deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-4746
Published: 2012-08-31
Description: Cross-site request forgery (CSRF) vulnerability in accessaccount.cgi in ZTE ZXDSL 831IIV7.5.0a_Z29_OV allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysPassword parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.exploit-db.com/exploits/18722; http://www.exploit-db.com/exploits/18722
CVE: CVE-2012-0275
Published: 2012-09-04
Description: Heap-based buffer overflow in Photoshop.exe in Adobe Photoshop CS5 12.x before 12.0.5, CS5.1 12.1.x before 12.1.1, and CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted TIFF image with SGI24LogLum compression.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/secunia_research/2012-29/; http://www.adobe.com/support/security/bulletins/apsb12-11.html; http://www.adobe.com/support/security/bulletins/apsb12-20.html
CVE: CVE-2012-2288
Published: 2012-09-04
Description: Format string vulnerability in the nsrd RPC service in EMC NetWorker 7.6.3 and 7.6.4 before 7.6.4.1, and 8.0 before 8.0.0.1, allows remote attackers to execute arbitrary code via format string specifiers in a message.
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://archives.neohapsis.com/archives/bugtraq/2012-08/0219.html; http://www.securityfocus.com/bid/55330; http://www.securitytracker.com/id?1027459
CVE: CVE-2012-3014
Published: 2012-09-04
Description: The Management Software application in GarrettCom Magnum MNS-6K before 4.4.0, and 14.x before 14.4.0, has a hardcoded password for an administrative account, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.7 (HIGH)
CWE: CWE-255
References: http://www.garrettcom.com/techsupport/6k_dl/6k440_rn.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-243-01.pdf; http://www.garrettcom.com/techsupport/6k_dl/6k440_rn.pdf
CVE: CVE-2012-3582
Published: 2012-09-04
Description: Symantec PGP Universal Server 3.2.x before 3.2.1 MP2 does not properly manage sessions that include key search requests, which might allow remote attackers to read a private key in opportunistic circumstances by making a request near the end of a user's session.
CVSS Score: 2.9 (LOW)
CWE: CWE-264
References: http://www.securityfocus.com/bid/55246; http://www.securitytracker.com/id?1027467; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120830_00
CVE: CVE-2012-3981
Published: 2012-09-04
Description: Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not restrict the characters in a username, which might allow remote attackers to inject data into an LDAP directory via a crafted login attempt.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://osvdb.org/85072; http://www.bugzilla.org/security/3.6.10/; http://www.mandriva.com/security/advisories?name=MDVSA-2013:066
CVE: CVE-2012-4747
Published: 2012-09-04
Description: Bugzilla 2.x and 3.x through 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to read (1) template (aka .tmpl) files, (2) other custom extension files under extensions/, or (3) custom documentation files under docs/ via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.bugzilla.org/security/3.6.10/; https://bugzilla.mozilla.org/show_bug.cgi?id=785511; https://bugzilla.mozilla.org/show_bug.cgi?id=785522
CVE: CVE-2012-1605
Published: 2012-09-04
Description: The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."
