deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-5078
Published: 2012-09-17
Description: SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain version information via a direct request to (1) apphire/silverstripe_version or (2) cms/silverstripe_version.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10; http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4; http://open.silverstripe.org/ticket/5031
CVE: CVE-2010-5079
Published: 2012-09-17
Description: SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2) autologin, (3) "forgot password" functionality, and (4) password salts, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10; http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4; http://open.silverstripe.org/changeset/114497
CVE: CVE-2011-4959
Published: 2012-09-17
Description: SQL injection vulnerability in the addslashes method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6, when connected to a MySQL database using far east character encodings, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12; http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6; http://www.openwall.com/lists/oss-security/2012/04/30/1
CVE: CVE-2011-4960
Published: 2012-09-17
Description: SQL injection vulnerability in the Folder::findOrMake method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12; http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6; http://www.openwall.com/lists/oss-security/2012/04/30/1
CVE: CVE-2011-4961
Published: 2012-09-17
Description: SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDIT_PERMISSIONS permission to gain administrator privileges via a TreeMultiselectField that includes admin groups when adding a user to the selected groups.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12; http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6; http://www.openwall.com/lists/oss-security/2012/04/30/1
CVE: CVE-2011-4962
Published: 2012-09-17
Description: code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6; http://www.openwall.com/lists/oss-security/2012/04/30/1; http://www.openwall.com/lists/oss-security/2012/04/30/3
CVE: CVE-2012-4968
Published: 2012-09-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted string to the AbsoluteLinks, (2) BigSummary, (3) ContextSummary, (4) EscapeXML, (5) FirstParagraph, (6) FirstSentence, (7) Initial, (8) LimitCharacters, (9) LimitSentences, (10) LimitWordCount, (11) LimitWordCountXML, (12) Lower, (13) LowerCase, (14) NoHTML, (15) Summary, (16) Upper, (17) UpperCase, or (18) URL method in a template, different vectors than CVE-2012-0976.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13; http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7; http://www.openwall.com/lists/oss-security/2012/04/30/1
CVE: CVE-2012-1899
Published: 2012-09-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in webfolio/admin/users/edit in Webfolio CMS 1.1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) First name, (2) Last name or (3) Email (required) fields.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ivanobinetti.blogspot.com/2012/03/webfolio-114-multiple-xss.html; http://packetstormsecurity.org/files/110524/Webfolio-CMS-1.1.4-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/52335
CVE: CVE-2012-2056
Published: 2012-09-17
Description: Cross-site request forgery (CSRF) vulnerability in the Content Lock module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1482126; http://www.openwall.com/lists/oss-security/2012/04/07/1; http://www.securityfocus.com/bid/52502
CVE: CVE-2012-2057
Published: 2012-09-17
Description: Cross-site request forgery (CSRF) vulnerability in the Ubercart Bulk Stock Updater module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors related to formAPI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1482126; http://www.openwall.com/lists/oss-security/2012/04/07/1; http://www.securityfocus.com/bid/52502
CVE: CVE-2012-2058
Published: 2012-09-17
Description: The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1482126; http://www.openwall.com/lists/oss-security/2012/04/07/1; http://www.securityfocus.com/bid/52502
CVE: CVE-2012-2059
Published: 2012-09-17
Description: Cross-site scripting (XSS) vulnerability in the ticketyboo News Ticker module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1482126; http://www.openwall.com/lists/oss-security/2012/04/07/1; http://www.securityfocus.com/bid/52502
CVE: CVE-2012-2060
Published: 2012-09-17
Description: Cross-site scripting (XSS) vulnerability in the Admin tools module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1482126; http://www.openwall.com/lists/oss-security/2012/04/07/1; http://www.securityfocus.com/bid/52502
CVE: CVE-2012-2061
Published: 2012-09-17
Description: Cross-site request forgery (CSRF) vulnerability in the Admin tools module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors involving "not checking tokens."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1482126; http://www.openwall.com/lists/oss-security/2012/04/07/1; http://www.securityfocus.com/bid/52502
CVE: CVE-2012-2062
Published: 2012-09-17
Description: Open redirect vulnerability in the Redirecting click bouncer module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://drupal.org/node/1482126; http://www.openwall.com/lists/oss-security/2012/04/07/1; http://www.securityfocus.com/bid/52502
CVE: CVE-2012-2993
