deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-5193
Published: 2012-09-23
Description: Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enabled, allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php, a different vulnerability than CVE-2011-5194.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/47428; http://secunia.com/advisories/47428
CVE: CVE-2011-5194
Published: 2012-09-23
Description: Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the domain parameter, a different vulnerability than CVE-2011-5193.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/108271/wpwhois-xss.txt; http://plugins.trac.wordpress.org/changeset/482954/wordpress-whois-search; http://secunia.com/advisories/47428
CVE: CVE-2011-5195
Published: 2012-09-23
Description: Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Conference Systems 2.3.4 and earlier allows remote attackers to hijack the authentication of administrators for requests that upload a PHP file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/77995; http://secunia.com/advisories/47330; http://www.exploit-db.com/exploits/18266
CVE: CVE-2011-5196
Published: 2012-09-23
Description: Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Journal Systems 2.3.6 and earlier allows remote attackers to hijack the authentication of administrators for requests that upload PHP files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/77995; http://secunia.com/advisories/47330; http://www.exploit-db.com/exploits/18266
CVE: CVE-2011-5197
Published: 2012-09-23
Description: Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Harvester Systems 2.3.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that upload PHP files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.exploit-db.com/exploits/18266; http://www.exploit-db.com/exploits/18266
CVE: CVE-2011-5198
Published: 2012-09-23
Description: SQL injection vulnerability in search.php in Neturf eCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the SearchFor parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/78068; http://packetstormsecurity.org/files/view/108231/neturf-xss.txt; http://secunia.com/advisories/47354
CVE: CVE-2011-5199
Published: 2012-09-23
Description: Cross-site scripting (XSS) vulnerability in sign.php in tinyguestbook allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0009.html; http://code.google.com/p/tinyguestbook/issues/detail?id=1; http://secunia.com/advisories/47419
CVE: CVE-2011-5200
Published: 2012-09-23
Description: Multiple SQL injection vulnerabilities in DeDeCMS, possibly 5.6, allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) list.php, (2) members.php, or (3) book.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18292; http://www.osvdb.org/82506; http://www.osvdb.org/82507
CVE: CVE-2011-5201
Published: 2012-09-23
Description: Multiple SQL injection vulnerabilities in sign.php in tinyguestbook allow remote attackers to execute arbitrary SQL commands via the (1) name and (2) msg parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0015.html; http://code.google.com/p/tinyguestbook/issues/detail?id=3; http://secunia.com/advisories/47419
CVE: CVE-2012-5098
Published: 2012-09-23
Description: Multiple SQL injection vulnerabilities in Php-X-Links, possibly 1.0, allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to rate.php, (2) cid parameter to view.php, or (3) t parameter to pop.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18298; http://www.securityfocus.com/bid/51223; https://exchange.xforce.ibmcloud.com/vulnerabilities/72066
CVE: CVE-2012-5099
Published: 2012-09-23
Description: Cross-site scripting (XSS) vulnerability in list.php in PHPB2B 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/108280/phpb2b-xss.txt; http://www.securityfocus.com/bid/51221; https://exchange.xforce.ibmcloud.com/vulnerabilities/72082
CVE: CVE-2012-5100
Published: 2012-09-23
Description: Directory traversal vulnerability in HServer 0.1.1 allows remote attackers to read arbitrary files via a (1) ..%5c (dot dot encoded backslash) or (2) %2e%2e%5c (encoded dot dot backslash) in the PATH_INFO.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0028.html; http://www.securityfocus.com/bid/51286; https://exchange.xforce.ibmcloud.com/vulnerabilities/72138
CVE: CVE-2012-5101
Published: 2012-09-23
Description: SQL injection vulnerability in the JExtensions JE Poll component before 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://joomlaextensions.co.in/product/JE-Poll; http://osvdb.org/78094; http://secunia.com/advisories/47436
CVE: CVE-2012-5102
Published: 2012-09-23
Description: Cross-site scripting (XSS) vulnerability in inc/extensions.php in VertrigoServ 2.25 allows remote attackers to inject arbitrary web script or HTML via the ext parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0034.html; http://secunia.com/advisories/47469; http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-11.txt
CVE: CVE-2012-5103
Published: 2012-09-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in action/add-submit.php in Ggb Guestbook 0.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url or (2) message parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0032.html; http://code.google.com/p/ggbook/issues/detail?id=17; http://packetstormsecurity.org/files/108389/ggbguestbook-xss.txt
CVE: CVE-2012-5104
Published: 2012-09-23
Description: Cross-site scripting (XSS) vulnerability in forums/ubbthreads.php in UBB.threads 7.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the Loginname parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/108353/ubbforum-xss.txt; http://secunia.com/advisories/47452; http://st2tea.blogspot.com/2012/01/ubb-forum756-cross-site-scripting.html
CVE: CVE-2012-5105
Published: 2012-09-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in SQLiteManager 1.2.4 allow remote attackers to inject arbitrary web script or HTML via the dbsel parameter to (1) main.php or (2) index.php; or (3) nsextt parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0035.html; http://secunia.com/advisories/28642; http://www.osvdb.org/78137
CVE: CVE-2012-3451
Published: 2012-09-24
Description: Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://cxf.apache.org/cve-2012-3451.html; http://rhn.redhat.com/errata/RHSA-2012-1591.html; http://rhn.redhat.com/errata/RHSA-2012-1592.html
CVE: CVE-2012-4655
Published: 2012-09-24
Description: The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug IDs CSCtz76128 and CSCtz78204.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/50669; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac; http://www.securityfocus.com/bid/55606
CVE: CVE-2012-5054
Published: 2012-09-24
Description: Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: http://packetstormsecurity.org/files/116435/Adobe-Flash-Player-Matrix3D-Integer-Overflow-Code-Execution.html; http://www.adobe.com/support/security/bulletins/apsb12-19.html; http://www.vupen.com/english/services/ba-index.php
CVE: CVE-2012-2287
Published: 2012-09-25
Description: The authentication functionality in EMC RSA Authentication Agent 7.1 and RSA Authentication Client 3.5 on Windows XP and Windows Server 2003, when an unspecified configuration exists, allows remote authenticated users to bypass an intended token-authentication step, and establish a login session to a remote host, by leveraging Windows credentials for that host.
