deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2596
Published: 2012-06-08
Description: The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-94
References: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-158-01.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdf
CVE: CVE-2012-2597
Published: 2012-06-08
Description: Multiple directory traversal vulnerabilities in Siemens WinCC 7.0 SP3 before Update 2 allow remote authenticated users to read arbitrary files via a crafted parameter in a URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-158-01.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdf
CVE: CVE-2012-2598
Published: 2012-06-08
Description: Buffer overflow in the DiagAgent web server in Siemens WinCC 7.0 SP3 through Update 2 allows remote attackers to cause a denial of service (agent outage) via crafted input.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-158-01.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdf
CVE: CVE-2012-3003
Published: 2012-06-08
Description: Open redirect vulnerability in an unspecified web application in Siemens WinCC 7.0 SP3 before Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a GET request.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-158-01.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdf
CVE: CVE-2012-2034
Published: 2012-06-09
Description: Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2037.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00007.html; http://rhn.redhat.com/errata/RHSA-2012-0722.html
CVE: CVE-2012-2035
Published: 2012-06-09
Description: Stack-based buffer overflow in Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00007.html; http://rhn.redhat.com/errata/RHSA-2012-0722.html
CVE: CVE-2012-2036
Published: 2012-06-09
Description: Integer overflow in Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00007.html; http://rhn.redhat.com/errata/RHSA-2012-0722.html
CVE: CVE-2012-2037
Published: 2012-06-09
Description: Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2034.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00007.html; http://rhn.redhat.com/errata/RHSA-2012-0722.html
CVE: CVE-2012-2038
Published: 2012-06-09
Description: Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00007.html; http://rhn.redhat.com/errata/RHSA-2012-0722.html
CVE: CVE-2012-2039
Published: 2012-06-09
Description: Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00007.html; http://rhn.redhat.com/errata/RHSA-2012-0722.html
CVE: CVE-2012-2040
Published: 2012-06-09
Description: Untrusted search path vulnerability in the installer in Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows local users to gain privileges via a Trojan horse executable file in an unspecified directory.
CVSS Score: 9.3 (HIGH)
CWE: CWE-426
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00007.html; http://www.adobe.com/support/security/bulletins/apsb12-14.html
CVE: CVE-2012-2563
Published: 2012-06-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Bloxx Web Filtering before 5.0.14 allow (1) remote attackers to inject arbitrary web script or HTML via web traffic that is examined within the Bloxx Reports component, and allow (2) remote authenticated administrators to inject arbitrary web script or HTML via vectors involving administrative menu functions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/722963; http://www.kb.cert.org/vuls/id/MAPG-8R9LBY; http://www.securityfocus.com/bid/53715
CVE: CVE-2012-2564
Published: 2012-06-09
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface in Bloxx Web Filtering before 5.0.14 allow remote attackers to hijack the authentication of administrators for requests that perform administrative actions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/722963; http://www.kb.cert.org/vuls/id/MAPG-8R9LBY; http://www.securityfocus.com/bid/53715
CVE: CVE-2012-2565
Published: 2012-06-09
Description: Bloxx Web Filtering before 5.0.14 does not use a salt during calculation of a password hash, which makes it easier for context-dependent attackers to determine cleartext passwords via a rainbow-table approach.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/722963; http://www.kb.cert.org/vuls/id/MAPG-8R9LBY; http://www.securityfocus.com/bid/53715
CVE: CVE-2012-2566
Published: 2012-06-09
Description: Bloxx Web Filtering before 5.0.14 does not properly interpret X-Forwarded-For headers during access-control and logging operations for HTTPS connection attempts, which allows remote attackers to bypass intended IP address and domain restrictions, and trigger misleading log entries, via a crafted header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/722963; http://www.kb.cert.org/vuls/id/MAPG-8R9LBY; http://www.securityfocus.com/bid/53715
CVE: CVE-2012-3343
Published: 2012-06-09
Description: Cross-site request forgery (CSRF) vulnerability in Microdasys before 3.5.1-B708, as used in Bloxx Web Filtering before 5.0.14 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that trigger error pages containing XSS sequences, a different vulnerability than CVE-2012-2564.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/722963; http://www.kb.cert.org/vuls/id/MAPG-8R9LBY; http://www.kb.cert.org/vuls/id/722963
CVE: CVE-2012-1825
Published: 2012-06-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in the status program on the ForeScout CounterACT appliance with software 6.3.3.2 through 6.3.4.10 allow remote attackers to inject arbitrary web script or HTML via (1) the loginname parameter in a forgotpass action or (2) the username parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/815532; http://www.kb.cert.org/vuls/id/MAPG-8TWMEJ; http://www.kb.cert.org/vuls/id/815532
CVE: CVE-2012-2959
Published: 2012-06-11
Description: Cross-site request forgery (CSRF) vulnerability in password-manager/changePasswords.do in BMC Identity Management Suite 7.5.00.103 allows remote attackers to hijack the authentication of administrators for requests that change passwords.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/221180; http://www.kb.cert.org/vuls/id/221180
CVE: CVE-2012-0677
Published: 2012-06-12
Description: Heap-based buffer overflow in Apple iTunes before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted .m3u playlist.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Jun/msg00000.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17016; http://lists.apple.com/archives/security-announce/2012/Jun/msg00000.html
