deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-5078
Published: 2012-02-08
Description: The web administration interface in the server in Sybase M-Business Anywhere 6.7 before ESD# 3 and 7.0 before ESD# 7 does not require admin authentication for unspecified scripts, which allows remote authenticated users to list or delete user accounts, modify passwords, or read log files via HTTP requests, aka Bug IDs 678497 and 678499.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.sybase.com/detail?id=1095200; http://www.verisigninc.com/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=952; http://www.sybase.com/detail?id=1095200
CVE: CVE-2012-1035
Published: 2012-02-08
Description: AdaCore Ada Web Services (AWS) before 2.10.2 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0169.html; http://www.adacore.com/2012/01/27/security-advisory-sa-2012-l119-003-hash-collisions-in-aws/; http://www.nruns.com/_downloads/advisory28122011.pdf
CVE: CVE-2011-3953
Published: 2012-02-09
Description: Google Chrome before 17.0.963.46 does not prevent monitoring of the clipboard after a paste event, which has unspecified impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=73478; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14392
CVE: CVE-2011-3954
Published: 2012-02-09
Description: Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) via vectors that trigger a large amount of database usage.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-400
References: http://code.google.com/p/chromium/issues/detail?id=92550; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14970
CVE: CVE-2011-3955
Published: 2012-02-09
Description: Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors that trigger the aborting of an IndexedDB transaction.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=93106; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14905
CVE: CVE-2011-3956
Published: 2012-02-09
Description: The extension implementation in Google Chrome before 17.0.963.46 does not properly handle sandboxed origins, which might allow remote attackers to bypass the Same Origin Policy via a crafted extension.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-346
References: http://code.google.com/p/chromium/issues/detail?id=103630; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14906
CVE: CVE-2011-3957
Published: 2012-02-09
Description: Use-after-free vulnerability in the garbage-collection functionality in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving PDF documents.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=104056; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14675
CVE: CVE-2011-3958
Published: 2012-02-09
Description: Google Chrome before 17.0.963.46 does not properly perform casts of variables during handling of a column span, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=105459; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3959
Published: 2012-02-09
Description: Buffer overflow in the locale implementation in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://code.google.com/p/chromium/issues/detail?id=106441; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14235
CVE: CVE-2011-3960
Published: 2012-02-09
Description: Google Chrome before 17.0.963.46 does not properly decode audio data, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=108416; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14921
CVE: CVE-2011-3961
Published: 2012-02-09
Description: Race condition in Google Chrome before 17.0.963.46 allows remote attackers to execute arbitrary code via vectors that trigger a crash of a utility process.
CVSS Score: 9.3 (HIGH)
CWE: CWE-362
References: http://code.google.com/p/chromium/issues/detail?id=108871; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14864
CVE: CVE-2011-3962
Published: 2012-02-09
Description: Google Chrome before 17.0.963.46 does not properly perform path clipping, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=108901; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14249
CVE: CVE-2011-3963
Published: 2012-02-09
Description: Google Chrome before 17.0.963.46 does not properly handle PDF FAX images, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=109094; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14825
CVE: CVE-2011-3964
Published: 2012-02-09
Description: Google Chrome before 17.0.963.46 does not properly implement the drag-and-drop feature, which makes it easier for remote attackers to spoof the URL bar via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=109245; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14591
CVE: CVE-2011-3965
Published: 2012-02-09
Description: Google Chrome before 17.0.963.46 does not properly check signatures, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-347
References: http://code.google.com/p/chromium/issues/detail?id=109664; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14954
CVE: CVE-2011-3966
Published: 2012-02-09
Description: Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to error handling for Cascading Style Sheets (CSS) token-sequence data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=109716; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3967
Published: 2012-02-09
Description: Unspecified vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) via a crafted certificate.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=109717; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14010
CVE: CVE-2011-3968
Published: 2012-02-09
Description: Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving Cascading Style Sheets (CSS) token sequences.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=109743; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3969
Published: 2012-02-09
Description: Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to layout of SVG documents.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=110112; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3970
Published: 2012-02-09
Description: libxslt, as used in Google Chrome before 17.0.963.46, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=110277; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14818
CVE: CVE-2011-3971
Published: 2012-02-09
Description: Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to mousemove events.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=110374; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3972
Published: 2012-02-09
Description: The shader translator implementation in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-787
References: http://code.google.com/p/chromium/issues/detail?id=110559; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14550
CVE: CVE-2011-4038
Published: 2012-02-10
Description: Cross-site scripting (XSS) vulnerability in Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/47742; http://secunia.com/advisories/47933; http://www.us-cert.gov/control_systems/pdf/ICSA-12-024-01.pdf
CVE: CVE-2011-4039
Published: 2012-02-10
Description: Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows user-assisted remote attackers to execute arbitrary code via a malformed file that triggers a "write access violation."