CVSS Score: 8.5 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2012-09/0102.html; http://www.securityfocus.com/bid/55662; https://exchange.xforce.ibmcloud.com/vulnerabilities/78802
CVE: CVE-2012-3011
Published: 2012-09-25
Description: Directory traversal vulnerability in the web server in Fultek WinTr Scada 4.0.5 and earlier allows remote attackers to read arbitrary files via a crafted request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/50668; http://www.us-cert.gov/control_systems/pdf/ICSA-12-262-01.pdf; http://secunia.com/advisories/50668
CVE: CVE-2012-3037
Published: 2012-09-25
Description: The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof the S7-1200 web server by using this key to create a forged certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-295
References: http://en.securitylab.ru/lab/PT-2012-48; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-240718.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-263-01.pdf
CVE: CVE-2012-3259
Published: 2012-09-25
Description: Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1461.
CVSS Score: 10.0 (HIGH)
References: http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03489683; https://exchange.xforce.ibmcloud.com/vulnerabilities/78877; http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03489683
CVE: CVE-2012-3260
Published: 2012-09-25
Description: Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1462.
CVSS Score: 10.0 (HIGH)
References: http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03489683; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8877&w=2; http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03489683
CVE: CVE-2012-3261
Published: 2012-09-25
Description: Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1463.
CVSS Score: 10.0 (HIGH)
References: http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03489683; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8877&w=2; http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03489683
CVE: CVE-2012-3262
Published: 2012-09-25
Description: Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1464.
CVSS Score: 10.0 (HIGH)
References: http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03489683; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8877&w=2; http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03489683
CVE: CVE-2012-3263
Published: 2012-09-25
Description: Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1465.
CVSS Score: 10.0 (HIGH)
References: http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03489683; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8877&w=2; http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03489683
CVE: CVE-2012-3264
Published: 2012-09-25
Description: Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1472.
CVSS Score: 7.5 (HIGH)
References: http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03489683; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8877&w=2; http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03489683
CVE: CVE-2012-4014
Published: 2012-09-25
Description: Unspecified vulnerability in McAfee Email Anti-virus (formerly WebShield SMTP) allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://jvn.jp/en/jp/JVN50701493/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000086; http://jvn.jp/en/jp/JVN50701493/index.html
CVE: CVE-2012-4015
Published: 2012-09-25
Description: Cross-site scripting (XSS) vulnerability in the management screen in myLittleTools myLittleAdmin for SQL Server 2000 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted database entry.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN56373673/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000087; http://jvn.jp/en/jp/JVN56373673/index.html
CVE: CVE-2012-2187
Published: 2012-09-25
Description: IBM Remote Supervisor Adapter II firmware for System x3650, x3850 M2, and x3950 M2 1.13 and earlier generates weak RSA keys, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_weak_key_vulnerability_in_remote_supervisor_adapter_ii_firmware_cve_2012_2187_ibm_system_x3650_system_x3850_m2_system_x3950_m25; http://www.securityfocus.com/bid/55609; https://www-947.ibm.com/support/entry/myportal/docdisplay?lndocid=MIGR-5091525
CVE: CVE-2012-2199
Published: 2012-09-25
Description: The server message channel agent in the queue manager in the server in IBM WebSphere MQ 7.0.1 before 7.0.1.9, 7.1, and 7.5 on Solaris allows remote attackers to cause a denial of service (invalid address alignment exception and daemon crash) via vectors involving a multiplexed channel.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC82725; http://www.ibm.com/support/docview.wss?uid=swg21610285; https://exchange.xforce.ibmcloud.com/vulnerabilities/76434
CVE: CVE-2012-3298
Published: 2012-09-25
Description: Unspecified vulnerability in the REST services framework in IBM WebSphere Commerce 7.0 Feature Pack 4 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR42770; http://www.ibm.com/support/docview.wss?uid=swg21610905; https://exchange.xforce.ibmcloud.com/vulnerabilities/77294
CVE: CVE-2012-3300
Published: 2012-09-25
Description: IBM WebSphere Commerce 7.0 before 7.0.0.6, when persistent sessions and personalization IDs are enabled, allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.