CVSS Score: 5.0 (MEDIUM)
References: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/; http://www.openwall.com/lists/oss-security/2012/03/30/4; http://www.osvdb.org/80759
CVE: CVE-2012-1606
Published: 2012-09-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/80760; http://secunia.com/advisories/48622; http://secunia.com/advisories/48647
CVE: CVE-2012-1607
Published: 2012-09-04
Description: The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/80761; http://secunia.com/advisories/48622; http://secunia.com/advisories/48647
CVE: CVE-2012-1608
Published: 2012-09-04
Description: The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/48647; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/; http://www.debian.org/security/2012/dsa-2445
CVE: CVE-2012-1613
Published: 2012-09-04
Description: Cross-site scripting (XSS) vulnerability in edit_one_pic.php in Coppermine Photo Gallery before 1.5.20 allows remote authenticated users with certain privileges to inject arbitrary web script or HTML via the keywords parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0167.html; http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.6.x/edit_one_pic.php?r1=8348&r2=8354; http://forum.coppermine-gallery.net/index.php/topic%2C74682.0.html
CVE: CVE-2012-1614
Published: 2012-09-04
Description: Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via (1) a direct request to plugins/visiblehookpoints/index.php, an invalid (2) page or (3) cat parameter to thumbnails.php, an invalid (4) page parameter to usermgr.php, or an invalid (5) newer_than or (6) older_than parameter to search.inc.php, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0167.html; http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.6.x/edit_one_pic.php?r1=8348&r2=8354; http://forum.coppermine-gallery.net/index.php/topic%2C74682.0.html
CVE: CVE-2012-2109
Published: 2012-09-04
Description: SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page parameter in an activity_widget_filter action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://buddypress.org/2012/03/buddypress-1-5-5/; http://osvdb.org/80763; http://seclists.org/bugtraq/2012/Apr/4
CVE: CVE-2012-2063
Published: 2012-09-05
Description: The Slidebox module before 7.x-1.4 for Drupal does not properly check permissions, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1482166; http://drupal.org/node/1482342; http://drupalcode.org/project/slidebox.git/commit/3dae144
CVE: CVE-2012-2064
Published: 2012-09-05
Description: Cross-site scripting (XSS) vulnerability in theme/views_lang_switch.theme.inc in the Views Language Switcher module before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1482420; http://drupalcode.org/project/views_lang_switch.git/commit/c27c318; http://secunia.com/advisories/48355
CVE: CVE-2012-2065
Published: 2012-09-05
Description: Cross-site scripting (XSS) vulnerability in the Language Icons module 6.x-2.x before 6.x-2.1 and 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with administer languages permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1482136; http://drupal.org/node/1482144; http://drupal.org/node/1482428
CVE: CVE-2012-2066
Published: 2012-09-05
Description: Cross-site scripting (XSS) vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal allows remote authenticated users or remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1482442; http://drupal.org/node/1482466; http://drupal.org/node/1482480
CVE: CVE-2012-2067
Published: 2012-09-05
Description: Unspecified vulnerability in the CKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal, when the core PHP module is enabled, allows remote authenticated users or remote attackers to execute arbitrary PHP code via the text parameter to a text filter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://drupal.org/node/1482442; http://drupal.org/node/1482466; http://drupal.org/node/1482480
CVE: CVE-2012-2068
Published: 2012-09-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in fancy_slide.module in the Fancy Slide module before 6.x-2.7 for Drupal allow remote authenticated users with the administer fancy_slide permission to inject arbitrary web script or HTML via the (1) node_title or (2) nodequeue_title parameter.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1417688; http://drupal.org/node/1482744; http://drupalcode.org/project/fancy_slide.git/commit/cd2a424
CVE: CVE-2011-4448
Published: 2012-09-05
Description: SQL injection vulnerability in actions/usersettings/usersettings.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to execute arbitrary SQL commands via the default_comment_display parameter in an update action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://wush.net/trac/wikka/changeset/1820; http://wush.net/trac/wikka/ticket/1097; http://wush.net/trac/wikka/changeset/1820
CVE: CVE-2011-4449
Published: 2012-09-05
Description: actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by placing this code in a file whose name has multiple extensions, as demonstrated by a (1) .mm or (2) .vpp file.
