deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-1293
Published: 2012-09-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20111129-2 allow remote attackers to inject arbitrary web script or HTML via the (1) to or (2) from parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0109.html; http://archives.neohapsis.com/archives/bugtraq/2012-02/0112.html; http://fex.rus.uni-stuttgart.de/fex.html
CVE: CVE-2012-1646
Published: 2012-09-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in the FAQ module 6.x-1.x before 6.x-1.13 and 7.x-1.x-rc1 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via the (1) title parameter in faq.admin.inc or (2) detailed_question parameter in faq.module.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1451194; http://drupalcode.org/project/faq.git/blobdiff/2991dd94e70a2881571a4b777645f4dcc42c1f10..912f1d2:/faq.module; http://drupalcode.org/project/faq.git/blobdiff/525fb85e5a43cb6cfe3028aa88eaf8a6e40548d5..f381756:/faq.admin.inc
CVE: CVE-2012-1116
Published: 2012-09-26
Description: SQL injection vulnerability in Joomla! 1.7.x and 2.5.x before 2.5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://developer.joomla.org/security/news/[PII_REDACTED]1-core-sql-injection.html; http://secunia.com/advisories/48005; http://www.openwall.com/lists/oss-security/2012/03/06/12
CVE: CVE-2012-1117
Published: 2012-09-26
Description: Cross-site scripting (XSS) vulnerability in Joomla! 2.5.0 and 2.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/news/[PII_REDACTED]2-core-xss-vulnerability.html; http://secunia.com/advisories/48005; http://www.openwall.com/lists/oss-security/2012/03/06/12
CVE: CVE-2012-1188
Published: 2012-09-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or (2) querystring parameters to private/en/error or (3) name parameter to private/en/locale/index.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0022.html; http://secunia.com/advisories/48183; http://www.fork-cms.com/blog/detail/fork-cms-3-2-7-released
CVE: CVE-2012-1617
Published: 2012-09-26
Description: Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter.  NOTE: this vulnerability can be leveraged to upload arbitrary files.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0024.html; http://osclass.org/2012/03/05/osclass-2-3-6/; http://secunia.com/advisories/48284
CVE: CVE-2012-5162
Published: 2012-09-26
Description: Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) edit_category_post or (2) enable_category action to index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osclass.org/2012/01/16/osclass-2-3-5/; http://secunia.com/advisories/47697; http://www.codseq.it/advisories/multiple_vulnerabilities_in_osclass
CVE: CVE-2012-5163
Published: 2012-09-26
Description: Cross-site scripting (XSS) vulnerability in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter in an enable_category action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osclass.org/2012/01/16/osclass-2-3-5/; http://secunia.com/advisories/47697; http://www.codseq.it/advisories/multiple_vulnerabilities_in_osclass
CVE: CVE-2012-5164
Published: 2012-09-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the term parameter to (1) autocomplete.php, (2) search/ajax/autosuggest.php, (3) livesuggest.php, or (4) save.php in frontend/modules/search/ajax.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.fork-cms.com/blog/detail/fork-cms-3-2-7-released; https://exchange.xforce.ibmcloud.com/vulnerabilities/78957; https://github.com/forkcms/forkcms/commit/03e8f5b53f193a87116b3875eec39769d5c07114
CVE: CVE-2012-2874
Published: 2012-09-26
Description: Skia, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation, a different vulnerability than CVE-2012-2883.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=132398
CVE: CVE-2012-2875
Published: 2012-09-26
Description: Multiple unspecified vulnerabilities in the PDF functionality in Google Chrome before 22.0.1229.79 allow remote attackers to have an unknown impact via a crafted document.
