deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-3499
Published: 2012-08-22
Description: F-Secure Anti-Virus does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection approach that occurs too late to stop the code execution.  NOTE: the researcher indicates that a vendor response was received, stating that "the inability to catch these files are caused by lacking functionality rather than programming errors."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www.n00bz.net/antivirus-cve; http://www.securityfocus.com/archive/1/514356; http://www.n00bz.net/antivirus-cve
CVE: CVE-2010-5143
Published: 2012-08-22
Description: McAfee VirusScan Enterprise before 8.8 allows local users to disable the product by leveraging administrative privileges to execute an unspecified Metasploit Framework module.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10014; https://kc.mcafee.com/corporate/index?page=content&id=SB10014
CVE: CVE-2011-5100
Published: 2012-08-22
Description: The web interface in McAfee Firewall Reporter before 5.1.0.13 does not properly implement cookie authentication, which allows remote attackers to obtain access, and disable anti-virus functionality, via an HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10015; https://kc.mcafee.com/corporate/index?page=content&id=SB10015
CVE: CVE-2011-5101
Published: 2012-08-22
Description: The Rumor technology in McAfee SaaS Endpoint Protection before 5.2.4 allows remote attackers to relay e-mail messages via unspecified vectors, as demonstrated by relaying spam.
CVSS Score: 5.0 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/78274; https://kc.mcafee.com/corporate/index?page=content&id=SB10018; https://exchange.xforce.ibmcloud.com/vulnerabilities/78274
CVE: CVE-2012-0681
Published: 2012-08-22
Description: Apple Remote Desktop before 3.6.1 does not recognize the "Encrypt all network data" setting during connections to third-party VNC servers, which allows remote attackers to obtain cleartext VNC session content by sniffing the network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.apple.com/archives/security-announce/2012/Aug/msg00000.html; http://support.apple.com/kb/HT5433; http://www.securityfocus.com/bid/55100
CVE: CVE-2012-2864
Published: 2012-08-22
Description: Mesa, as used in Google Chrome before 21.0.1183.0 on the Acer AC700, Cr-48, and Samsung Series 5 and 5 550 Chromebook platforms, and the Samsung Chromebox Series 3, allows remote attackers to execute arbitrary code via unspecified vectors that trigger an "array overflow."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=141901; http://googlechromereleases.blogspot.com/2012/08/stable-channel-update-for-chrome-os.html; http://secunia.com/advisories/51215
CVE: CVE-2012-4580
Published: 2012-08-22
Description: Cross-site scripting (XSS) vulnerability in McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote attackers to inject arbitrary web script or HTML via vectors related to the McAfee Security Appliance Management Console/Dashboard.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10020; https://kc.mcafee.com/corporate/index?page=content&id=SB10020
CVE: CVE-2012-4581
Published: 2012-08-22
Description: McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers to hijack sessions by capturing a session cookie and then modifying the response to a login attempt, related to a "Logout Failure" issue.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10020; https://kc.mcafee.com/corporate/index?page=content&id=SB10020
CVE: CVE-2012-4582
Published: 2012-08-22
Description: McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to reset the passwords of arbitrary administrative accounts via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0160.html; https://kc.mcafee.com/corporate/index?page=content&id=SB10020; http://archives.neohapsis.com/archives/bugtraq/2012-03/0160.html
CVE: CVE-2012-4583
Published: 2012-08-22
Description: McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to obtain the session tokens of arbitrary users by navigating within the Dashboard.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0161.html; https://kc.mcafee.com/corporate/index?page=content&id=SB10020; http://archives.neohapsis.com/archives/bugtraq/2012-03/0161.html
CVE: CVE-2012-4584
Published: 2012-08-22
Description: McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, does not properly encrypt system-backup data, which makes it easier for remote authenticated users to obtain sensitive information by reading a backup file, as demonstrated by obtaining password hashes.
