deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-2888
Published: 2011-07-27
Description: IBM Lotus Symphony 3 before FP3 allows remote attackers to cause a denial of service (application hang) via complex graphics in a presentation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/74165; http://www.ibm.com/software/lotus/symphony/buzz.nsf/web_DisPlayPlugin?open&unid=9717F6F587AAA939852578D300404BCF&category=announcements; http://www.ibm.com/software/lotus/symphony/idcontents/releasenotes/en/readme_fixpack3_standalone_long.htm
CVE: CVE-2011-2889
Published: 2011-07-27
Description: templates/system/error.php in Joomla! before 1.5.23 might allow remote attackers to obtain sensitive information via unspecified vectors that trigger an undefined value of a certain error field, leading to disclosure of the installation path.  NOTE: this might overlap CVE-2011-2488.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://developer.joomla.org/security/news/9-security/10-core-security/[PII_REDACTED]1-core-information-disclosure.html; http://www.joomla.org/announcements/release-news/5367-joomla-1523-released.html; http://www.openwall.com/lists/oss-security/2011/07/01/1
CVE: CVE-2011-2890
Published: 2011-07-27
Description: The MediaViewMedia class in administrator/components/com_media/views/media/view.html.php in Joomla! 1.5.23 and earlier allows remote attackers to obtain sensitive information via vectors involving the base variable, leading to disclosure of the installation path, a different vulnerability than CVE-2011-2488.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2011/07/01/1; https://exchange.xforce.ibmcloud.com/vulnerabilities/68882; http://www.openwall.com/lists/oss-security/2011/07/01/1
CVE: CVE-2011-2891
Published: 2011-07-27
Description: Joomla! 1.6.x before 1.6.2 allows remote attackers to obtain sensitive information via an empty Itemid array parameter to index.php, which reveals the installation path in an error message, a different vulnerability than CVE-2011-2488.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://bl0g.yehg.net/2011/04/joomla-161-and-lower-information.html; http://developer.joomla.org/security/news/[PII_REDACTED]2-core-information-disclosure.html; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-2892
Published: 2011-07-27
Description: Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://bl0g.yehg.net/2011/04/joomla-161-and-lower-information.html; http://developer.joomla.org/security/news/[PII_REDACTED]9-core-clickjacking.html; http://bl0g.yehg.net/2011/04/joomla-161-and-lower-information.html
CVE: CVE-2011-2893
Published: 2011-07-27
Description: The DataPilot feature in IBM Lotus Symphony 3 before FP3 allows user-assisted remote attackers to cause a denial of service (application crash) via a large .xls spreadsheet with an invalid Value reference.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/74166; http://www.ibm.com/software/lotus/symphony/buzz.nsf/web_DisPlayPlugin?open&unid=9717F6F587AAA939852578D300404BCF&category=announcements; http://www.ibm.com/software/lotus/symphony/idcontents/releasenotes/en/readme_fixpack3_standalone_long.htm
CVE: CVE-2011-1339
Published: 2011-07-28
Description: Cross-site scripting (XSS) vulnerability in Google Search Appliance before 5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN86220950/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000054; http://jvn.jp/en/jp/JVN86220950/index.html
CVE: CVE-2011-2688
Published: 2011-07-28
Description: SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://anders.fix.no/software/#unix; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633637; http://code.google.com/p/mod-auth-external/issues/detail?id=5
CVE: CVE-2011-2747
Published: 2011-07-28
Description: Google Picasa before 3.6 Build 105.67 does not properly handle invalid properties in JPEG images, which allows remote attackers to execute arbitrary code via a crafted image file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/73980; http://picasa.google.com/support/bin/static.py?hl=en&page=release_notes.cs&from=53209&rd=1; http://secunia.com/advisories/45293
CVE: CVE-2011-2956
Published: 2011-07-28
Description: AzeoTech DAQFactory before 5.85 (Build 1842) does not perform authentication for certain signals, which allows remote attackers to cause a denial of service (system reboot or shutdown) via a signal.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://www.azeotech.com/revisionhistory.php; http://www.us-cert.gov/control_systems/pdf/ICSA-11-122-01.pdf; http://www.azeotech.com/revisionhistory.php
CVE: CVE-2011-2957
Published: 2011-07-28
Description: Unspecified vulnerability in Rockwell Automation FactoryTalk Diagnostics Viewer before V2.30.00 (CPR9 SR3) allows local users to execute arbitrary code via a crafted FactoryTalk Diagnostics Viewer (.ftd) configuration file, which triggers memory corruption.
