deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-0620
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0621
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0622
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0623
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0624
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0625
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0626
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0627
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0628
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0629
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0630
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0631
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0632
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0633
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0634
Published: 2012-03-08
Description: WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://secunia.com/advisories/48274; http://www.securityfocus.com/bid/52363
CVE: CVE-2012-0635
Published: 2012-03-08
Description: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
CVE: CVE-2012-0636
Published: 2012-03-08
Description: WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html; http://secunia.com/advisories/48274
CVE: CVE-2012-0637
Published: 2012-03-08
Description: WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html; http://secunia.com/advisories/48274
CVE: CVE-2012-0638
Published: 2012-03-08
Description: WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html; http://secunia.com/advisories/48274
CVE: CVE-2012-0639
Published: 2012-03-08
Description: WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html; http://secunia.com/advisories/48274
CVE: CVE-2012-0641
Published: 2012-03-08
Description: CFNetwork in Apple iOS before 5.1 does not properly construct request headers during parsing of URLs, which allows remote attackers to obtain sensitive information via a malformed URL, a different vulnerability than CVE-2011-3447.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://secunia.com/advisories/48288; http://www.securitytracker.com/id?1026774
CVE: CVE-2012-0642
Published: 2012-03-08
Description: Integer underflow in Apple iOS before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (device crash) via a crafted catalog file in an HFS disk image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://secunia.com/advisories/48288
CVE: CVE-2012-0643
Published: 2012-03-08
Description: The kernel in Apple iOS before 5.1 does not properly handle debug system calls, which allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a crafted program.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html; http://secunia.com/advisories/48288
CVE: CVE-2012-0644
Published: 2012-03-08
Description: Race condition in the Passcode Lock feature in Apple iOS before 5.1 allows physically proximate attackers to bypass intended passcode requirements via a slide-to-dial gesture.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://secunia.com/advisories/48288; http://www.securitytracker.com/id?1026774
CVE: CVE-2012-0645
Published: 2012-03-08
Description: Siri in Apple iOS before 5.1 does not properly restrict the ability of Mail.app to handle voice commands, which allows physically proximate attackers to bypass the locked state via a command that forwards an active e-mail message to an arbitrary recipient.
CVSS Score: 1.2 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://secunia.com/advisories/48288; http://www.securitytracker.com/id?1026774
CVE: CVE-2012-0646
Published: 2012-03-08
Description: Format string vulnerability in VPN in Apple iOS before 5.1 allows remote attackers to execute arbitrary code via a crafted racoon configuration file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html; http://secunia.com/advisories/48288; http://www.securitytracker.com/id?1026774
CVE: CVE-2012-0648
Published: 2012-03-08
Description: WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html; http://secunia.com/advisories/48274
CVE: CVE-2011-3046
Published: 2012-03-09
Description: The extension subsystem in Google Chrome before 17.0.963.78 does not properly handle history navigation, which allows remote attackers to execute arbitrary code by leveraging a "Universal XSS (UXSS)" issue.
