deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-3974
Published: 2012-08-29
Description: Untrusted search path vulnerability in the installer in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, and Thunderbird ESR 10.x before 10.0.7 on Windows allows local users to gain privileges via a Trojan horse executable file in a root directory.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html; http://www.mozilla.org/security/announce/2012/mfsa2012-67.html
CVE: CVE-2012-3975
Published: 2012-08-29
Description: The DOMParser component in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 loads subresources during parsing of text/html data within an extension, which allows remote attackers to obtain sensitive information by providing crafted data to privileged extension code.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3976
Published: 2012-08-29
Description: Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly handle onLocationChange events during navigation between different https sites, which allows remote attackers to spoof the X.509 certificate information in the address bar via a crafted web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3978
Published: 2012-08-29
Description: The nsLocation::CheckURL function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 does not properly follow the security model of the location object, which allows remote attackers to bypass intended content-loading restrictions or possibly have unspecified other impact via vectors involving chrome code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3979
Published: 2012-08-29
Description: Mozilla Firefox before 15.0 on Android does not properly implement unspecified callers of the __android_log_print function, which allows remote attackers to execute arbitrary code via a crafted web page that calls the JavaScript dump function.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html; http://www.mozilla.org/security/announce/2012/mfsa2012-71.html
CVE: CVE-2012-3980
Published: 2012-08-29
Description: The web console in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, and Thunderbird ESR 10.x before 10.0.7 allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that injects this code and triggers an eval operation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2011-2777
Published: 2012-08-29
Description: samples/powerbtn/powerbtn.sh in acpid (aka acpid2) 2.0.16 and earlier uses the pidof program incorrectly, which allows local users to gain privileges by running a program with the name kded4 and a DBUS_SESSION_BUS_ADDRESS environment variable containing commands.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: https://bugs.launchpad.net/ubuntu/+source/acpid/+bug/893821; https://bugs.launchpad.net/ubuntu/+source/acpid/+bug/893821
CVE: CVE-2011-4578
Published: 2012-08-29
Description: event.c in acpid (aka acpid2) before 2.0.11 does not have an appropriate umask setting during execution of event-handler scripts, which might allow local users to (1) perform write operations within directories created by a script, or (2) read files created by a script, via standard filesystem system calls.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://sourceforge.net/u/tedfelix/acpid2/ci/02d0bf29207f17996936ab652717855b15873901/tree/Changelog?force=True; http://www.mandriva.com/security/advisories?name=MDVSA-2012:138; http://www.openwall.com/lists/oss-security/2011/12/06/3
CVE: CVE-2012-2285
Published: 2012-08-29
Description: EMC Cloud Tiering Appliance (aka CTA, formerly FMA) 9.0 and earlier, and Cloud Tiering Appliance Virtual Edition (CTA/VE) 9.0 and earlier, allows remote attackers to obtain GUI administrative access by sending a crafted file during the authentication phase.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2012-08/0184.html; http://osvdb.org/85050; http://secunia.com/advisories/50393
CVE: CVE-2012-3295
Published: 2012-08-29
Description: IBM WebSphere MQ 7.1, when an SVRCONN channel is used, allows remote attackers to bypass the security-configuration setup step and obtain queue-manager access via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM56593; http://www.ibm.com/support/docview.wss?uid=swg21595523; https://exchange.xforce.ibmcloud.com/vulnerabilities/77279
CVE: CVE-2012-3309
Published: 2012-08-29
Description: Cross-site request forgery (CSRF) vulnerability in the account-creation panel in IBM InfoSphere Guardium 8.2 and earlier, when the CSRF filtering (aka csrf_status) feature is disabled, allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://en.securitylab.ru/lab/; http://en.securitylab.ru/lab/PT-2012-15; http://www.ibm.com/support/docview.wss?uid=swg21609223
CVE: CVE-2012-3312
Published: 2012-08-29
Description: The datasource definition editor in IBM InfoSphere Guardium 8.2 and earlier, when the save-password setting is enabled, transmits cleartext database credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://en.securitylab.ru/lab/; http://en.securitylab.ru/lab/PT-2012-15; http://www.ibm.com/support/docview.wss?uid=swg21609224
CVE: CVE-2012-4736
Published: 2012-08-29
Description: The Device Encryption Client component in Sophos SafeGuard Enterprise 6.0, when a volume-based encryption policy is enabled in conjunction with a user-defined key, does not properly block use of exFAT USB flash drives, which makes it easier for local users to bypass intended access restrictions and copy sensitive information to a drive via multiple removal and reattach operations.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://www.sophos.com/support/knowledgebase/1376/1380/114138.aspx; https://exchange.xforce.ibmcloud.com/vulnerabilities/78580; http://www.sophos.com/support/knowledgebase/1376/1380/114138.aspx
CVE: CVE-2012-3253
Published: 2012-08-30
Description: Multiple unspecified vulnerabilities in HP Intelligent Management Center (IMC) before 5.0 E0101P05 allow remote attackers to execute arbitrary code via crafted input, as demonstrated by an integer overflow and heap-based buffer overflow in img.exe for a crafted message packet.