CVSS Score: 6.8 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; https://code.google.com/p/chromium/issues/detail?id=134955; https://code.google.com/p/chromium/issues/detail?id=135488
CVE: CVE-2012-2876
Published: 2012-09-26
Description: Buffer overflow in the SSE2 optimization functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=135432
CVE: CVE-2012-2877
Published: 2012-09-26
Description: The extension system in Google Chrome before 22.0.1229.79 does not properly handle modal dialogs, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=137707
CVE: CVE-2012-2878
Published: 2012-09-26
Description: Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to plug-in handling.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=137852
CVE: CVE-2012-2879
Published: 2012-09-26
Description: Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service (DOM topology corruption) via a crafted document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=139168
CVE: CVE-2012-2880
Published: 2012-09-26
Description: Race condition in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the plug-in paint buffer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=139462
CVE: CVE-2012-2881
Published: 2012-09-26
Description: Google Chrome before 22.0.1229.79 does not properly handle plug-ins, which allows remote attackers to cause a denial of service (DOM tree corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=139814
CVE: CVE-2012-2882
Published: 2012-09-26
Description: FFmpeg, as used in Google Chrome before 22.0.1229.79, does not properly handle OGG containers, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors, related to a "wild pointer" issue.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://chromiumcodereview.appspot.com/10829204
CVE: CVE-2012-2883
Published: 2012-09-26
Description: Skia, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation, a different vulnerability than CVE-2012-2874.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=140803
CVE: CVE-2012-2884
Published: 2012-09-26
Description: Skia, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=141651
CVE: CVE-2012-2885
Published: 2012-09-26
Description: Double free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to application exit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; http://osvdb.org/85755
CVE: CVE-2012-2886
Published: 2012-09-26
Description: Cross-site scripting (XSS) vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors related to the Google V8 bindings, aka "Universal XSS (UXSS)."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=143437
CVE: CVE-2012-2887
Published: 2012-09-26
Description: Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving onclick events.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=143609
CVE: CVE-2012-2888
Published: 2012-09-26
Description: Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG text references.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=143656
CVE: CVE-2012-2889
Published: 2012-09-26
Description: Cross-site scripting (XSS) vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors involving frames, aka "Universal XSS (UXSS)."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html
CVE: CVE-2012-2890
Published: 2012-09-26
Description: Use-after-free vulnerability in the PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; https://code.google.com/p/chromium/issues/detail?id=143798; https://code.google.com/p/chromium/issues/detail?id=144072
CVE: CVE-2012-2891
Published: 2012-09-26
Description: The IPC implementation in Google Chrome before 22.0.1229.79 allows attackers to obtain potentially sensitive information about memory addresses via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=144051
CVE: CVE-2012-2892
Published: 2012-09-26
Description: Unspecified vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to bypass the pop-up blocker via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=144704
CVE: CVE-2012-2893
Published: 2012-09-26
Description: Double free vulnerability in libxslt, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XSL transforms.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://git.chromium.org/gitweb/?p=chromium.git%3Ba=commit%3Bh=9a5da8e7d4b6f3454614b0331a51bf29c966f556; http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html
CVE: CVE-2012-2894
Published: 2012-09-26
Description: Google Chrome before 22.0.1229.79 does not properly handle graphics-context data structures, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=144899
CVE: CVE-2012-2895
Published: 2012-09-26
Description: The PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; https://code.google.com/p/chromium/issues/detail?id=145029; https://code.google.com/p/chromium/issues/detail?id=145157
CVE: CVE-2012-2896
Published: 2012-09-26
Description: Integer overflow in the WebGL implementation in Google Chrome before 22.0.1229.79 on Mac OS X allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html; https://code.google.com/p/chromium/issues/detail?id=145544
CVE: CVE-2012-2897
Published: 2012-09-26
Description: The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT, as used by Google Chrome before 22.0.1229.79 and other programs, do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a crafted TrueType font file, aka "Windows Font Parsing Vulnerability" or "TrueType Font Parsing Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html; http://secunia.com/advisories/51239; http://www.securitytracker.com/id?1027750
CVE: CVE-2012-3949
Published: 2012-09-27