CVSS Score: 10.0 (HIGH)
CWE: CWE-79
References: http://code.google.com/p/chromium/issues/detail?id=117226; http://code.google.com/p/chromium/issues/detail?id=117230; http://googlechromereleases.blogspot.com/2012/03/chrome-stable-channel-update.html
CVE: CVE-2012-0245
Published: 2012-03-09
Description: Multiple stack-based buffer overflows in RobNetScanHost.exe in ABB Robot Communications Runtime before 5.14.02, as used in ABB Interlink Module, IRC5 OPC Server, PC SDK, PickMaster 3 and 5, RobView 5, RobotStudio, WebWare SDK, and WebWare Server, allow remote attackers to execute arbitrary code via a crafted (1) 0xA or (2) 0xE Netscan packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0125.html; http://secunia.com/advisories/48090; http://www.securityfocus.com/bid/52123
CVE: CVE-2012-0323
Published: 2012-03-09
Description: Cross-site scripting (XSS) vulnerability in the Autocomplete plugin before 3.0 for SquirrelMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN56653852/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000021; http://squirrelmail.org/plugin_view.php?id=32
CVE: CVE-2012-0324
Published: 2012-03-09
Description: Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0325.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN14791558/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000022; http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-03-05.cb
CVE: CVE-2012-0325
Published: 2012-03-09
Description: Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0324.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN79950061/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000023; http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-03-05.cb
CVE: CVE-2012-1544
Published: 2012-03-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-1876.  Reason: This candidate is a duplicate of CVE-2012-1876.  Notes: All CVE users should reference CVE-2012-1876 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-1545
Published: 2012-03-09
Description: Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service (memory corruption) by leveraging access to a Low integrity process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://arstechnica.com/business/news/2012/03/ie-9-on-latest-windows-gets-stomped-at-hacker-contest.ars; http://pwn2own.zerodayinitiative.com/status.html; http://twitter.com/vupen/statuses/[PII_REDACTED]8291073
CVE: CVE-2011-3047
Published: 2012-03-10
Description: The GPU process in Google Chrome before 17.0.963.79 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) by leveraging an error in the plug-in loading mechanism.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=117620; http://code.google.com/p/chromium/issues/detail?id=117656; http://googlechromereleases.blogspot.com/2012/03/chrome-stable-update_10.html
CVE: CVE-2012-1557
Published: 2012-03-12
Description: SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x before MU#13, 10.1.x before MU#22, 10.2.x before MU#16, and 10.3.x before MU#5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in March 2012.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-linux-updates-release-notes.html#10216; http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-windows-updates-release-notes.html#10216; http://kb.parallels.com/en/113321
CVE: CVE-2012-1558
Published: 2012-03-12
Description: yaSSL CyaSSL before 2.0.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted X.509 certificate.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/48634; http://www.securityfocus.com/bid/52828; http://www.yassl.com/yaSSL/Docs-cyassl-changelog.html
CVE: CVE-2012-0584
Published: 2012-03-12
Description: The Internationalized Domain Name (IDN) feature in Apple Safari before 5.1.4 on Windows does not properly restrict the characters in URLs, which allows remote attackers to spoof a domain name via unspecified homoglyphs.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html; http://osvdb.org/80088; http://secunia.com/advisories/48377
CVE: CVE-2012-0640
Published: 2012-03-12
Description: WebKit in Apple Safari before 5.1.4 does not properly implement "From third parties and advertisers" cookie blocking, which makes it easier for remote web servers to track users via a cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html; http://secunia.com/advisories/48377; http://www.securitytracker.com/id?1026785
CVE: CVE-2012-0647
Published: 2012-03-12
Description: WebKit in Apple Safari before 5.1.4 does not properly handle redirects in conjunction with HTTP authentication, which might allow remote web servers to capture credentials by logging the Authorization HTTP header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html; http://secunia.com/advisories/48377; http://www.securitytracker.com/id?1026785
CVE: CVE-2011-1394
Published: 2012-03-13
Description: IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allow remote attackers to cause a denial of service (memory consumption) by establishing many UI sessions within one HTTP session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/48299; http://secunia.com/advisories/48305; http://www-01.ibm.com/support/docview.wss?uid=swg1IV09157
CVE: CVE-2011-1395
Published: 2012-03-13
Description: Cross-site scripting (XSS) vulnerability in imicon.jsp in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the controlid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48299; http://www-01.ibm.com/support/docview.wss?uid=swg1IV09189; http://www.ibm.com/support/docview.wss?uid=swg21584666
CVE: CVE-2011-1396
Published: 2012-03-13
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the reportType parameter to an unspecified component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48299; http://www-01.ibm.com/support/docview.wss?uid=swg1IV09190; http://www.ibm.com/support/docview.wss?uid=swg21584666