deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-1798
Published: 2012-06-05
Description: The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-updates/2012-06/msg00001.html; http://rhn.redhat.com/errata/RHSA-2012-0544.html; http://secunia.com/advisories/48974
CVE: CVE-2012-2094
Published: 2012-06-05
Description: Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the guest console.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079160.html; http://secunia.com/advisories/49024; http://secunia.com/advisories/49071
CVE: CVE-2012-2144
Published: 2012-06-05
Description: Session fixation vulnerability in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 allows remote attackers to hijack web sessions via the sessionid cookie.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081173.html; http://secunia.com/advisories/49024; http://secunia.com/advisories/49071
CVE: CVE-2012-0441
Published: 2012-06-05
Description: The ASN.1 decoder in the QuickDER decoder in Mozilla Network Security Services (NSS) before 3.13.4, as used in Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10, allows remote attackers to cause a denial of service (application crash) via a zero-length item, as demonstrated by (1) a zero-length basic constraint or (2) a zero-length field in an OCSP response.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html; http://secunia.com/advisories/49976
CVE: CVE-2012-1937
Published: 2012-06-05
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-0710.html
CVE: CVE-2012-1938
Published: 2012-06-05
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 13.0, Thunderbird before 13.0, and SeaMonkey before 2.10 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) methodjit/ImmutableSync.cpp, (2) the JSObject::makeDenseArraySlow function in js/src/jsarray.cpp, and unknown other components.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-0710.html
CVE: CVE-2012-1939
Published: 2012-06-05
Description: jsinfer.cpp in Mozilla Firefox ESR 10.x before 10.0.5 and Thunderbird ESR 10.x before 10.0.5 does not properly determine data types, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via crafted JavaScript code.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html; http://rhn.redhat.com/errata/RHSA-2012-0710.html; http://rhn.redhat.com/errata/RHSA-2012-0715.html
CVE: CVE-2012-1940
Published: 2012-06-05
Description: Use-after-free vulnerability in the nsFrameList::FirstChild function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) by changing the size of a container of absolutely positioned elements in a column.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-0710.html
CVE: CVE-2012-1941
Published: 2012-06-05
Description: Heap-based buffer overflow in the nsHTMLReflowState::CalculateHypotheticalBox function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code by resizing a window displaying absolutely positioned and relatively positioned elements in nested columns.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-0710.html
CVE: CVE-2012-1942
Published: 2012-06-05
Description: The Mozilla Updater and Windows Updater Service in Mozilla Firefox 12.0, Thunderbird 12.0, and SeaMonkey 2.9 on Windows allow local users to gain privileges by loading a DLL file in a privileged context.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html; http://www.mozilla.org/security/announce/2012/mfsa2012-35.html; http://www.mozilla.org/security/announce/2013/mfsa2013-45.html
CVE: CVE-2012-1943
Published: 2012-06-05
Description: Untrusted search path vulnerability in Updater.exe in the Windows Updater Service in Mozilla Firefox 12.0, Thunderbird 12.0, and SeaMonkey 2.9 on Windows allows local users to gain privileges via a Trojan horse wsock32.dll file in an application directory.
CVSS Score: 6.9 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html; http://www.mozilla.org/security/announce/2012/mfsa2012-35.html; https://bugzilla.mozilla.org/show_bug.cgi?id=750850
CVE: CVE-2012-1944
Published: 2012-06-05
Description: The Content Security Policy (CSP) implementation in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 does not block inline event handlers, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-0710.html
CVE: CVE-2012-1945
Published: 2012-06-05
Description: Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allow local users to obtain sensitive information via an HTML document that loads a shortcut (aka .lnk) file for display within an IFRAME element, as demonstrated by a network share implemented by (1) Microsoft Windows or (2) Samba.