CVSS Score: 6.9 (MEDIUM)
References: http://rockwellautomation.custhelp.com/app/answers/detail/a_id/448424; http://www.securityfocus.com/bid/48962; http://www.us-cert.gov/control_systems/pdf/ICSA-11-175-01.pdf
CVE: CVE-2011-2958
Published: 2011-07-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ecava IntegraXor before 3.60 (Build 4080) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.integraxor.com/blog/security-issue-xss-vulnerability-note; http://www.us-cert.gov/control_systems/pdf/ICSA-11-147-02.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/68896
CVE: CVE-2011-2492
Published: 2011-07-28
Description: The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8d03e971cf403305217b8e62db3a2e5ad2d6263f; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6211&w=2; http://permalink.gmane.org/gmane.linux.bluez.kernel/12909
CVE: CVE-2011-2546
Published: 2011-07-28
Description: SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/45355; http://securitytracker.com/id?1025810; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b8915e.shtml
CVE: CVE-2011-2547
Published: 2011-07-28
Description: The web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote authenticated users to execute arbitrary commands via crafted parameters to web forms, aka Bug ID CSCtq65681.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/45355; http://securitytracker.com/id?1025810; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b8915e.shtml
CVE: CVE-2011-2549
Published: 2011-07-28
Description: Unspecified vulnerability in Cisco IOS XR 4.1.x before 4.1.1 on Cisco Aggregation Services Routers (ASR) 9000 series devices allows remote attackers to cause a denial of service (line-card reload) via an IPv4 packet, aka Bug ID CSCtr26695.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/45333; http://securitytracker.com/id?1025811; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b89155.shtml
CVE: CVE-2011-2667
Published: 2011-07-28
Description: Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and daemon crash) via a malformed request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/45332; http://securityreason.com/securityalert/8316; http://securitytracker.com/id?1025812
CVE: CVE-2011-2689
Published: 2011-07-28
Description: The gfs2_fallocate function in fs/gfs2/file.c in the Linux kernel before 3.0-rc1 does not ensure that the size of a chunk allocation is a multiple of the block size, which allows local users to cause a denial of service (BUG and system crash) by arranging for all resource groups to have too little free space.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6905d9e4dda6112f007e9090bca80507da158e63; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6211&w=2; http://rhn.redhat.com/errata/RHSA-2011-1065.html
CVE: CVE-2011-2695
Published: 2011-07-28
Description: Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a write operation involving a block number corresponding to the largest possible 32-bit unsigned integer.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-193
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f17722f917b2f21497deb6edc62fb1683daa08e6; http://secunia.com/advisories/45193; http://www.kernel.org/pub/linux/kernel/v3.0/testing/ChangeLog-3.0-rc5
CVE: CVE-2011-2959
Published: 2011-07-29
Description: Stack-based buffer overflow in the Open Database Connectivity (ODBC) service (Odbcixv9se.exe) in 7-Technologies Interactive Graphical SCADA System (IGSS) 9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet to TCP port 22202.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/44345; http://www.insomniasec.com/advisories/ISVA-110427.1.htm; http://www.osvdb.org/72117
CVE: CVE-2011-2960
Published: 2011-07-29
Description: Heap-based buffer overflow in httpsvr.exe 6.0.5.3 in Sunway ForceControl 6.1 SP1, SP2, and SP3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted URL.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/45033; http://securitytracker.com/id?1025672; http://www.cnvd.org.cn/vulnerability/CNVD-2011-05347
CVE: CVE-2011-2961
Published: 2011-07-29
Description: Heap-based buffer overflow in AngelServer.exe 6.0.11.3 in Sunway pNetPower allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UDP packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/44990; http://securitytracker.com/id?1025673; http://www.cnvd.org.cn/vulnerability/CNVD-2011-05348
CVE: CVE-2011-2962
Published: 2011-07-29
Description: Multiple stack-based buffer overflows in Invensys Wonderware Information Server 3.1, 4.0, and 4.0 SP1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via two unspecified ActiveX controls.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/45476; http://www.securityfocus.com/bid/48976; http://www.us-cert.gov/control_systems/pdf/ICSA-11-195-01.pdf
CVE: CVE-2011-2963
Published: 2011-07-29
Description: TCPUploadServer.exe in Progea Movicon 11.2 before Build 1084 does not require authentication for critical functions, which allows remote attackers to obtain sensitive information, delete files, execute arbitrary programs, or cause a denial of service (crash) via a crafted packet to TCP port 10651.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.exploit-db.com/exploits/17034; http://www.osvdb.org/72888; http://www.securityfocus.com/bid/46907
CVE: CVE-2011-2400
Published: 2011-07-29
Description: Cross-site scripting (XSS) vulnerability in HP SiteScope 9.x, 10.x, and 11.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02940969; http://osvdb.org/74113; http://secunia.com/advisories/45440
CVE: CVE-2011-2401
Published: 2011-07-29
Description: Session fixation vulnerability in HP SiteScope 9.x, 10.x, and 11.x allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 8.3 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02940969; http://osvdb.org/74114; http://secunia.com/advisories/45440
CVE: CVE-2011-2522
Published: 2011-07-29
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN29529126/index.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5056&w=2; http://osvdb.org/74071
CVE: CVE-2011-2694
Published: 2011-07-29
Description: Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page).