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/47742; http://secunia.com/advisories/47933; http://www.us-cert.gov/control_systems/pdf/ICSA-12-024-01.pdf
CVE: CVE-2011-4533
Published: 2012-02-10
Description: zenAdminSrv.exe in Ing. Punzenberger COPA-DATA zenon 6.51 SP0 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted packet to TCP port 50777, aka Reference Number 25240.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/47892; http://www.us-cert.gov/control_systems/pdf/ICSA-12-013-01.pdf; http://secunia.com/advisories/47892
CVE: CVE-2011-4534
Published: 2012-02-10
Description: ZenSysSrv.exe in Ing. Punzenberger COPA-DATA zenon 6.51 SP0 allows remote attackers to cause a denial of service (service crash) or possibly execute arbitrary code via a series of connections and disconnections on TCP port 1101, aka Reference Number 25212.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/47892; http://www.us-cert.gov/control_systems/pdf/ICSA-12-013-01.pdf; http://secunia.com/advisories/47892
CVE: CVE-2012-0840
Published: 2012-02-10
Description: tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://mail-archives.apache.org/mod_mbox/apr-commits/201201.mbox/%3C[PII_REDACTED]3715.071D423888FD%40eris.apache.org%3E; http://openwall.com/lists/oss-security/2012/02/08/3; http://openwall.com/lists/oss-security/2012/02/09/1
CVE: CVE-2012-1046
Published: 2012-02-10
Description: Cross-site scripting (XSS) vulnerability in TM1 Web in IBM Cognos TM1 9.5.2 FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0696.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/47889; http://securitytracker.com/id?1026648; http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1PM49009
CVE: CVE-2012-0831
Published: 2012-02-10
Description: PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/php_variables.c, sapi/cgi/cgi_main.c, and sapi/fpm/fpm/fpm_main.c.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080037.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080041.html
CVE: CVE-2012-0452
Published: 2012-02-11
Description: Use-after-free vulnerability in Mozilla Firefox 10.x before 10.0.1, Thunderbird 10.x before 10.0.1, and SeaMonkey 2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger failure of an nsXBLDocumentInfo::ReadPrototypeBindings function call, related to the cycle collector's access to a hash table containing a stale XBL binding.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00013.html; http://secunia.com/advisories/48110
CVE: CVE-2012-0834
Published: 2012-02-11
Description: Cross-site scripting (XSS) vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a query_engine action to cmd.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2012/02/02/9; http://openwall.com/lists/oss-security/2012/02/03/3; http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin%3Ba=commit%3Bh=7dc8d57d6952fe681cb9e8818df7f103220457bd
CVE: CVE-2011-4340
Published: 2012-02-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author privileges to inject arbitrary web script or HTML via (1) the profile parameter to extensions/profiledevkit/content/content.profile.php, as demonstrated via requests to (a) the default URI, (b) about/, or (c) drafts/; or (2) the filter parameter in symphony/lib/core/class.symphony.php, as demonstrated via requests to (d) symphony/publish/comments or (e) symphony/publish/images.  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/106493/symphonycms-sqlxss.txt; http://seclists.org/bugtraq/2011/Nov/8; http://secunia.com/advisories/46663
CVE: CVE-2011-4341
Published: 2012-02-12
Description: Multiple SQL injection vulnerabilities in symphony/content/content.publish.php in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author permissions to execute arbitrary SQL commands via the filter parameter to (1) symphony/publish/comments or (2) symphony/publish/images.  NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks via error messages.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/106493/symphonycms-sqlxss.txt; http://seclists.org/bugtraq/2011/Nov/8; http://secunia.com/advisories/46663
CVE: CVE-2012-1047
Published: 2012-02-12
Description: Directory traversal vulnerability in the WWWHELP Service (js/html/wwhelp.htm) in Cyberoam Central Console (CCC) 2.00.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter in an Online_help action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0036.html; http://www.exploit-db.com/exploits/18473; http://www.securityfocus.com/bid/51901
