deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5991
Published: 2012-12-19
Description: screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allows remote authenticated users to cause a denial of service (device reload) via a certain buttonClicked value in an internal webauth_type request, aka Bug ID CSCud50209.
CVSS Score: 6.3 (MEDIUM)
References: http://infosec42.blogspot.dk/2012/12/cisco-wlc-csrf-dos-and-persistent-xss.html; http://infosec42.blogspot.dk/2012/12/cisco-wlc-csrf-dos-and-persistent-xss.html
CVE: CVE-2012-5992
Published: 2012-12-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via screens/aaa/mgmtuser_create.html or (2) insert XSS sequences via the headline parameter to screens/base/web_auth_custom.html, aka Bug ID CSCud50283.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://infosec42.blogspot.dk/2012/12/cisco-wlc-csrf-dos-and-persistent-xss.html; http://infosec42.blogspot.dk/2012/12/cisco-wlc-csrf-dos-and-persistent-xss.html
CVE: CVE-2012-6007
Published: 2012-12-19
Description: Cross-site scripting (XSS) vulnerability in screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allows remote authenticated users to inject arbitrary web script or HTML via the headline parameter, aka Bug ID CSCud65187, a different vulnerability than CVE-2012-5992.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://infosec42.blogspot.dk/2012/12/cisco-wlc-csrf-dos-and-persistent-xss.html; http://infosec42.blogspot.dk/2012/12/cisco-wlc-csrf-dos-and-persistent-xss.html
CVE: CVE-2012-3428
Published: 2012-12-20
Description: The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource connection in opportunistic circumstances via an invalid connection attempt.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://rhn.redhat.com/errata/RHSA-2012-1591.html; http://rhn.redhat.com/errata/RHSA-2012-1592.html; http://rhn.redhat.com/errata/RHSA-2012-1594.html
CVE: CVE-2012-4839
Published: 2012-12-20
Description: The OSLC interface in the Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote attackers to conduct phishing attacks via a FRAME element.
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21620342; http://www.securitytracker.com/id?1027889; https://exchange.xforce.ibmcloud.com/vulnerabilities/79068
CVE: CVE-2012-4856
Published: 2012-12-20
Description: The Service Processor in the IBM Power 5 91##-### and 940#-### before SF240_418_382 does not ensure that firewall code is executed, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.9 (HIGH)
CWE: CWE-255
References: http://aix.software.ibm.com/aix/efixes/security/squadrons_advisory.asc; http://www.kb.cert.org/vuls/id/194604; https://exchange.xforce.ibmcloud.com/vulnerabilities/79736
CVE: CVE-2012-5469
Published: 2012-12-20
Description: The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to wp-content/plugins/portable-phpmyadmin/wp-pma-mod.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-12/0092.html; http://wordpress.org/extend/plugins/portable-phpmyadmin/changelog/; http://archives.neohapsis.com/archives/bugtraq/2012-12/0092.html
CVE: CVE-2012-5638
Published: 2012-12-20
Description: The setup_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwrite the file content or bypass intended disk-quota restrictions via standard filesystem write operations.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0691.html; https://bugzilla.redhat.com/show_bug.cgi?id=887010; http://rhn.redhat.com/errata/RHSA-2013-0691.html
CVE: CVE-2012-5643
Published: 2012-12-20
Description: Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00052.html
CVE: CVE-2012-5765
Published: 2012-12-20
Description: The Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a SQL error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM72905; http://www-01.ibm.com/support/docview.wss?uid=swg21620048; https://exchange.xforce.ibmcloud.com/vulnerabilities/80211
CVE: CVE-2012-5955
Published: 2012-12-20
Description: Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows remote attackers to execute arbitrary commands via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?&uid=swg21620945; https://exchange.xforce.ibmcloud.com/vulnerabilities/80684; http://www-01.ibm.com/support/docview.wss?&uid=swg21620945
CVE: CVE-2012-6270
Published: 2012-12-20
Description: Adobe Shockwave Player through 11.6.8.638 allows remote attackers to trigger installation of a Shockwave Player 10.4.0.025 compatibility feature via a crafted HTML document that references Shockwave content with a certain compatibility parameter, related to a "downgrading" attack.
CVSS Score: 9.3 (HIGH)
References: http://www.kb.cert.org/vuls/id/323161; http://www.kb.cert.org/vuls/id/546769; http://www.kb.cert.org/vuls/id/323161
CVE: CVE-2012-6271
Published: 2012-12-20
Description: Adobe Shockwave Player through 11.6.8.638 allows remote attackers to trigger installation of arbitrary signed Xtras via a Shockwave movie that contains an Xtra URL, as demonstrated by a URL for an outdated Xtra.