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN63041502/index.html; http://osvdb.org/74072; http://samba.org/samba/history/samba-3.5.10.html
CVE: CVE-2011-2697
Published: 2011-07-29
Description: foomatic-rip-hplip in HP Linux Imaging and Printing (HPLIP) 3.11.5 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://security.gentoo.org/glsa/glsa-201203-07.xml; http://www.mandriva.com/security/advisories?name=MDVSA-2011:125; http://www.openwall.com/lists/oss-security/2011/07/13/3
CVE: CVE-2011-2964
Published: 2011-07-29
Description: foomaticrip.c in foomatic-rip in foomatic-filters in Foomatic 4.0.6 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file, a different vulnerability than CVE-2011-2697.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/45477; http://security.gentoo.org/glsa/glsa-201203-07.xml; http://www.mandriva.com/security/advisories?name=MDVSA-2011:125
CVE: CVE-2011-1742
Published: 2011-08-01
Description: EMC Data Protection Advisor before 5.8.1 places cleartext account credentials in the DPA configuration file in unspecified circumstances, which might allow local users to obtain sensitive information by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://securityreason.com/securityalert/8318; http://www.securityfocus.com/archive/1/519012/100/0/threaded; http://securityreason.com/securityalert/8318
CVE: CVE-2011-1743
Published: 2011-08-01
Description: Cross-site scripting (XSS) vulnerability in EMC Captiva eInput 2.1.1 before 2.1.1.37 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/8319; http://www.securityfocus.com/archive/1/519010/100/0/threaded; http://securityreason.com/securityalert/8319
CVE: CVE-2011-1744
Published: 2011-08-01
Description: EMC Captiva eInput 2.1.1 before 2.1.1.37 does not restrict the origin of calls to ActiveX functions, which allows remote attackers to read arbitrary files or cause a denial of service via a crafted web site.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://securityreason.com/securityalert/8319; http://www.securityfocus.com/archive/1/519010/100/0/threaded; http://securityreason.com/securityalert/8319
CVE: CVE-2011-2399
Published: 2011-08-01
Description: Unspecified vulnerability in the Media Management Daemon (mmd) in HP Data Protector 6.11 and earlier allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1606&w=2; http://securityreason.com/securityalert/8320; http://www.securityfocus.com/bid/48917
CVE: CVE-2011-2402
Published: 2011-08-01
Description: Cross-site scripting (XSS) vulnerability in HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, and 9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0971&w=2; http://osvdb.org/74133; http://secunia.com/advisories/45454
CVE: CVE-2011-2403
Published: 2011-08-01
Description: SQL injection vulnerability in HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, and 9.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0971&w=2; http://osvdb.org/74134; http://secunia.com/advisories/45454
CVE: CVE-2011-2642
Published: 2011-08-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html; http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=4bd27166c314faa37cada91533b86377f4d4d214
CVE: CVE-2011-2643
Published: 2011-08-01
Description: Directory traversal vulnerability in sql.php in phpMyAdmin 3.4.x before 3.4.3.2, when configuration storage is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a MIME-type transformation parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html; http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c
CVE: CVE-2011-2703
Published: 2011-08-01
Description: Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html; http://secunia.com/advisories/45257; http://secunia.com/advisories/45318
CVE: CVE-2011-2704
Published: 2011-08-01
Description: Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html; http://secunia.com/advisories/45257; http://secunia.com/advisories/45368
CVE: CVE-2011-2718
Published: 2011-08-01
Description: Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to (1) libraries/schema/User_Schema.class.php and (2) schema_export.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html; http://osvdb.org/74111
CVE: CVE-2011-2719
Published: 2011-08-01
Description: libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain swekey.auth.lib.php local variables via a crafted query string, a related issue to CVE-2011-2505.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html; http://osvdb.org/74112
CVE: CVE-2011-2975
Published: 2011-08-01
Description: Double free vulnerability in the msAddImageSymbol function in mapsymbol.c in MapServer before 6.0.1 might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact via crafted mapfile data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html; http://trac.osgeo.org/mapserver/ticket/3939; http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html
CVE: CVE-2011-2358
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 does not ensure that extension installations are confirmed by a browser dialog, which makes it easier for remote attackers to modify the product's functionality via a Trojan horse extension.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=75821; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74228
CVE: CVE-2011-2359
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 does not properly track line boxes during rendering, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=78841; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-2360
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 does not ensure that the user is prompted before download of a dangerous file, which makes it easier for remote attackers to bypass intended content restrictions via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=79266; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74230
CVE: CVE-2011-2361
Published: 2011-08-03
Description: The Basic Authentication dialog implementation in Google Chrome before 13.0.782.107 does not properly handle strings, which might make it easier for remote attackers to capture credentials via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://code.google.com/p/chromium/issues/detail?id=79426; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74231