Description: The SIP implementation in Cisco Unified Communications Manager (CUCM) 6.x and 7.x before 7.1(5b)su5, 8.x before 8.5(1)su4, and 8.6 before 8.6(2a)su1; Cisco IOS 12.2 through 12.4 and 15.0 through 15.2; and Cisco IOS XE 3.3.xSG before 3.3.1SG, 3.4.xS, and 3.5.xS allows remote attackers to cause a denial of service (service crash or device reload) via a crafted SIP message containing an SDP session description, aka Bug IDs CSCtw66721, CSCtj33003, and CSCtw84664.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/85816; http://secunia.com/advisories/50774; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-cucm
CVE: CVE-2012-3950
Published: 2012-09-27
Description: The Intrusion Prevention System (IPS) feature in Cisco IOS 12.3 through 12.4 and 15.0 through 15.2, in certain configurations of enabled categories and missing signatures, allows remote attackers to cause a denial of service (device reload) via DNS packets, aka Bug ID CSCtw55976.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/50777; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-ios-ips; http://www.securityfocus.com/bid/55695
CVE: CVE-2012-4617
Published: 2012-09-27
Description: The BGP implementation in Cisco IOS 15.2, IOS XE 3.5.xS before 3.5.2S, and IOS XR 4.1.0 through 4.2.2 allows remote attackers to cause a denial of service (multiple connection resets) by leveraging a peer relationship and sending a malformed attribute, aka Bug IDs CSCtt35379, CSCty58300, CSCtz63248, and CSCtz62914.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-bgp; http://www.securityfocus.com/bid/55694; http://www.securitytracker.com/id?1027576
CVE: CVE-2012-4618
Published: 2012-09-27
Description: The SIP ALG feature in the NAT implementation in Cisco IOS 12.2, 12.4, and 15.0 through 15.2 allows remote attackers to cause a denial of service (device reload) via transit IP packets, aka Bug ID CSCtn76183.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-nat; http://www.securityfocus.com/bid/55693; http://www.securitytracker.com/id?1027579
CVE: CVE-2012-4619
Published: 2012-09-27
Description: The NAT implementation in Cisco IOS 12.2, 12.4, and 15.0 through 15.2 allows remote attackers to cause a denial of service (device reload) via transit IP packets, aka Bug ID CSCtr46123.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-nat; http://www.securityfocus.com/bid/55705; http://www.securitytracker.com/id?1027579
CVE: CVE-2012-4620
Published: 2012-09-27
Description: Cisco IOS 12.2 and 15.0 through 15.2 on Cisco 10000 series routers, when a tunnel interface exists, allows remote attackers to cause a denial of service (interface queue wedge) via tunneled (1) GRE/IP, (2) IPIP, or (3) IPv6 in IPv4 packets, aka Bug ID CSCts66808.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-c10k-tunnels; http://www.securityfocus.com/bid/55696; http://www.securitytracker.com/id?1027578
CVE: CVE-2012-4621
Published: 2012-09-27
Description: The Device Sensor feature in Cisco IOS 15.0 through 15.2 allows remote attackers to cause a denial of service (device reload) via a DHCP packet, aka Bug ID CSCty96049.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-dhcp; http://www.securitytracker.com/id?1027572; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-dhcp
CVE: CVE-2012-4622
Published: 2012-09-27
Description: Cisco IOS XE 03.02.00.XO.15.0(2)XO on Catalyst 4500E series switches, when a Supervisor Engine 7L-E card is installed, allows remote attackers to cause a denial of service (card reload) via malformed packets that trigger uncorrected ECC error messages, aka Bug ID CSCty88456.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://osvdb.org/85821; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-ecc; http://www.securityfocus.com/bid/55701
CVE: CVE-2012-4623
Published: 2012-09-27
Description: The DHCPv6 server in Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x, 3.1.xS before 3.1.4S, 3.1.xSG and 3.2.xSG before 3.2.5SG, 3.2.xS, 3.2.xXO, 3.3.xS, and 3.3.xSG before 3.3.1SG allows remote attackers to cause a denial of service (device reload) via a malformed DHCPv6 packet, aka Bug ID CSCto57723.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/85810; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-dhcpv6; http://www.securityfocus.com/bid/55700
CVE: CVE-2012-0417
Published: 2012-09-28
Description: Integer overflow in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://download.novell.com/Download?buildid=O5hTjIiMdMo~; http://www.novell.com/support/kb/doc.php?id=7010770; http://www.securitytracker.com/id?1027599
CVE: CVE-2012-0418
Published: 2012-09-28
Description: Unspecified vulnerability in the client in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 9.3 (HIGH)
References: http://download.novell.com/Download?buildid=O5hTjIiMdMo~; http://www.novell.com/support/kb/doc.php?id=7010771; http://www.securityfocus.com/bid/55729
CVE: CVE-2012-0419
Published: 2012-09-28
Description: Directory traversal vulnerability in the agent HTTP interfaces in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to read arbitrary files via directory traversal sequences in a request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-09/0106.html; http://download.novell.com/Download?buildid=O5hTjIiMdMo~; http://seclists.org/fulldisclosure/2012/Sep/161
CVE: CVE-2012-2998
Published: 2012-09-28
Description: SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager (TMCM) before 5.5.0.1823 and 6.0 before 6.0.0.1449 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://esupport.trendmicro.com/solution/en-us/1061043.aspx; http://jvn.jp/en/jp/JVN42014489/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000090