CVSS Score: 6.8 (MEDIUM)
References: http://wush.net/trac/wikka/changeset/1822; http://wush.net/trac/wikka/ticket/1097; http://wush.net/trac/wikka/changeset/1822
CVE: CVE-2011-4450
Published: 2012-09-05
Description: Directory traversal vulnerability in handlers/files.xml/files.xml.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to read or delete arbitrary files via a non-initial .. (dot dot) in the file parameter, as demonstrated by the /../../wikka.config.php pathname in a download action.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://wush.net/trac/wikka/changeset/1828; http://wush.net/trac/wikka/ticket/1097; http://wush.net/trac/wikka/changeset/1828
CVE: CVE-2011-4451
Published: 2012-09-05
Description: libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam_logging option is enabled, allows remote attackers to write arbitrary PHP code to the spamlog_path file via the User-Agent HTTP header in an addcomment request.  NOTE: the vendor disputes this issue because the rendering of the spamlog_path file never uses the PHP interpreter
CVSS Score: 4.3 (MEDIUM)
References: http://wush.net/trac/wikka/ticket/1098; http://wush.net/trac/wikka/ticket/1098
CVE: CVE-2011-4452
Published: 2012-09-05
Description: Cross-site request forgery (CSRF) vulnerability in the AdminUsers component in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to hijack the authentication of administrators for requests that remove arbitrary user accounts via a delete operation, as demonstrated by an {{image}} action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://wush.net/trac/wikka/changeset/1819; http://wush.net/trac/wikka/changeset/1832; http://wush.net/trac/wikka/ticket/1097
CVE: CVE-2012-3012
Published: 2012-09-05
Description: The Arbiter Power Sentinel 1133A device with firmware before 11Jun2012 Rev 421 allows remote attackers to cause a denial of service (Ethernet outage) via unspecified Ethernet traffic that fills a buffer, as demonstrated by a port scan.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.arbiter.com/news/index.php?id=261; http://www.us-cert.gov/control_systems/pdf/ICSA-12-249-01.pdf; http://www.arbiter.com/news/index.php?id=261
CVE: CVE-2010-4818
Published: 2012-09-05
Description: The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via (1) a crafted request that triggers a client swap in glx/glxcmdsswap.c; or (2) a crafted length or (3) a negative value in the screen field in a request to glx/glxcmds.c.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://cgit.freedesktop.org/xorg/xserver/commit?id=3f0d3f4d97bce75c1828635c322b6560a45a037f; http://cgit.freedesktop.org/xorg/xserver/commit?id=6c69235a9dfc52e4b4e47630ff4bab1a820eb543; http://cgit.freedesktop.org/xorg/xserver/commit?id=ec9c97c6bf70b523bc500bd3adf62176f1bb33a4
CVE: CVE-2010-4819
Published: 2012-09-05
Description: The ProcRenderAddGlyphs function in the Render extension (render/render.c) in X.Org xserver 1.7.7 and earlier allows local users to read arbitrary memory and possibly cause a denial of service (server crash) via unspecified vectors related to an "input sanitization flaw."
CVSS Score: 3.6 (LOW)
CWE: CWE-20
References: http://aix.software.ibm.com/aix/efixes/security/X_advisory2.asc; http://cgit.freedesktop.org/xorg/xserver/commit/render/render.c?id=5725849a1b427cd4a72b84e57f211edb35838718; http://rhn.redhat.com/errata/RHSA-2011-1359.html
CVE: CVE-2011-3146
Published: 2012-09-05
Description: librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and possibly execute arbitrary code via a SVG file with a node with the element name starting with "fe," which is misidentified as a RsvgFilterPrimitive.