CVSS Score: 10.0 (HIGH)
References: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03473459; http://zerodayinitiative.com/advisories/ZDI-12-164/; http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03473459
CVE: CVE-2012-3254
Published: 2012-08-30
Description: Multiple unspecified vulnerabilities in HP iNode Management Center before iNode PC 5.1 E0304 allow remote attackers to execute arbitrary code via crafted input, as demonstrated by a stack-based buffer overflow in iNodeMngChecker.exe for a crafted 0x0A0BF007 packet.
CVSS Score: 10.0 (HIGH)
References: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03473527; http://zerodayinitiative.com/advisories/ZDI-12-163/; http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03473527
CVE: CVE-2012-4010
Published: 2012-08-30
Description: Opera before 11.60 allows remote attackers to spoof the address bar via unspecified homograph characters, a different vulnerability than CVE-2010-2660.
CVSS Score: 5.0 (MEDIUM)
References: http://jvn.jp/en/jp/JVN69880570/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000080; http://www.opera.com/docs/changelogs/windows/1160/
CVE: CVE-2011-1398
Published: 2012-08-30
Description: The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://article.gmane.org/gmane.comp.php.devel/70584; http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.html; http://openwall.com/lists/oss-security/2012/08/29/5
CVE: CVE-2011-5129
Published: 2012-08-30
Description: Heap-based buffer overflow in XChat 2.8.9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long response string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.org/files/107312/xchat-dos.txt; http://www.exploit-db.com/exploits/18159; http://www.osvdb.org/77629
CVE: CVE-2011-5130
Published: 2012-08-30
Description: dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/77492; http://secunia.com/advisories/47069; http://sourceforge.net/apps/trac/fam-connections/ticket/407
CVE: CVE-2011-5131
Published: 2012-08-30
Description: Cross-site request forgery (CSRF) vulnerability in global.php in MyBB before 1.6.5 allows remote attackers to hijack the authentication of a user for requests that change the user's language via the language parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://blog.mybb.com/2011/11/25/mybb-1-6-5-released-feature-update-security-maintenance-release/; http://dev.mybb.com/issues/1729; http://secunia.com/advisories/46951
CVE: CVE-2011-5132
Published: 2012-08-30
Description: Cross-site scripting (XSS) vulnerability in MyBB before 1.6.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "usernames via AJAX."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.mybb.com/2011/11/25/mybb-1-6-5-released-feature-update-security-maintenance-release/; http://secunia.com/advisories/46951; http://www.osvdb.org/77326
CVE: CVE-2011-5133
Published: 2012-08-30
Description: Unspecified vulnerability in MyBB before 1.6.5 has unknown impact and attack vectors, related to an "unparsed user avatar in the buddy list."
CVSS Score: 10.0 (HIGH)
References: http://blog.mybb.com/2011/11/25/mybb-1-6-5-released-feature-update-security-maintenance-release/; http://secunia.com/advisories/46951; http://www.osvdb.org/77325
CVE: CVE-2011-5134
Published: 2012-08-30
Description: Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the JCE component before 2.0.18 for Joomla! allows remote authenticated users with the author privileges to execute arbitrary PHP code by uploading a file with a double extension, as demonstrated by .php.gif.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/47190; http://www.joomlacontenteditor.net/news/item/jce-2018-released?category_id=32; http://www.osvdb.org/77579
CVE: CVE-2011-5135
Published: 2012-08-30
Description: Multiple SQL injection vulnerabilities in the save_connection function in lib/lib.iotask.php in the iotask module in DoceboLMS 4.0.4 and earlier allow remote authenticated users with admin or teacher privileges to execute arbitrary SQL commands via the (1) coursereportuiconfig[name] or (2) coursereportuiconfig[description] parameters to index.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18224; https://exchange.xforce.ibmcloud.com/vulnerabilities/71720; https://twitter.com/claudioerba73/status/[PII_REDACTED]2685440
CVE: CVE-2011-5136
Published: 2012-08-30
Description: showImg.php in EPractize Labs Subscription Manager, possibly 1.0, allows remote attackers to overwrite arbitrary files via the db parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/77505; http://seclists.org/fulldisclosure/2011/Dec/125; http://secunia.com/advisories/47072
CVE: CVE-2012-3325
Published: 2012-08-30
Description: IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.5, and 8.5.x Full Profile before 8.5.0.1, when the PM44303 fix is installed, does not properly validate credentials, which allows remote authenticated users to obtain administrative access via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/54971; http://secunia.com/advisories/55115; http://www-01.ibm.com/support/docview.wss?uid=swg1PM71296
CVE: CVE-2012-3548
Published: 2012-08-30
Description: The dissect_drda function in epan/dissectors/packet-drda.c in Wireshark 1.6.x through 1.6.10 and 1.8.x through 1.8.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a small value for a certain length field in a capture file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://openwall.com/lists/oss-security/2012/08/29/4; http://secunia.com/advisories/54425; http://www.gentoo.org/security/en/glsa/glsa-201308-05.xml
CVE: CVE-2012-0547
Published: 2012-08-30
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier, and 6 Update 34 and earlier, has no impact and remote attack vectors involving AWT and "a security-in-depth issue that is not directly exploitable but which can be used to aggravate security vulnerabilities that can be directly exploited." NOTE: this identifier was assigned by the Oracle CNA, but CVE is not intended to cover defense-in-depth issues that are only exposed by the presence of other vulnerabilities.  NOTE: Oracle has not commented on claims from a downstream vendor that this issue is related to "toolkit internals references."