CVSS Score: 2.9 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-0710.html
CVE: CVE-2012-1946
Published: 2012-06-05
Description: Use-after-free vulnerability in the nsINode::ReplaceOrInsertBefore function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 might allow remote attackers to execute arbitrary code via document changes involving replacement or insertion of a node.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-0710.html
CVE: CVE-2012-1947
Published: 2012-06-05
Description: Heap-based buffer overflow in the utf16_to_isolatin1 function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code via vectors that trigger a character-set conversion failure.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html; http://rhn.redhat.com/errata/RHSA-2012-0710.html
CVE: CVE-2012-3105
Published: 2012-06-05
Description: The glBufferData function in the WebGL implementation in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 does not properly mitigate an unspecified flaw in an NVIDIA driver, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a related issue to CVE-2011-3101.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.mozilla.org/security/announce/2012/mfsa2012-34.html; https://bugzilla.mozilla.org/show_bug.cgi?id=744888; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16912
CVE: CVE-2011-1761
Published: 2012-06-07
Description: Multiple stack-based buffer overflows in the (1) abc_new_macro and (2) abc_new_umacro functions in src/load_abc.cpp in libmodplug before 0.8.8.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ABC file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060520.html; http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00019.html; http://secunia.com/advisories/44388
CVE: CVE-2011-2911
Published: 2012-06-07
Description: Integer overflow in the CSoundFile::ReadWav function in src/load_wav.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted WAV file, which triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://jira.atheme.org/browse/AUDPLUG-394; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063786.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066044.html
CVE: CVE-2011-2912
Published: 2012-06-07
Description: Stack-based buffer overflow in the CSoundFile::ReadS3M function in src/load_s3m.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted S3M file with an invalid offset.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://jira.atheme.org/browse/AUDPLUG-394; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063786.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066044.html
CVE: CVE-2011-2913
Published: 2012-06-07
Description: Off-by-one error in the CSoundFile::ReadAMS function in src/load_ams.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (stack memory corruption) and possibly execute arbitrary code via a crafted AMS file with a large number of samples.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://jira.atheme.org/browse/AUDPLUG-394; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063786.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066044.html
CVE: CVE-2011-2914
Published: 2012-06-07
Description: Off-by-one error in the CSoundFile::ReadDSM function in src/load_dms.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted DSM file with a large number of samples.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://jira.atheme.org/browse/AUDPLUG-394; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063786.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066044.html
CVE: CVE-2011-2915
Published: 2012-06-07
Description: Off-by-one error in the CSoundFile::ReadAMS2 function in src/load_ams.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted AMS file with a large number of instruments.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://jira.atheme.org/browse/AUDPLUG-394; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063786.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066044.html
CVE: CVE-2011-4964
Published: 2012-06-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-2667.  Reason: This candidate is a duplicate of CVE-2012-2667.  Notes: All CVE users should reference CVE-2012-2667 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-0985
Published: 2012-06-07
Description: Multiple buffer overflows in the Wireless Manager ActiveX control 4.0.0.0 in WifiMan.dll in Sony VAIO PC Wireless LAN Wizard 1.0; VAIO Wireless Wizard 1.00, 1.00_64, 1.0.1, 2.0, and 3.0; SmartWi Connection Utility 4.7, 4.7.4, 4.8, 4.9, 4.10, and 4.11; and VAIO Easy Connect software 1.0.0 and 1.1.0 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the second argument of the (1) SetTmpProfileOption or (2) ConnectToNetwork method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-05/0147.html; http://esupport.sony.com/US/perl/support-info.pl?template_id=1&info_id=946; http://osvdb.org/82401
CVE: CVE-2012-1012
Published: 2012-06-07
Description: server/server_stubs.c in the kadmin protocol implementation in MIT Kerberos 5 (aka krb5) 1.10 before 1.10.1 does not properly restrict access to (1) SET_STRING and (2) GET_STRINGS operations, which might allow remote authenticated administrators to modify or read string attributes by leveraging the global list privilege.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7093; http://src.mit.edu/fisheye/changelog/krb5/?cs=25704; http://web.mit.edu/kerberos/krb5-1.10/
CVE: CVE-2012-1013
Published: 2012-06-07
Description: The check_1_6_dummy function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x, and 1.10.x before 1.10.2 allows remote authenticated administrators to cause a denial of service (NULL pointer dereference and daemon crash) via a KRB5_KDB_DISALLOW_ALL_TIX create request that lacks a password.