Published: 2012-09-18
Description: Microsoft Windows Phone 7 does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL server for the (1) POP3, (2) IMAP, or (3) SMTP protocol via an arbitrary valid certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: http://osvdb.org/85619; http://www.kb.cert.org/vuls/id/389795; http://www.securityfocus.com/bid/55569
CVE: CVE-2012-2994
Published: 2012-09-18
Description: The CoSoSys Endpoint Protector 4 appliance establishes an EPProot password based entirely on the appliance serial number, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/50604; http://www.kb.cert.org/vuls/id/591667; http://secunia.com/advisories/50604
CVE: CVE-2012-4969
Published: 2012-09-18
Description: Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-416
References: http://blog.vulnhunt.com/index.php/2012/09/17/ie-execcommand-fuction-use-after-free-vulnerability-0day_en/; http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/ie_execcommand_uaf.rb; http://eromang.zataz.com/2012/09/16/zero-day-season-is-really-not-over-yet/
CVE: CVE-2012-3028
Published: 2012-09-18
Description: Cross-site request forgery (CSRF) vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that modify data or cause a denial of service.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://en.securitylab.ru/lab/PT-2012-42; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-864051.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-256-01.pdf
CVE: CVE-2012-3030
Published: 2012-09-18
Description: WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, stores sensitive information under the web root with insufficient access control, which allows remote attackers to read a (1) log file or (2) configuration file via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://en.securitylab.ru/lab/PT-2012-43; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-864051.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-256-01.pdf
CVE: CVE-2012-3031
Published: 2012-09-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allow remote attackers to inject arbitrary web script or HTML via a (1) GET parameter, (2) POST parameter, or (3) Referer HTTP header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://en.securitylab.ru/lab/PT-2012-42; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-864051.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-256-01.pdf
CVE: CVE-2012-3032
Published: 2012-09-18
Description: SQL injection vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to execute arbitrary SQL commands via a crafted SOAP message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://en.securitylab.ru/lab/PT-2012-44; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-864051.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-256-01.pdf
CVE: CVE-2012-3034
Published: 2012-09-18
Description: WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to discover a username and password via crafted parameters to unspecified methods in ActiveX controls.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://en.securitylab.ru/lab/PT-2012-45; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-864051.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-256-01.pdf
CVE: CVE-2012-3524
Published: 2012-09-18
Description: libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable.  NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00000.html
CVE: CVE-2012-3547
Published: 2012-09-18
Description: Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-09/0043.html; http://freeradius.org/security.html; http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
CVE: CVE-2012-4405
Published: 2012-09-18
Description: Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow.  NOTE: this issue is also described as an array index error.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00001.html; http://lists.opensuse.org/opensuse-updates/2012-10/msg00015.html
CVE: CVE-2012-4413
Published: 2012-09-18
Description: OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/85484; http://secunia.com/advisories/50531; http://secunia.com/advisories/50590
CVE: CVE-2012-4425
Published: 2012-09-18
Description: libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable.  NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://permalink.gmane.org/gmane.linux.redhat.fedora.extras.cvs/853051; http://rhn.redhat.com/errata/RHSA-2012-1284.html; http://www.exploit-db.com/exploits/21323
CVE: CVE-2011-4941
Published: 2012-09-18
Description: Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/; http://www.openwall.com/lists/oss-security/2012/03/18/1; http://www.openwall.com/lists/oss-security/2012/03/19/8
CVE: CVE-2012-1183
Published: 2012-09-18
Description: Stack-based buffer overflow in the milliwatt_generate function in the Miliwatt application in Asterisk 1.4.x before 1.4.44, 1.6.x before 1.6.2.23, 1.8.x before 1.8.10.1, and 10.x before 10.2.1, when the o option is used and the internal_timing option is off, allows remote attackers to cause a denial of service (application crash) via a large number of samples in an audio packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0069.html; http://downloads.asterisk.org/pub/security/AST-2012-002-1.8.diff; http://downloads.asterisk.org/pub/security/AST-2012-002.pdf
CVE: CVE-2012-1184
Published: 2012-09-18