CVSS Score: 9.3 (HIGH)
References: http://www.kb.cert.org/vuls/id/323161; http://www.kb.cert.org/vuls/id/519137; http://www.kb.cert.org/vuls/id/323161
CVE: CVE-2010-2387
Published: 2012-12-21
Description: vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs.
CVSS Score: 1.9 (LOW)
CWE: CWE-255
References: http://ftp.gnome.org/pub/GNOME/sources/gdm/2.20/gdm-2.20.11.changes; http://secunia.com/advisories/40690; http://secunia.com/advisories/40780
CVE: CVE-2011-2728
Published: 2012-12-21
Description: The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.
CVSS Score: 4.3 (MEDIUM)
References: http://cpansearch.perl.org/src/FLORA/perl-5.14.2/pod/perldelta.pod; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069752.html; http://perl5.git.perl.org/perl.git/commit/1af4051e077438976a4c12a0622feaf6715bec77
CVE: CVE-2012-0841
Published: 2012-12-21
Description: libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660846; http://git.gnome.org/browse/libxml2/commit/?id=8973d58b7498fa5100a876815476b81fd1a2412a; http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html
CVE: CVE-2012-0882
Published: 2012-12-21
Description: Buffer overflow in yaSSL, as used in MySQL 5.5.20 and possibly other versions including 5.5.x before 5.5.22 and 5.1.x before 5.1.62, allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VulnDisco Pack Professional 9.17.  NOTE: as of 20120224, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.  NOTE: due to lack of details, it is not clear whether this issue is a duplicate of CVE-2012-0492 or another CVE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2012/02/24/2; https://blogs.oracle.com/sunsecurity/entry/cve_2012_0882buffer_overflow_vulnerability; https://bugzilla.redhat.com/show_bug.cgi?id=789141
CVE: CVE-2012-1699
Published: 2012-12-21
Description: The ProcSetEventMask function in difs/events.c in the xfs font server for X.Org X11R6 through X11R6.6 and XFree86 before 3.3.3 calls the SendErrToClient function with a mask value instead of a pointer, which allows local users to cause a denial of service (memory corruption and crash) or obtain potentially sensitive information from memory via a SetEventMask request that triggers an invalid pointer dereference.
CVSS Score: 3.6 (LOW)
CWE: CWE-119
References: http://invisible-island.net/ansification/ansify-xfs-cve.html; http://lists.freedesktop.org/archives/xorg-announce/2012-July/002040.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4334&w=2
CVE: CVE-2012-1712
Published: 2012-12-21
Description: Directory traversal vulnerability in the Liferay component in Oracle Sun GlassFish Web Space Server before 10.0 Update 7 Patch 2 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: https://blogs.oracle.com/sunsecurity/entry/cve_2012_1712_path_traversal; https://blogs.oracle.com/sunsecurity/entry/cve_2012_1712_path_traversal
CVE: CVE-2012-1714
Published: 2012-12-21
Description: Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: https://blogs.oracle.com/sunsecurity/entry/cve_2012_1714_tlist_6; https://blogs.oracle.com/sunsecurity/entry/cve_2012_1714_tlist_6
CVE: CVE-2012-3133
Published: 2012-12-21
Description: Buffer overflow in the DataDirect ODBC driver, as used in Oracle Hyperion Interactive Reporting 11.1.2.1 and 11.1.2.2, Essbase Server 11.1.2.1 and 11.1.2.2, Production Reporting Server 11.1.2.1 and 11.1.2.2, and Integration Services Server 11.1.2.1 and 11.1.2.2 has unknown impact and attack vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: https://blogs.oracle.com/sunsecurity/entry/cve_2012_3133_buffer_overflow; https://blogs.oracle.com/sunsecurity/entry/cve_2012_3133_buffer_overflow
CVE: CVE-2012-3482
Published: 2012-12-21
Description: Fetchmail 5.0.8 through 6.3.21, when using NTLM authentication in debug mode, allows remote NTLM servers to (1) cause a denial of service (crash and delayed delivery of inbound mail) via a crafted NTLM response that triggers an out-of-bounds read in the base64 decoder, or (2) obtain sensitive information from memory via an NTLM Type 2 message with a crafted Target Name structure, which triggers an out-of-bounds read.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-October/088836.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/088871.html; http://seclists.org/oss-sec/2012/q3/230
CVE: CVE-2012-0957
Published: 2012-12-21
Description: The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-16
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2702b1526c7278c4d65d78de209a465d4de2885e; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091110.html; http://secunia.com/advisories/51409
CVE: CVE-2012-3002
Published: 2012-12-21
Description: The web interface on (1) Foscam and (2) Wansview IP cameras allows remote attackers to bypass authentication, and perform administrative functions or read the admin password, via a direct request to an unspecified URL.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://foscam.us/forum/h264-ip-camera-web-interface-authentication-bypass-test-tool-t3252.html; http://secunia.com/advisories/50950; http://secunia.com/advisories/50966
CVE: CVE-2012-4444
Published: 2012-12-21
Description: The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments.