CVSS Score: 4.0 (MEDIUM)
References: http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7152; http://mailman.mit.edu/pipermail/kerberos-announce/2012q2/000136.html; http://rhn.redhat.com/errata/RHSA-2012-1131.html
CVE: CVE-2012-2101
Published: 2012-06-07
Description: Openstack Compute (Nova) Folsom, 2012.1, and 2011.3 does not limit the number of security group rules, which allows remote authenticated users with certain permissions to cause a denial of service (CPU and hard drive consumption) via a network request that triggers a large number of iptables rules.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079434.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079551.html; http://secunia.com/advisories/49034
CVE: CVE-2012-2667
Published: 2012-06-07
Description: Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/49312; http://symfony.com/blog/security-release-symfony-1-4-18-released; http://trac.symfony-project.org/browser/tags/RELEASE_1_4_18/CHANGELOG
CVE: CVE-2012-2762
Published: 2012-06-07
Description: SQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url parameter to comment.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.s9y.org/archives/241-Serendipity-1.6.2-released.html; http://secunia.com/advisories/49234; http://www.osvdb.org/82036
CVE: CVE-2012-3290
Published: 2012-06-07
Description: Multiple unspecified vulnerabilities in Google Chrome before 20.0.1132.22 on the Acer AC700; Samsung Series 5, 5 550, and Chromebox 3; and Cr-48 Chromebook platforms have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2012/06/beta-channel-update-for-chromebooks.html; http://googlechromereleases.blogspot.com/2012/06/beta-channel-update-for-chromebooks.html
CVE: CVE-2012-3291
Published: 2012-06-07
Description: Heap-based buffer overflow in OpenConnect 3.18 allows remote servers to cause a denial of service via a crafted greeting banner.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.infradead.org/users/dwmw2/openconnect.git/commitdiff/14cae65318d3ef1f7d449e463b72b6934e82f1c2; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079747.html; http://lists.opensuse.org/opensuse-updates/2013-06/msg00186.html
CVE: CVE-2012-3292
Published: 2012-06-07
Description: The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://jira.globus.org/browse/GT-195; http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081787.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081791.html
CVE: CVE-2012-0948
Published: 2012-06-07
Description: DistUpgrade/DistUpgradeMain.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uses weak permissions for (1) apt-clone_system_state.tar.gz and (2) system_state.tar.gz, which allows local users to obtain repository credentials.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://launchpadlibrarian.net/105380733/update-manager_1%3A0.156.14.3_1%3A0.156.14.4.diff.gz; http://osvdb.org/82019; http://secunia.com/advisories/49230
CVE: CVE-2012-0507
Published: 2012-06-07
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency.  NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions.  NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843
References: http://blogs.technet.com/b/mmpc/archive/2012/03/20/an-interesting-case-of-jre-sandbox-breach-cve-2012-0507.aspx; http://krebsonsecurity.com/2012/03/new-java-attack-rolled-into-exploit-packs/; http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html
CVE: CVE-2012-1826
Published: 2012-06-08
Description: dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://dotcms.com/dotCMSVersions/; http://osvdb.org/82240; http://secunia.com/advisories/49276
CVE: CVE-2012-2603
Published: 2012-06-08
Description: The server in CollabNet ScrumWorks Pro before 6.0 allows remote authenticated users to gain privileges and obtain sensitive information via a modified desktop client.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/442595; http://www.kb.cert.org/vuls/id/MAPG-8RJPJX; http://www.kb.cert.org/vuls/id/442595
CVE: CVE-2012-1814
Published: 2012-06-08
Description: Cross-site scripting (XSS) vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/81996; http://secunia.com/advisories/49210; http://www.securityfocus.com/bid/53591
CVE: CVE-2012-1815
Published: 2012-06-08
Description: SQL injection vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/82011; http://secunia.com/advisories/49210; http://www.securityfocus.com/bid/53591
CVE: CVE-2012-1816
Published: 2012-06-08
Description: PORTSERV.exe in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to cause a denial of service (daemon crash) via a crafted (1) TCP or (2) UDP packet to port 111.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/82012; http://secunia.com/advisories/49210; http://www.securityfocus.com/bid/53591
CVE: CVE-2012-1817
Published: 2012-06-08
Description: Buffer overflow in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via an invalid field in a project file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/82013; http://secunia.com/advisories/49210; http://www.securityfocus.com/bid/53591
CVE: CVE-2012-1818
Published: 2012-06-08
Description: An unspecified ActiveX control in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to overwrite arbitrary files via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/82014; http://secunia.com/advisories/49210; http://www.securityfocus.com/bid/53591
CVE: CVE-2012-2595
Published: 2012-06-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 allow remote attackers to inject arbitrary web script or HTML via vectors involving special characters in parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-158-01.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdf