deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-3999
Published: 2012-07-12
Description: Cross-site scripting (XSS) vulnerability in admin/login.php in Sticky Notes 0.3.09062012.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/77138; https://gitorious.org/sticky-notes/sticky-notes/merge_requests/2; https://exchange.xforce.ibmcloud.com/vulnerabilities/77138
CVE: CVE-2012-4000
Published: 2012-07-12
Description: Cross-site scripting (XSS) vulnerability in the print_textinputs_var function in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor 2.6.7 and earlier allows remote attackers to inject arbitrary web script or HTML via textinputs array parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://disse.cting.org/blog/2012/06/22/fckeditor-reflected-xss-vulnerability/; http://secunia.com/advisories/49606; http://www.debian.org/security/2012/dsa-2522
CVE: CVE-2012-2812
Published: 2012-07-13
Description: The exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-1255.html
CVE: CVE-2012-2813
Published: 2012-07-13
Description: The exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-1255.html; http://secunia.com/advisories/49988
CVE: CVE-2012-2814
Published: 2012-07-13
Description: Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-1255.html
CVE: CVE-2012-2836
Published: 2012-07-13
Description: The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-1255.html
CVE: CVE-2012-2837
Published: 2012-07-13
Description: The mnote_olympus_entry_get_value function in olympus/mnote-olympus-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (divide-by-zero error) via an image with crafted EXIF tags that are not properly handled during the formatting of EXIF maker note tags.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-1255.html
CVE: CVE-2012-2840
Published: 2012-07-13
Description: Off-by-one error in the exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-1255.html; http://secunia.com/advisories/49988
CVE: CVE-2012-2841
Published: 2012-07-13
Description: Integer underflow in the exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 might allow remote attackers to execute arbitrary code via vectors involving a crafted buffer-size parameter during the formatting of an EXIF tag, leading to a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-1255.html
CVE: CVE-2012-2845
Published: 2012-07-13
Description: Integer overflow in the jpeg_data_load_data function in jpeg-data.c in libjpeg in exif 0.6.20 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain potentially sensitive information via a crafted JPEG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/49988; http://sourceforge.net/mailarchive/message.php?msg_id=29534027; http://www.mandriva.com/security/advisories?name=MDVSA-2012:107
CVE: CVE-2012-0283
Published: 2012-07-13
Description: Cross-site scripting (XSS) vulnerability in the tpl_mediaFileList function in inc/template.php in DokuWiki before 2012-01-25b allows remote attackers to inject arbitrary web script or HTML via the ns parameter in a medialist action to lib/exe/ajax.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.dokuwiki.org/index.php?do=details&task_id=2561; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090755.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090899.html
CVE: CVE-2012-2278
Published: 2012-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in the (1) Self-Service Console and (2) Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-07/0064.html; http://archives.neohapsis.com/archives/bugtraq/2012-07/0064.html
CVE: CVE-2012-2279
Published: 2012-07-13
Description: Open redirect vulnerability in the Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2012-07/0064.html; http://archives.neohapsis.com/archives/bugtraq/2012-07/0064.html
CVE: CVE-2012-2280
Published: 2012-07-13
Description: EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 do not properly use frames, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "Cross frame scripting vulnerability."
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2012-07/0064.html; http://archives.neohapsis.com/archives/bugtraq/2012-07/0064.html
CVE: CVE-2011-4133
Published: 2012-07-16
Description: Cross-site request forgery (CSRF) vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=8f031d5431c1204197b1482fd6c63bc87a19a476; http://moodle.org/mod/forum/discuss.php?d=170002; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4278
Published: 2012-07-16
Description: Cross-site scripting (XSS) vulnerability in the tag autocomplete functionality in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=fd29b2ad1c20906da00d7e523f39bc8a0358a65b; http://moodle.org/mod/forum/discuss.php?d=170003; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4279
Published: 2012-07-16
Description: Moodle 2.0.x before 2.0.2 does not use the forceloginforprofiles setting for course-profiles access control, which makes it easier for remote attackers to obtain potentially sensitive information via vectors involving use of a search engine, as demonstrated by the search functionality of Google, Yahoo!, Wrensoft Zoom, MSN, Yandex, and AltaVista.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=81b58cc227cf96a1cd2e002cc210b7b3e376fd17; http://moodle.org/mod/forum/discuss.php?d=170004; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4280
Published: 2012-07-16
Description: Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=bd654f0ced8af925c27b7c94321f0c299b50b38e; http://moodle.org/mod/forum/discuss.php?d=170005; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4281
Published: 2012-07-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication of arbitrary users for requests that mark the completion of (1) an activity or (2) a course.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=9cedb80c5d6318aa17cd66912d37e6ef3dca9455; http://moodle.org/mod/forum/discuss.php?d=170006; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4282
Published: 2012-07-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the course-tags functionality in tag/coursetags_more.php in Moodle 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) sort or (2) show parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=73de6fa06f[PII_REDACTED]a445bd69b3fbc1e518d2; http://moodle.org/mod/forum/discuss.php?d=170008; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4283
Published: 2012-07-16
Description: Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 places an IMS enterprise enrolment file in the course-files area, which allows remote attackers to obtain sensitive information via a request for imsenterprise-enrol.xml.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=6fde0dac702b3d0954bd1c34d427944e9cd89ae6; http://moodle.org/mod/forum/discuss.php?d=170009; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4284
Published: 2012-07-16
Description: Moodle 2.0.x before 2.0.2 allows remote attackers to obtain sensitive information from a myprofile (aka My profile) block by visiting a user-context page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=0ab727fb35e5ae1d8316d96c6752ee9ebec4c185; http://moodle.org/mod/forum/discuss.php?d=170010; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4285
Published: 2012-07-16
Description: The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote authenticated users to delete arbitrary courses by leveraging the teacher role.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=5cfe8aecb8b78e343ded38ba9e7a0a859887d21c; http://moodle.org/mod/forum/discuss.php?d=170011; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4286
Published: 2012-07-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the media-filter implementation in filter/mediaplugin/filter.php in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) Flash Video (aka FLV) files and (2) YouTube videos.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=8f81bfd412c6b2e93a5b15711727d5cb7cc78336; http://moodle.org/mod/forum/discuss.php?d=170012; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4287
Published: 2012-07-16
Description: admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=22a77963439e[PII_REDACTED]0f0517135b3a5418da; http://moodle.org/mod/forum/discuss.php?d=175588; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4288
Published: 2012-07-16
Description: Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=79c6e3a0968ee1fedcf8a1f14f8086fcd9dbd3f6; http://moodle.org/mod/forum/discuss.php?d=175590; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4289
Published: 2012-07-16
Description: Moodle 2.0.x before 2.0.3 does not recognize the configuration setting that makes e-mail addresses visible only to course members, which allows remote authenticated users to obtain sensitive address information by reading a full profile page.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=181991e791a13a3c383234718c26c499e31d3df1; http://moodle.org/mod/forum/discuss.php?d=175591; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4290
Published: 2012-07-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in lib/weblib.php in Moodle 1.9.x before 1.9.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to URL encoding.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=5a3010310bff0b3946804a72ca2d6bc166a0028f; http://moodle.org/mod/forum/discuss.php?d=175592; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4291
Published: 2012-07-16
Description: Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service (invalid database records) via a series of crafted ratings operations.
CVSS Score: 4.0 (MEDIUM)
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=34b5e856b0c98aab3f[PII_REDACTED]628df0834957; http://moodle.org/mod/forum/discuss.php?d=175593; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4292
Published: 2012-07-16
Description: Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service (invalid database records) via a series of crafted comments operations.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-89
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=acb4688d29a7cc028803ee3d81edc7f1b6515c64; http://moodle.org/mod/forum/discuss.php?d=175594; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4293
Published: 2012-07-16
Description: The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets (CSS) and JavaScript content, which allows remote attackers to bypass intended access restrictions and write to an operating-system temporary directory via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e1c2a211f259821910be2cba23679d4176fb00a3; http://moodle.org/mod/forum/discuss.php?d=182736; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4294
Published: 2012-07-16
Description: The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=8f9f666c902cb30ef6f519353f38c45a29fdf4a6; http://moodle.org/mod/forum/discuss.php?d=182737; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4295
Published: 2012-07-16
Description: The moodle_enrol_external:role_assign function in enrol/externallib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not have an authorization check, which allows remote authenticated users to gain privileges by making a role assignment.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=d20f655d59cd486fd9b3a26ad353af13daafd1d3; http://moodle.org/mod/forum/discuss.php?d=182738; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4296
Published: 2012-07-16
Description: lib/db/access.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 assigns incorrect capabilities to the course-creator role, which allows remote authenticated users to modify course filters by leveraging this role.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=88d823c1f491a3c74f67bbf74306a8d1109dee02; http://moodle.org/mod/forum/discuss.php?d=182739; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2011-4297
Published: 2012-07-16
Description: comment/lib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not properly restrict comment capabilities, which allows remote attackers to post a comment by leveraging the guest role and operating on a front-page activity.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=9da3c2efadcc5f56cb8adc19c67ed16be35780f3; http://moodle.org/mod/forum/discuss.php?d=182740; http://openwall.com/lists/oss-security/2011/11/14/1
CVE: CVE-2012-2021
Published: 2012-07-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in HP AssetManager 5.20, 5.21, 5.22, and 9.30 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03403333; http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03403333
CVE: CVE-2012-2607
Published: 2012-07-16
Description: The Johnson Controls CK721-A controller with firmware before SSM4388_03.1.0.14_BB allows remote attackers to perform arbitrary actions via crafted packets to TCP port 41014 (aka the download port).