CVE: CVE-2012-1048
Published: 2012-02-12
Description: Cross-site scripting (XSS) vulnerability in communityplusplus/www/administrator.php in eFront Community++ edition 3.6.10, and possibly other editions, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0033.html; http://www.securityfocus.com/bid/51894; http://www.vulnerability-lab.com/get_content.php?id=423
CVE: CVE-2012-1049
Published: 2012-02-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ADManager Plus 5.2 Build 5210 allow remote attackers to inject arbitrary web script or HTML via the (1) domainName parameter to jsp/AddDC.jsp or (2) operation parameter to DomainConfig.do.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/109528; http://secunia.com/advisories/47887; http://www.securityfocus.com/bid/51893
CVE: CVE-2012-1050
Published: 2012-02-13
Description: Directory traversal vulnerability in Mathopd 1.4.x and 1.5.x before 1.5p7, when configured with the * construct for mass virtual hosting, allows remote attackers to read arbitrary files via a crafted Host header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0025.html; http://osvdb.org/78896; http://secunia.com/advisories/47908
CVE: CVE-2012-1051
Published: 2012-02-13
Description: Heap-based buffer overflow in Xjp2.dll in the JPEG2000 plug-in in XnView 1.98.5 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/78904; http://secunia.com/advisories/47352; http://www.securityfocus.com/bid/51896
CVE: CVE-2012-1052
Published: 2012-02-13
Description: Buffer overflow in IvanView 1.2.15 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/78905; http://secunia.com/advisories/47362; http://www.securityfocus.com/bid/51895
CVE: CVE-2012-0340
Published: 2012-02-13
Description: Cross-site scripting (XSS) vulnerability in the management interface on the Cisco IronPort Encryption Appliance with software before 6.5.3 allows remote attackers to inject arbitrary web script or HTML via the header parameter to the default URI under admin/, aka bug ID 72410.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=25045; http://www.secureworks.com/research/advisories/SWRX-2012-001/; http://tools.cisco.com/security/center/viewAlert.x?alertId=25045
CVE: CVE-2012-0829
Published: 2012-02-14
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Mibew Messenger 1.6.4 and earlier allow remote attackers to hijack the authentication of operators for requests that insert cross-site scripting (XSS) sequences via the (1) address or (2) threadid parameters to operator/ban.php; or (3) geolinkparams, (4) title, or (5) chattitle parameters to operator/settings.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0178.html; http://secunia.com/advisories/47787; http://www.codseq.it/advisories/mibew_messenger_multiple_xss
CVE: CVE-2012-1055
Published: 2012-02-14
Description: Heap-based buffer overflow in PhotoLine 17.01 and possibly other versions before 17.02 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/78985; http://secunia.com/advisories/47477; http://www.securityfocus.com/bid/51948
CVE: CVE-2012-1056
Published: 2012-02-14
Description: The Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal does not properly enforce permissions for (1) Recent forwards, (2) Most forwarded, or (3) Dynamic blocks, which allows remote attackers to obtain node titles via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1423722; http://drupal.org/node/1425150; http://osvdb.org/78817
CVE: CVE-2012-1057
Published: 2012-02-14
Description: Cross-site request forgery (CSRF) vulnerability in the clickthrough tracking functionality in the Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that increase node rankings via the tracking code, possibly related to improper "flood control."
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1423722; http://drupal.org/node/1425150; http://drupalcode.org/project/forward.git/commitdiff/72158fdbfbf5a068938985e3d10ce1d8f969d9c3
CVE: CVE-2012-1058
Published: 2012-02-14
Description: Cross-site request forgery (CSRF) vulnerability in Flyspray 0.9.9.6 allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an admin.newuser action to index.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/78923; http://packetstormsecurity.org/files/109507/Flyspray-0.9.9.6-Cross-Site-Request-Forgery.html; http://secunia.com/advisories/47881