Description: Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://downloads.asterisk.org/pub/security/AST-2012-003-1.8.diff; http://downloads.asterisk.org/pub/security/AST-2012-003.pdf; http://osvdb.org/80126
CVE: CVE-2012-1901
Published: 2012-09-18
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to (1) hijack the authentication of users for requests that change account settings via a request to index.php/profile-edit-save or (2) hijack the authentication of administrators for requests that add a new page via a request to admin/pages-new-save.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://ivanobinetti.blogspot.com/2012/03/flexcms-multiple-csrf-vulnerabilities.html; http://secunia.com/advisories/48451; http://www.exploit-db.com/exploits/18609
CVE: CVE-2012-1654
Published: 2012-09-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Data module 6.x-1.x before 6.x-1.0 and 7.x-1.x before 7.x-1.0-alpha3 for Drupal allow remote authenticated users with the administer data tables permission to inject arbitrary web script or HTML via the title parameter in (1) data.views.inc and (2) data_ui/data_ui.admin.inc.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1470980; http://drupal.org/node/1470982; http://drupal.org/node/1471780
CVE: CVE-2012-1655
Published: 2012-09-18
Description: Unspecified vulnerability in the UC PayDutchGroup / WeDeal payment module 6.x-1.0 for Drupal allows remote authenticated users to obtain account credentials via unknown attack vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://drupal.org/node/1471800; http://www.openwall.com/lists/oss-security/2012/04/07/1; http://www.osvdb.org/79855
CVE: CVE-2012-1656
Published: 2012-09-18
Description: SQL injection vulnerability in the Multisite Search module 6.x-2.2 for Drupal allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the Site table prefix field.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://drupal.org/node/1471800; http://www.madirish.net/content/drupal-multisite-search-module-sql-injection-vulnerability; http://www.openwall.com/lists/oss-security/2012/04/07/1
CVE: CVE-2012-1657
Published: 2012-09-18
Description: Cross-site scripting (XSS) vulnerability in block_class.module in the Block Class module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the class name.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1471090; http://drupal.org/node/1471808; http://drupalcode.org/project/block_class.git/commit/9a5205d
CVE: CVE-2012-1658
Published: 2012-09-18
Description: Cross-site scripting (XSS) vulnerability in the Read More Link module 6.x-3.x before 6.x-3.1 for Drupal allows remote authenticated users with the access administration pages permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1471080; http://drupal.org/node/1471822; http://secunia.com/advisories/48138
CVE: CVE-2012-1659
Published: 2012-09-18
Description: Cross-site scripting (XSS) vulnerability in the Node Recommendation module 6.x-1.x before 6.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1471906; http://drupal.org/node/1471940; http://drupalcode.org/project/noderecommendation.git/commit/55567d0
CVE: CVE-2012-1660
Published: 2012-09-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select (or other)" module is enabled, allow remote authenticated users with the create webform content permission to inject arbitrary web script or HTML via vectors related to (1) checkboxes or (2) radios.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1472178; http://drupal.org/node/1472180; http://drupal.org/node/1472214
CVE: CVE-2012-3258
Published: 2012-09-19
Description: Unspecified vulnerability in HP Operations Orchestration 9.0 before 9.03 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/bid/55594; https://exchange.xforce.ibmcloud.com/vulnerabilities/78621; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03490339
CVE: CVE-2011-3827
Published: 2012-09-19
Description: The iCalendar component in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted date-time string in a .ics attachment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-09/0075.html; http://secunia.com/secunia_research/2012-30/; http://www.novell.com/support/kb/doc.php?id=7010767
CVE: CVE-2012-0271
Published: 2012-09-19
Description: Integer overflow in the WebConsole component in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before 8.0.3 HP1 and 2012 before SP1 might allow remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow, as demonstrated by a request with -1 in the Content-Length HTTP header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://osvdb.org/85426; http://www.novell.com/support/kb/doc.php?id=7010769; http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=61&Itemid=61
CVE: CVE-2012-0272
Published: 2012-09-19
Description: Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to inject arbitrary web script or HTML via the merge parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.novell.com/support/kb/doc.php?id=7010368; http://www.securitytracker.com/id?1027615; https://bugzilla.novell.com/show_bug.cgi?id=702785
CVE: CVE-2012-2578
Published: 2012-09-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a JavaScript alert function used in conjunction with the fromCharCode method, (2) a SCRIPT element, (3) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element, or (4) an innerHTML attribute within an XML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/20362/; http://www.exploit-db.com/exploits/20362/