CVSS Score: 6.8 (MEDIUM)
References: http://ftp.gnome.org/pub/GNOME/sources/librsvg/2.34/librsvg-2.34.1.news; http://git.gnome.org/browse/librsvg/commit/?id=34c95743ca692ea0e44778e41a7c0a129363de84; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065730.html
CVE: CVE-2012-3509
Published: 2012-09-05
Description: Multiple integer overflows in the (1) _objalloc_alloc function in objalloc.c and (2) objalloc_alloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service (crash) via vectors related to the "addition of CHUNK_HEADER_SIZE to the length," which triggers a heap-based buffer overflow.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54411; http://gcc.gnu.org/ml/gcc-patches/2012-08/msg01986.html; http://security-tracker.debian.org/tracker/CVE-2012-3509
CVE: CVE-2012-3526
Published: 2012-09-05
Description: The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683984; http://secunia.com/advisories/50400; http://www.debian.org/security/2012/dsa-2532
CVE: CVE-2012-3527
Published: 2012-09-05
Description: view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-502
References: http://osvdb.org/84773; http://secunia.com/advisories/50287; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/
CVE: CVE-2012-3528
Published: 2012-09-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/84771; http://secunia.com/advisories/50287; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/
CVE: CVE-2012-3529
Published: 2012-09-05
Description: The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://osvdb.org/84775; http://secunia.com/advisories/50287; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/
CVE: CVE-2012-3530
Published: 2012-09-05
Description: Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/84772; http://secunia.com/advisories/50287; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/
CVE: CVE-2012-3531
Published: 2012-09-05
Description: Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/; http://www.debian.org/security/2012/dsa-2537; http://www.openwall.com/lists/oss-security/2012/08/22/8
CVE: CVE-2012-3535
Published: 2012-09-05
Description: Heap-based buffer overflow in OpenJPEG 1.5.0 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted JPEG2000 file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/openjpeg/issues/detail?id=170; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090021.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090579.html
CVE: CVE-2012-3537
Published: 2012-09-05
Description: The Crowbar Ohai plugin (chef/cookbooks/ohai/files/default/plugins/crowbar.rb) in the Deployer Barclamp in Crowbar, possibly 1.4 and earlier, allows local users to execute arbitrary shell commands via vectors related to "insecure handling of tmp files" and predictable file names.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/84955; http://secunia.com/advisories/50442; http://www.openwall.com/lists/oss-security/2012/08/27/5
CVE: CVE-2012-3540
Published: 2012-09-05
Description: Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/50480; http://www.openwall.com/lists/oss-security/2012/08/30/4; http://www.openwall.com/lists/oss-security/2012/08/30/5
CVE: CVE-2012-3542
Published: 2012-09-05
Description: OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API.  NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/50467; http://secunia.com/advisories/50494; http://www.openwall.com/lists/oss-security/2012/08/30/6
CVE: CVE-2012-3551
Published: 2012-09-05
Description: Cross-site scripting (XSS) vulnerability in crowbar_framework/app/views/support/index.html.haml in the Crowbar barclamp in Crowbar, possibly 1.4 and earlier, allows remote attackers to inject arbitrary web script or HTML via the file parameter to /utils.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/08/31/1; http://www.securityfocus.com/bid/55315; https://bugzilla.novell.com/show_bug.cgi?id=771840
CVE: CVE-2012-4386
Published: 2012-09-05
Description: The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/50420; http://struts.apache.org/2.x/docs/s2-010.html; http://www.openwall.com/lists/oss-security/2012/09/01/4
CVE: CVE-2012-4387
Published: 2012-09-05
Description: Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/50420; http://struts.apache.org/2.x/docs/s2-011.html; http://www.openwall.com/lists/oss-security/2012/09/01/4
CVE: CVE-2012-4389
Published: 2012-09-05
Description: Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an import.zip file and accessing an uploaded PHP file.
CVSS Score: 6.8 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2012/09/02/2; https://github.com/owncloud/core/commit/4fd069b47906ebcf83887970c732d464dbe7d37a; http://www.openwall.com/lists/oss-security/2012/09/02/2
CVE: CVE-2012-4390
Published: 2012-09-05
Description: (1) apps/calendar/appinfo/remote.php and (2) apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote authenticated users to enumerate the registered users via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://owncloud.org/changelog/; http://www.openwall.com/lists/oss-security/2012/09/02/2; https://github.com/owncloud/core/commit/4682846d3ecdad15c6a60126dda75eb7fa97c707
CVE: CVE-2012-4391
Published: 2012-09-05
Description: Cross-site request forgery (CSRF) vulnerability in core/ajax/appconfig.php in ownCloud before 4.0.7 allows remote attackers to hijack the authentication of administrators for requests that edit the app configurations.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://owncloud.org/changelog/; http://www.openwall.com/lists/oss-security/2012/09/02/2; https://github.com/owncloud/core/commit/5192eecce239a0b7ade1e60a6cf03075e5cfc188