CVSS Score: 5.0 (MEDIUM)
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=70789d[PII_REDACTED]824628db8133de08dc78e593; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00000.html
CVE: CVE-2012-4508
Published: 2012-12-21
Description: Race condition in fs/ext4/extents.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized.
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=dee1f973ca341c266229faa5a1a5bb268bed3531; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091110.html; http://rhn.redhat.com/errata/RHSA-2012-1540.html
CVE: CVE-2012-4565
Published: 2012-12-21
Description: The tcp_illinois_info function in net/ipv4/tcp_illinois.c in the Linux kernel before 3.4.19, when the net.ipv4.tcp_congestion_control illinois setting is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) by reading TCP stats.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8f363b77ee4fbf7c3bbcf5ec2c5ca482d396d664; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091110.html; http://rhn.redhat.com/errata/RHSA-2012-1580.html
CVE: CVE-2012-4859
Published: 2012-12-21
Description: Unspecified vulnerability in IBM Tivoli Storage Manager for Space Management (aka TSM HSM) before 6.2.5.0 and 6.3.x before 6.3.1.0 allows local users to read or modify file system objects via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC87006; http://www-01.ibm.com/support/docview.wss?uid=swg21615292; https://exchange.xforce.ibmcloud.com/vulnerabilities/79843
CVE: CVE-2012-5517
Published: 2012-12-21
Description: The online_pages function in mm/memory_hotplug.c in the Linux kernel before 3.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact in opportunistic circumstances by using memory that was hot-added by an administrator.
CVSS Score: 4.0 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=08dff7b7d629807dbb1f398c68dd9cd58dd657a1; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html; http://rhn.redhat.com/errata/RHSA-2012-1580.html
CVE: CVE-2012-5954
Published: 2012-12-21
Description: Unspecified vulnerability in IBM Tivoli Storage Manager for Space Management (aka TSM HSM) before 6.2.5.0 and 6.3.x before 6.3.1.0 allows remote attackers to read or modify HSM-managed file system objects via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC86724; http://www-01.ibm.com/support/docview.wss?uid=swg21615292; http://www.securitytracker.com/id?1027901
CVE: CVE-2012-5181
Published: 2012-12-21
Description: Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and concrete5 English 5.5.0 through 5.6.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://concrete5-japan.org/news/concrete5602ja-release/; http://jvn.jp/en/jp/JVN65458431/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000113
CVE: CVE-2012-6324
Published: 2012-12-21
Description: Directory traversal vulnerability in VMware vCenter Server Appliance (vCSA) 5.0 before Update 2 and 5.1 before Patch 1 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www.vmware.com/security/advisories/VMSA-2012-0018.html; http://www.vmware.com/security/advisories/VMSA-2012-0018.html
CVE: CVE-2012-6325
Published: 2012-12-21
Description: VMware vCenter Server Appliance (vCSA) 5.0 before Update 2 does not properly parse XML documents, which allows remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.vmware.com/security/advisories/VMSA-2012-0018.html; http://www.vmware.com/security/advisories/VMSA-2012-0018.html
CVE: CVE-2012-4698
Published: 2012-12-23
Description: Siemens RuggedCom Rugged Operating System (ROS) before 3.12, ROX I OS through 1.14.5, ROX II OS through 2.3.0, and RuggedMax OS through 4.2.1.4621.22 use hardcoded private keys for SSL and SSH communication, which makes it easier for man-in-the-middle attackers to spoof servers and decrypt network traffic by leveraging the availability of these keys within ROS files at all customer installations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://ics-cert.us-cert.gov/advisories/ICSA-12-354-01A; http://www.ruggedcom.com/productbulletin/ros-security-page/; http://www.us-cert.gov/control_systems/pdf/ICSA-12-354-01.pdf
CVE: CVE-2012-6427
Published: 2012-12-23
Description: The Carlo Gavazzi 
EOS-Box

does not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.