CVSS Score: 0.0 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html
CVE: CVE-2012-1682
Published: 2012-08-30
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans, a different vulnerability than CVE-2012-3136.  NOTE: Oracle has not commented on claims from a downstream vendor that this issue is related to "XMLDecoder security issue via ClassFinder."
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html
CVE: CVE-2012-3136
Published: 2012-08-30
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans, a different vulnerability than CVE-2012-1682.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9176&w=2; http://rhn.redhat.com/errata/RHSA-2012-1225.html
CVE: CVE-2012-2186
Published: 2012-08-31
Description: Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action.
CVSS Score: 9.0 (HIGH)
References: http://downloads.asterisk.org/pub/security/AST-2012-012.html; http://secunia.com/advisories/50687; http://secunia.com/advisories/50756
CVE: CVE-2012-4008
Published: 2012-08-31
Description: The Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN23009798/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000081; http://magazine.cybozulive.com/2012/08/291200.html
CVE: CVE-2012-4009
Published: 2012-08-31
Description: The WebView class in the Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN77393797/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000082; http://magazine.cybozulive.com/2012/08/291200.html
CVE: CVE-2012-4170
Published: 2012-08-31
Description: Buffer overflow in Adobe Photoshop CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb12-20.html; http://www.securityfocus.com/bid/55333; http://www.securitytracker.com/id?1027477
CVE: CVE-2012-4600
Published: 2012-08-31
Description: Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.14, 3.0.x before 3.0.16, and 3.1.x before 3.1.10, when Firefox or Opera is used, allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with nested HTML tags.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/50615; http://www.kb.cert.org/vuls/id/511404; http://www.otrs.com/de/open-source/community-news/security-advisories/security-advisory-2012-02/
CVE: CVE-2012-4737
Published: 2012-08-31
Description: channels/chan_iax2.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert7, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 does not enforce ACL rules during certain uses of peer credentials, which allows remote authenticated users to bypass intended outbound-call restrictions by leveraging the availability of these credentials.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://downloads.asterisk.org/pub/security/AST-2012-013.html; http://secunia.com/advisories/50687; http://secunia.com/advisories/50756
CVE: CVE-2012-2657
Published: 2012-08-31
Description: Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2012/05/29/10; http://www.openwall.com/lists/oss-security/2012/05/29/7; http://www.openwall.com/lists/oss-security/2012/05/30/7
CVE: CVE-2012-2658
Published: 2012-08-31
Description: Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2012/05/29/10; http://www.openwall.com/lists/oss-security/2012/05/29/7; http://www.openwall.com/lists/oss-security/2012/05/30/7
CVE: CVE-2012-3378
Published: 2012-08-31
Description: The register_application function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in /tmp/at-spi2.
CVSS Score: 3.3 (LOW)
CWE: CWE-310
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=678026; http://www.openwall.com/lists/oss-security/2012/07/05/1; http://www.openwall.com/lists/oss-security/2012/07/06/3
CVE: CVE-2012-3379
Published: 2012-08-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-0808.  Reason: This candidate is a duplicate of CVE-2012-0808.  Notes: All CVE users should reference CVE-2012-0808 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-3380
Published: 2012-08-31
Description: Directory traversal vulnerability in naxsi-ui/nx_extract.py in the Naxsi module before 0.46-1 for Nginx allows local users to read arbitrary files via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-22
References: http://code.google.com/p/naxsi/; http://code.google.com/p/naxsi/source/detail?r=307; http://secunia.com/advisories/49811
CVE: CVE-2012-3478
Published: 2012-08-31
Description: rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-05/0036.html; http://archives.neohapsis.com/archives/bugtraq/2012-11/0101.html; http://secunia.com/advisories/50272
CVE: CVE-2012-4245
Published: 2012-08-31
Description: The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to execute arbitrary commands via the python-fu-eval command.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-862
References: http://archives.neohapsis.com/archives/bugtraq/2012-08/0106.html; http://www.openwall.com/lists/oss-security/2012/08/16/6; http://www.openwall.com/lists/oss-security/2012/08/17/2