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://www.kb.cert.org/vuls/id/977312; http://www.kb.cert.org/vuls/id/MORO-8UYN8P; http://www.kb.cert.org/vuls/id/977312
CVE: CVE-2012-2645
Published: 2012-07-16
Description: The Yahoo! Japan Yahoo! Browser application 1.2.0 and earlier for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN46088915/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000070; http://secunia.com/advisories/49905
CVE: CVE-2012-4026
Published: 2012-07-16
Description: The Johnson Controls Pegasys P2000 server with software before 3.11 allows remote attackers to trigger false alerts via crafted packets to TCP port 41013 (aka the upload port), a different vulnerability than CVE-2012-2607.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/977312; http://www.kb.cert.org/vuls/id/MORO-8UYN8P; http://www.kb.cert.org/vuls/id/977312
CVE: CVE-2012-2282
Published: 2012-07-16
Description: EMC Celerra Network Server 6.x before 6.0.61.0, VNX 7.x before 7.0.53.2, and VNXe 2.0 and 2.1 before 2.1.3.19077 (aka MR1 SP3.2) and 2.2 before 2.2.0.19078 (aka MR2 SP0.2) do not properly implement NFS access control, which allows remote authenticated users to read or modify files via a (1) NFSv2, (2) NFSv3, or (3) NFSv4 request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-07/0063.html; http://www.securitytracker.com/id?1027242; http://archives.neohapsis.com/archives/bugtraq/2012-07/0063.html
CVE: CVE-2012-4027
Published: 2012-07-16
Description: Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.washingtonpost.com/investigations/tridiums-niagara-framework-marvel-of-connectivity-illustrates-new-cyber-risks/2012/07/11/gJQARJL6dW_story.html; https://www.tridium.com/galleries/briefings/NiagaraAX_Framework_Software_Security_Alert.pdf; http://www.washingtonpost.com/investigations/tridiums-niagara-framework-marvel-of-connectivity-illustrates-new-cyber-risks/2012/07/11/gJQARJL6dW_story.html
CVE: CVE-2012-4028
Published: 2012-07-16
Description: Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restrictions by using the stored information for authentication.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: http://www.washingtonpost.com/investigations/tridiums-niagara-framework-marvel-of-connectivity-illustrates-new-cyber-risks/2012/07/11/gJQARJL6dW_story.html; https://www.tridium.com/galleries/briefings/NiagaraAX_Framework_Software_Security_Alert.pdf; http://www.washingtonpost.com/investigations/tridiums-niagara-framework-marvel-of-connectivity-illustrates-new-cyber-risks/2012/07/11/gJQARJL6dW_story.html
CVE: CVE-2012-0792
Published: 2012-07-17
Description: mod/forum/user.php in Moodle 1.9.x before 1.9.16 allows remote authenticated users to obtain the names and other details of arbitrary user accounts by searching for posts.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=36b0ddeed45d0751508dcd9fa50f17fda43bae54; http://moodle.org/mod/forum/discuss.php?d=194009; http://www.debian.org/security/2012/dsa-2421
CVE: CVE-2012-0793
Published: 2012-07-17
Description: Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote attackers to view the profile images of arbitrary user accounts via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=90911c4ff98dc2078a3acef5ddf5a1a8f7e20ba5; http://moodle.org/mod/forum/discuss.php?d=194012; http://www.debian.org/security/2012/dsa-2421
CVE: CVE-2012-0794
Published: 2012-07-17
Description: The rc4encrypt function in lib/moodlelib.php in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 uses a hardcoded password of nfgjeingjk, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by reading this script's source code within the open-source software distribution.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=98456628a24bba25d336860d38a45b5a4e3895da; http://moodle.org/mod/forum/discuss.php?d=194013; http://www.debian.org/security/2012/dsa-2421