CVSS Score: 3.5 (LOW)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0162.html; https://kc.mcafee.com/corporate/index?page=content&id=SB10020; http://archives.neohapsis.com/archives/bugtraq/2012-03/0162.html
CVE: CVE-2012-4585
Published: 2012-08-22
Description: McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to read arbitrary files via a crafted URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0163.html; https://kc.mcafee.com/corporate/index?page=content&id=SB10020; http://archives.neohapsis.com/archives/bugtraq/2012-03/0163.html
CVE: CVE-2012-4586
Published: 2012-08-22
Description: McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, accesses files with the privileges of the root user, which allows remote authenticated users to bypass intended permission settings by requesting a file.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10020; https://kc.mcafee.com/corporate/index?page=content&id=SB10020
CVE: CVE-2012-4587
Published: 2012-08-22
Description: McAfee Enterprise Mobility Manager (EMM) Agent before 4.8 and Server before 10.1, when one-time provisioning (OTP) mode is enabled, have an improper dependency on DNS SRV records, which makes it easier for remote attackers to discover user passwords by spoofing the EMM server, as demonstrated by a password entered on an iOS device.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/78130; https://kc.mcafee.com/corporate/index?page=content&id=SB10021; https://exchange.xforce.ibmcloud.com/vulnerabilities/78130
CVE: CVE-2012-4588
Published: 2012-08-22
Description: McAfee Enterprise Mobility Manager (EMM) Agent before 4.8 and Server before 10.1 record all invalid usernames presented in failed login attempts, and place them on a list of accounts that an administrator may wish to unlock, which allows remote attackers to cause a denial of service (excessive list size in the EMM Database) via a long sequence of login attempts with different usernames.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10021; https://kc.mcafee.com/corporate/index?page=content&id=SB10021
CVE: CVE-2012-4589
Published: 2012-08-22
Description: Login.aspx in the Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 does not have an off autocomplete attribute for unspecified form fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
CVSS Score: 2.1 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/78223; https://kc.mcafee.com/corporate/index?page=content&id=SB10022; https://exchange.xforce.ibmcloud.com/vulnerabilities/78223
CVE: CVE-2012-4590
Published: 2012-08-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in About.aspx in the Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 might allow remote attackers to inject arbitrary web script or HTML via the (1) User Agent or (2) Connection variable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/78222; https://kc.mcafee.com/corporate/index?page=content&id=SB10022; https://exchange.xforce.ibmcloud.com/vulnerabilities/78222
CVE: CVE-2012-4591
Published: 2012-08-22
Description: About.aspx in the Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 discloses the name of the user account for an IIS worker process, which allows remote attackers to obtain potentially sensitive information by visiting this page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/78221; https://kc.mcafee.com/corporate/index?page=content&id=SB10022; https://exchange.xforce.ibmcloud.com/vulnerabilities/78221
CVE: CVE-2012-4592
Published: 2012-08-22
Description: The Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 does not set the secure flag for the ASP.NET session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 5.0 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/78220; https://kc.mcafee.com/corporate/index?page=content&id=SB10022; https://exchange.xforce.ibmcloud.com/vulnerabilities/78220
CVE: CVE-2012-4593
Published: 2012-08-22
Description: McAfee Application Control and Change Control 5.1.x and 6.0.0 do not enforce an intended password requirement in certain situations involving attributes of the password file, which allows local users to bypass authentication by executing a command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10023; https://kc.mcafee.com/corporate/index?page=content&id=SB10023
CVE: CVE-2012-4594
Published: 2012-08-22
Description: McAfee ePolicy Orchestrator (ePO) 4.6.1 and earlier allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information from arbitrary reporting panels, via a modified ID value in a console URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/78132; https://kc.mcafee.com/corporate/index?page=content&id=SB10025; https://exchange.xforce.ibmcloud.com/vulnerabilities/78132
CVE: CVE-2012-4595
Published: 2012-08-22
Description: McAfee Email and Web Security (EWS) 5.5 through Patch 6 and 5.6 through Patch 3, and McAfee Email Gateway (MEG) 7.0.0 and 7.0.1, allows remote attackers to bypass authentication and obtain an admin session ID via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securitytracker.com/id?1027444; https://exchange.xforce.ibmcloud.com/vulnerabilities/77977; https://kc.mcafee.com/corporate/index?page=content&id=SB10026
CVE: CVE-2012-4596
Published: 2012-08-22
Description: Directory traversal vulnerability in McAfee Email Gateway (MEG) 7.0.0 and 7.0.1 allows remote authenticated users to bypass intended access restrictions and download arbitrary files via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.securitytracker.com/id?1027444; https://kc.mcafee.com/corporate/index?page=content&id=SB10026; http://www.securitytracker.com/id?1027444
CVE: CVE-2012-4597
Published: 2012-08-22
Description: Cross-site scripting (XSS) vulnerability in McAfee Email and Web Security (EWS) 5.5 through Patch 6 and 5.6 through Patch 3, and McAfee Email Gateway (MEG) 7.0.0 and 7.0.1, allows remote attackers to inject arbitrary web script or HTML via vectors related to the McAfee Security Appliance Management Console/Dashboard.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id?1027444; https://exchange.xforce.ibmcloud.com/vulnerabilities/77979; https://kc.mcafee.com/corporate/index?page=content&id=SB10026
CVE: CVE-2012-4598
Published: 2012-08-22
Description: An unspecified ActiveX control in McAfee Virtual Technician (MVT) before 6.4, and ePO-MVT, allows remote attackers to execute arbitrary code or cause a denial of service (Internet Explorer crash) via a crafted web site.