CVSS Score: 7.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/news-events/ics-advisories/icsa-12-354-02; http://www.us-cert.gov/control_systems/pdf/ICSA-12-354-02.pdf
CVE: CVE-2012-6428
Published: 2012-12-23
Description: The Carlo Gavazzi 
EOS-Box

stores hard-coded passwords in the PHP file of 
the device. By using the hard-coded passwords, attackers can log into 
the device with administrative privileges. This could allow the attacker
 to have unauthorized access.
CVSS Score: 10.0 (HIGH)
CWE: CWE-798, CWE-255
References: https://www.cisa.gov/news-events/ics-advisories/icsa-12-354-02; http://www.us-cert.gov/control_systems/pdf/ICSA-12-354-02.pdf
CVE: CVE-2012-0411
Published: 2012-12-24
Description: Unspecified vulnerability in Novell iPrint Client before 5.82 allows remote attackers to execute arbitrary code via an op-client-interface-version action.
CVSS Score: 10.0 (HIGH)
References: http://www.novell.com/support/kb/doc.php?id=7008708; http://www.novell.com/support/kb/doc.php?id=7008708
CVE: CVE-2012-4046
Published: 2012-12-24
Description: The D-Link DCS-932L camera with firmware 1.02 allows remote attackers to discover the password via a UDP broadcast packet, as demonstrated by running the D-Link Setup Wizard and reading the _paramR["P"] value.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://seclists.org/bugtraq/2012/Dec/98; http://www.fishnetsecurity.com/6labs/blog/password-disclosure-d-link-surveillance-cameras-cve-2012-4046; http://seclists.org/bugtraq/2012/Dec/98
CVE: CVE-2012-5930
Published: 2012-12-24
Description: The pa_modify_accounts function in auth.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 does not require authentication for the modifyAccounts method, which allows remote attackers to change the passwords of administrative accounts via a crafted application/x-amf request.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://download.novell.com/Download?buildid=K6-PmbPjduA~; http://retrogod.altervista.org/9sg_novell_netiq_i.htm; http://retrogod.altervista.org/9sg_novell_netiq_i_adv.htm
CVE: CVE-2012-5931
Published: 2012-12-24
Description: Directory traversal vulnerability in the set_log_config function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote authenticated users to create or overwrite arbitrary files via directory traversal sequences in a log pathname.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://download.novell.com/Download?buildid=K6-PmbPjduA~; http://retrogod.altervista.org/9sg_novell_netiq_i_adv.htm; https://www.netiq.com/support/kb/doc.php?id=7011385
CVE: CVE-2012-5932
Published: 2012-12-24
Description: Eval injection vulnerability in the ldapagnt_eval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute arbitrary Perl code via a crafted application/x-amf request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://download.novell.com/Download?buildid=K6-PmbPjduA~; http://retrogod.altervista.org/9sg_novell_netiq_ii.htm; http://retrogod.altervista.org/9sg_novell_netiq_ldapagnt_adv.htm
CVE: CVE-2012-0428
Published: 2012-12-25
Description: Cross-site scripting (XSS) vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.novell.com/support/kb/doc.php?id=3426981; http://www.novell.com/support/kb/doc.php?id=7011539; http://www.securitytracker.com/id?1027911
CVE: CVE-2012-0429
Published: 2012-12-25
Description: dhost in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote authenticated users to cause a denial of service (daemon crash) via crafted characters in an HTTP request.
CVSS Score: 4.0 (MEDIUM)
References: http://www.novell.com/support/kb/doc.php?id=3426981; http://www.novell.com/support/kb/doc.php?id=7011533; http://www.securitytracker.com/id?1027912
CVE: CVE-2012-0430
Published: 2012-12-25
Description: Unspecified vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote attackers to obtain an administrator cookie and bypass authorization checks via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://www.novell.com/support/kb/doc.php?id=3426981; http://www.novell.com/support/kb/doc.php?id=7011538; http://www.securitytracker.com/id?1027910
CVE: CVE-2012-0432
Published: 2012-12-25
Description: Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.novell.com/support/kb/doc.php?id=3426981; https://bugzilla.novell.com/show_bug.cgi?id=785272; http://www.novell.com/support/kb/doc.php?id=3426981
CVE: CVE-2012-5179
Published: 2012-12-26
Description: The Boat Browser application before 4.2 and Boat Browser Mini application before 3.9 for Android do not properly implement the WebView class, which allows attackers to obtain sensitive information via a crafted application.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN69589791/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000111; http://jvn.jp/en/jp/JVN69589791/index.html