerabilities_22.html#2.2.22; http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html
CVE: CVE-2012-4834
Published: 2012-11-30
Description: Directory traversal vulnerability in LayerLoader.jsp in the theme component in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF19 and 8.0 before CF03 allows remote attackers to read arbitrary files via a crafted URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/51281; http://www-01.ibm.com/support/docview.wss?uid=swg1PM76354; http://www.ibm.com/connections/blogs/PSIRT/entry/security_vulnerability_in_theme_component_for_websphere_portal_versions_7_0_0_x_and_8_0_cve2012_48344
CVE: CVE-2012-5568
Published: 2012-11-30
Description: Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.
CVSS Score: 5.0 (MEDIUM)
References: http://captainholly.wordpress.com/2009/06/19/slowloris-vs-tomcat/; http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html; http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
CVE: CVE-2012-4468
Published: 2012-11-30
Description: Cross-site scripting (XSS) vulnerability in the Privatemsg module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a user name in a private message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1649338; http://drupal.org/node/1649346; http://www.openwall.com/lists/oss-security/2012/10/04/3
CVE: CVE-2012-4469
Published: 2012-11-30
Description: Cross-site scripting (XSS) vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal, when "Log failed hashcash" is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid token, which is not properly handled when administrators use the Database logging module.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1650784; http://drupal.org/node/1650790; http://drupal.org/node/1663306
CVE: CVE-2012-4470
Published: 2012-11-30
Description: The Listhandler module 6.x-1.x before 6.x-1.1 for Drupal does not properly check permissions when importing emails, which allows remote comment authors to bypass access restrictions and possibly have other unspecified impact.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://drupal.org/node/1679412; http://drupal.org/node/1819780; http://www.openwall.com/lists/oss-security/2012/10/04/3
CVE: CVE-2012-4471
Published: 2012-11-30
Description: The Search Autocomplete module 7.x-2.x before 7.x-2.4 for Drupal does not properly restrict access to the module admin page, which allows remote attackers to disable an autocompletion or change the priority order via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1649442; http://drupal.org/node/1679422; http://www.openwall.com/lists/oss-security/2012/10/04/3
CVE: CVE-2012-4472
Published: 2012-11-30
Description: Unrestricted file upload vulnerability in upload.php in the Drag & Drop Gallery module 6.x-1.5 and earlier for Drupal allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the directory specified by the filedir parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://drupal.org/node/1679442; http://secunia.com/advisories/49698; http://www.opensyscom.fr/Actualites/drupal-modules-drag-a-drop-gallery-arbitrary-file-upload-vulnerability.html
CVE: CVE-2012-4473
Published: 2012-11-30
Description: The Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "view any node page" or "view any node {type} page" permission to access unpublished nodes via a direct request.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://drupal.org/node/1662724; http://drupal.org/node/1679466; http://www.openwall.com/lists/oss-security/2012/10/04/3
CVE: CVE-2012-4474
Published: 2012-11-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Colorbox Node module 7.x-2.x before 7.x-2.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1679410; http://drupal.org/node/1679486; http://www.openwall.com/lists/oss-security/2012/10/04/3
CVE: CVE-2012-4475
Published: 2012-11-30
Description: The Security Questions module for Drupal 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1 does not properly restrict access, which allows remote attackers to edit an arbitrary user's questions and answers via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1648200; http://drupal.org/node/1648204; http://drupal.org/node/1679532
CVE: CVE-2012-4476
Published: 2012-11-30
Description: Cross-site scripting (XSS) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1679442; http://www.openwall.com/lists/oss-security/2012/10/04/5; http://drupal.org/node/1679442
CVE: CVE-2012-4477
Published: 2012-11-30
Description: Unspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to bypass access restrictions via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1679442; http://www.openwall.com/lists/oss-security/2012/10/04/5; http://drupal.org/node/1679442