CVSS Score: 9.3 (HIGH)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10028; https://kc.mcafee.com/corporate/index?page=content&id=SB10028
CVE: CVE-2012-4599
Published: 2012-08-22
Description: McAfee SmartFilter Administration, and SmartFilter Administration Bess Edition, before 4.2.1.01 does not require authentication for access to the JBoss Remote Method Invocation (RMI) interface, which allows remote attackers to execute arbitrary code via a crafted .war file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10029; https://kc.mcafee.com/corporate/index?page=content&id=SB10029
CVE: CVE-2012-2687
Published: 2012-08-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html
CVE: CVE-2012-3502
Published: 2012-08-22
Description: The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://mail-archives.apache.org/mod_mbox/www-announce/201208.mbox/%3C0BFFEA9B-801B-4BAA-9534-56F640268E30%40apache.org%3E; http://www.apache.org/dist/httpd/CHANGES_2.4.3
CVE: CVE-2008-7312
Published: 2012-08-23
Description: The Filtering Service in Websense Enterprise 5.2 through 6.3 does not consider the IP address during URL categorization, which makes it easier for remote attackers to bypass filtering via an HTTP request, as demonstrated by a request to a compromised server associated with a specific IP address.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.websense.com/support/article/t-kbarticle/Why-doesn-t-my-Websense-installation-categorize-URLs-and-Permit-Block-in-accordance-with-the-Site-Lookup-Tool-s-categorization; https://exchange.xforce.ibmcloud.com/vulnerabilities/78299; http://www.websense.com/support/article/t-kbarticle/Why-doesn-t-my-Websense-installation-categorize-URLs-and-Permit-Block-in-accordance-with-the-Site-Lookup-Tool-s-categorization
CVE: CVE-2009-5119
Published: 2012-08-23
Description: The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 enables weak SSL ciphers in conf/server.xml, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-16
References: http://www.websense.com/support/article/t-kbarticle/v7-Apache-Tomcat-security-vulnerabilities[PII_REDACTED]850; http://www.websense.com/support/article/t-kbarticle/v7-Apache-Tomcat-security-vulnerabilities[PII_REDACTED]850
CVE: CVE-2009-5120
Published: 2012-08-23
Description: The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 allows connections to TCP port 1812 from arbitrary source IP addresses, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 text to the 404 error page of a Project Woodstock service on this port.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-16
References: http://www.websense.com/support/article/t-kbarticle/v7-Apache-Tomcat-security-vulnerabilities[PII_REDACTED]850; http://www.websense.com/support/article/t-kbarticle/v7-Apache-Tomcat-security-vulnerabilities[PII_REDACTED]850
CVE: CVE-2009-5121
Published: 2012-08-23
Description: Websense Email Security 7.1 before Hotfix 4 allows remote attackers to bypass the sender-based blacklist by using the 8BITMIME EHLO keyword in the SMTP session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.websense.com/support/article/t-kbarticle/Hotfix-4-for-Websense-Email-Security-v7-1; http://www.websense.com/support/article/t-kbarticle/Hotfix-4-for-Websense-Email-Security-v7-1
CVE: CVE-2009-5122
Published: 2012-08-23
Description: The Personal Email Manager component in Websense Email Security before 7.2 allows remote attackers to obtain potentially sensitive information from the JBoss status page via an unspecified query.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.websense.com/content/support/library/email/v72wes/release_notes/WES72_ReleaseNotes.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/78449; http://www.websense.com/content/support/library/email/v72wes/release_notes/WES72_ReleaseNotes.pdf
CVE: CVE-2010-5144
Published: 2012-08-23
Description: The ISAPI Filter plug-in in Websense Enterprise, Websense Web Security, and Websense Web Filter 6.3.3 and earlier, when used in conjunction with a Microsoft ISA or Microsoft Forefront TMG server, allows remote attackers to bypass intended filtering and monitoring activities for web traffic via an HTTP Via header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0376.html; http://mrhinkydink.blogspot.com/2010/05/websense-633-via-bypass.html; http://www.websense.com/support/article/t-kbarticle/Web-Security-Vulnerability-Microsoft-ISA-Server-Integrations