CVSS Score: 2.6 (LOW)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR42771; http://www.ibm.com/support/docview.wss?uid=swg21610909; https://exchange.xforce.ibmcloud.com/vulnerabilities/77382
CVE: CVE-2012-3304
Published: 2012-09-25
Description: The Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack sessions via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/85733; http://www-01.ibm.com/support/docview.wss?uid=swg1PM54356; http://www.ibm.com/support/docview.wss?uid=swg21611313
CVE: CVE-2012-3305
Published: 2012-09-25
Description: Directory traversal vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to overwrite arbitrary files via a crafted application file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM62467; http://www.ibm.com/support/docview.wss?uid=swg21611313; https://exchange.xforce.ibmcloud.com/vulnerabilities/77477
CVE: CVE-2012-3306
Published: 2012-09-25
Description: IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, when multi-domain support is configured, does not purge password data from the authentication cache, which has unspecified impact and remote attack vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM66514; http://www.ibm.com/support/docview.wss?uid=swg21611313; https://exchange.xforce.ibmcloud.com/vulnerabilities/77478
CVE: CVE-2012-3311
Published: 2012-09-25
Description: IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 on z/OS, in certain configurations involving Federated Repositories for IIOP connections and Optimized Local Adapters, does not perform CBIND checks, which allows local users to bypass intended access restrictions, and read or modify application data, via unspecified vectors.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM61388; http://www.ibm.com/support/docview.wss?uid=swg21611313; http://www.securityfocus.com/bid/55671
CVE: CVE-2012-3324
Published: 2012-09-25
Description: Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows remote authenticated users to modify, delete, or read arbitrary files via a pathname in the file field.
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC85513; http://www-01.ibm.com/support/docview.wss?uid=swg21611040; https://exchange.xforce.ibmcloud.com/vulnerabilities/77924
CVE: CVE-2012-3334
Published: 2012-09-25
Description: Stack-based buffer overflow in IBM Informix Dynamic Server (IDS) 11.50 before 11.50.xC9W2 and 11.70 before 11.70.xC5 allows remote authenticated users to execute arbitrary code via crafted arguments in a SET COLLATION statement.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/85736; http://www.ibm.com/support/docview.wss?uid=swg21611800; http://www.securityfocus.com/bid/55668
CVE: CVE-2012-0209
Published: 2012-09-25
Description: Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in templates/javascript/open_calendar.js, which allows remote attackers to execute arbitrary PHP code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://dev.horde.org/h/jonah/stories/view.php?channel_id=1&id=155; http://eromang.zataz.com/2012/02/15/cve-2012-0209-horde-backdoor-analysis/; http://lists.horde.org/archives/announce/2012/000751.html
CVE: CVE-2012-5159
Published: 2012-09-25
Description: phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which allows remote attackers to execute arbitrary PHP code via an eval injection attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://seclists.org/oss-sec/2012/q3/562; http://sourceforge.net/blog/phpmyadmin-back-door/; http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php
CVE: CVE-2011-4623
Published: 2012-09-25
Description: Integer overflow in the rsCStrExtendBuf function in runtime/stringbuf.c in the imfile module in rsyslog 4.x before 4.6.6, 5.x before 5.7.4, and 6.x before 6.1.4 allows local users to cause a denial of service (daemon hang) via a large file, which triggers a heap-based buffer overflow.
CVSS Score: 2.1 (LOW)
CWE: CWE-189
References: http://bugzilla.adiscon.com/show_bug.cgi?id=221; http://git.adiscon.com/?p=rsyslog.git%3Ba=commit%3Bh=6bad782f154b7f838c7371bf99c13f6dc4ec4101; http://rsyslog.com/changelog-for-4-6-6-v4-stable/
CVE: CVE-2012-0869
Published: 2012-09-25
Description: Cross-site scripting (XSS) vulnerability in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20120215 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0109.html; http://archives.neohapsis.com/archives/bugtraq/2012-02/0112.html; http://fex.rus.uni-stuttgart.de/fex.html
CVE: CVE-2012-0973
Published: 2012-09-25
Description: Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the (1) osc_search_category_id function in oc-includes/osclass/helpers/hSearch.php and (2) findBySlug function oc-includes/osclass/model/Category.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0157.html; http://osclass.org/2012/01/16/osclass-2-3-5/; http://secunia.com/advisories/47697
CVE: CVE-2012-0974
Published: 2012-09-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) sCity, (2) sPattern, (3) sPriceMax, and (4) sPriceMin parameters in a search action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0157.html; http://osclass.org/2012/01/16/osclass-2-3-5/; http://secunia.com/advisories/47697
CVE: CVE-2012-1103
Published: 2012-09-25
Description: emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://git.notmuchmail.org/git/notmuch/blobdiff/3f2050ac221a4c940c12442f156f12fff11600c6..ae438ccd8c77831158c7c30f19710d798ee4a6b4:/emacs/notmuch-mua.el; http://notmuchmail.org/news/release-0.11.1/; http://secunia.com/advisories/48139