CVE: CVE-2012-0173
Published: 2012-06-12
Description: The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly process packets in memory, which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to an object that (1) was not properly initialized or (2) is deleted, aka "Remote Desktop Protocol Vulnerability," a different vulnerability than CVE-2012-0002.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-036; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15116
CVE: CVE-2012-0217
Published: 2012-06-12
Description: The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application.  NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched/; http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-003.txt.asc
CVE: CVE-2012-1523
Published: 2012-06-12
Description: Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Center Element Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15579
CVE: CVE-2012-1849
Published: 2012-06-12
Description: Untrusted search path vulnerability in Microsoft Lync 2010, 2010 Attendee, and 2010 Attendant allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .ocsmeet file, aka "Lync Insecure Library Loading Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14874
CVE: CVE-2012-1855
Published: 2012-06-12
Description: Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly handle function pointers, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka ".NET Framework Memory Access Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-038; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14717
CVE: CVE-2012-1857
Published: 2012-06-12
Description: Cross-site scripting (XSS) vulnerability in the Enterprise Portal component in Microsoft Dynamics AX 2012 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Dynamics AX Enterprise Portal XSS Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-040; http://www.us-cert.gov/cas/techalerts/TA12-164A.html
CVE: CVE-2012-1858
Published: 2012-06-12
Description: The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properly handle event attributes and script, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document, aka "HTML Sanitization Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; http://www.us-cert.gov/cas/techalerts/TA12-192A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037
CVE: CVE-2012-1864
Published: 2012-06-12
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle user-mode input passed to kernel mode for driver objects, which allows local users to gain privileges via a crafted application, aka "String Atom Class Name Handling Vulnerability," a different vulnerability than CVE-2012-1865.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-041; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15496
CVE: CVE-2012-1865
Published: 2012-06-12
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle user-mode input passed to kernel mode for driver objects, which allows local users to gain privileges via a crafted application, aka "String Atom Class Name Handling Vulnerability," a different vulnerability than CVE-2012-1864.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-041; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15649
CVE: CVE-2012-1866
Published: 2012-06-12
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle user-mode input passed to kernel mode for driver objects, which allows local users to gain privileges via a crafted application, aka "Clipboard Format Atom Name Handling Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-041; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15096
CVE: CVE-2012-1867
Published: 2012-06-12
Description: Integer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted TrueType font file that triggers incorrect memory allocation, aka "Font Resource Refcount Integer Overflow Vulnerability."
CVSS Score: 8.4 (HIGH)
CWE: CWE-399, CWE-190
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-041; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15510
CVE: CVE-2012-1868
Published: 2012-06-12
Description: Race condition in the thread-creation implementation in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3 allows local users to gain privileges via a crafted application, aka "Win32k.sys Race Condition Vulnerability."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-041; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15647
CVE: CVE-2012-1872
Published: 2012-06-12
Description: Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to inject arbitrary web script or HTML via crafted character sequences with EUC-JP encoding, aka "EUC-JP Character Encoding Vulnerability."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15629; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037
CVE: CVE-2012-1873
Published: 2012-06-12
Description: Microsoft Internet Explorer 7 through 9 does not properly create and initialize string data, which allows remote attackers to obtain sensitive information from process memory via a crafted HTML document, aka "Null Byte Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15026
CVE: CVE-2012-1874
Published: 2012-06-12
Description: Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows user-assisted remote attackers to execute arbitrary code by accessing a deleted object, aka "Developer Toolbar Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15425
CVE: CVE-2012-1875
Published: 2012-06-12
Description: Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Same ID Property Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15663
CVE: CVE-2012-1876
Published: 2012-06-12
Description: Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution Vulnerability," as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://arstechnica.com/business/news/2012/03/ie-9-on-latest-windows-gets-stomped-at-hacker-contest.ars; http://pwn2own.zerodayinitiative.com/status.html; http://twitter.com/vupen/statuses/[PII_REDACTED]8291073
CVE: CVE-2012-1877
Published: 2012-06-12
Description: Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Title Element Change Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15472
CVE: CVE-2012-1878
Published: 2012-06-12
Description: Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnBeforeDeactivate Event Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15632