CVE: CVE-2010-5145
Published: 2012-08-23
Description: The Filtering Service in Websense Web Security and Web Filter before 6.3.1 Hotfix 136 and 7.x before 7.1.1 on Windows allows remote attackers to cause a denial of service (filtering outage) via a crafted sequence of characters in a URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.websense.com/content/support/library/web/v711/ws711_known_issues/first.aspx; http://www.websense.com/content/support/library/web/v711/ws711_known_issues/ws711_known_issues.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/78345
CVE: CVE-2010-5146
Published: 2012-08-23
Description: The Remote Filtering component in Websense Web Security and Web Filter before 7.1 Hotfix 66 allows local users to bypass filtering by (1) renaming the WDC.exe file or (2) deleting driver files.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.websense.com/content/support/library/web/v711/ws711_known_issues/first.aspx; http://www.websense.com/content/support/library/web/v711/ws711_known_issues/ws711_known_issues.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/78344
CVE: CVE-2010-5147
Published: 2012-08-23
Description: The Remote Filtering component in Websense Web Security and Web Filter before 6.3.3 Hotfix 18 and 7.x before 7.1.1 allows remote attackers to cause a denial of service (daemon exit) via a large volume of traffic.
CVSS Score: 5.0 (MEDIUM)
References: http://www.websense.com/content/support/library/web/v711/ws711_known_issues/first.aspx; http://www.websense.com/content/support/library/web/v711/ws711_known_issues/ws711_known_issues.pdf; http://www.websense.com/content/support/library/web/v711/ws711_known_issues/first.aspx
CVE: CVE-2010-5148
Published: 2012-08-23
Description: Websense Web Security and Web Filter before 7.1 Hotfix 21 do not set the secure flag for the Encrypted Session (SSL) cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 5.0 (MEDIUM)
References: http://www.websense.com/content/support/library/web/v711/ws711_known_issues/first.aspx; http://www.websense.com/content/support/library/web/v711/ws711_known_issues/ws711_known_issues.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/78342
CVE: CVE-2010-5149
Published: 2012-08-23
Description: Websense Web Security and Web Filter before 6.3.3 Hotfix 27 and 7.x before 7.1.1 allow remote attackers to cause a denial of service (Blue Coat appliance integration outage) via a long URL.
CVSS Score: 5.0 (MEDIUM)
References: http://www.websense.com/content/support/library/web/v711/ws711_known_issues/first.aspx; http://www.websense.com/content/support/library/web/v711/ws711_known_issues/ws711_known_issues.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/78341
CVE: CVE-2011-5102
Published: 2012-08-23
Description: The Investigative Reports web interface in the TRITON management console in Websense Web Security 7.1 before Hotfix 109, 7.1.1 before Hotfix 06, 7.5 before Hotfix 78, 7.5.1 before Hotfix 12, 7.6 before Hotfix 24, and 7.6.2 before Hotfix 12; Web Filter; Web Security Gateway; and Web Security Gateway Anywhere allows remote attackers to execute commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.websense.com/support/article/kbarticle/v7-1-1-About-Hotfix-06-for-Web-Security-Web-Filter-and-Web-Security-Gateway; http://www.websense.com/support/article/kbarticle/v7-1-About-Hotfix-109-for-Websense-Web-Security-Web-Filter-and-Web-Security-Gateway; http://www.websense.com/support/article/kbarticle/v7-5-1-About-Hotfix-12-for-Websense-Web-Security-Web-Filter-Web-Security-Gateway-and-Web-Security-Gateway-Anywhere
CVE: CVE-2012-2582
Published: 2012-08-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element or (2) UTF-7 text in an HTTP-EQUIV="CONTENT-TYPE" META element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2012-09/msg00024.html; http://secunia.com/advisories/50513; http://www.debian.org/security/2012/dsa-2536
CVE: CVE-2012-4604
Published: 2012-08-23
Description: The TRITON management console in Websense Web Security before 7.6 Hotfix 24 allows remote attackers to bypass authentication and read arbitrary reports via a crafted uid field, in conjunction with a crafted userRoles field, in a cookie, as demonstrated by a request to explorer_wse/favorites.exe.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/archive/1/522530; http://www.securityfocus.com/archive/1/522530