deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-5265
Published: 2012-09-07
Description: Untrusted search path vulnerability in SmartSniff 1.71 allows local users to gain privileges via a Trojan horse wpcap.dll file in the current working directory, as demonstrated by a directory that contains a .cfg or .ssp file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://packetstormsecurity.org/1009-exploits/smartsniff-dllhijack.txt; http://secunia.com/advisories/41580; http://packetstormsecurity.org/1009-exploits/smartsniff-dllhijack.txt
CVE: CVE-2010-5266
Published: 2012-09-07
Description: Untrusted search path vulnerability in VideoCharge Studio 2.9.0.632 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .vsc file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://packetstormsecurity.org/1009-exploits/videocharge-dllhijack.txt; http://secunia.com/advisories/41581; http://packetstormsecurity.org/1009-exploits/videocharge-dllhijack.txt
CVE: CVE-2010-5267
Published: 2012-09-07
Description: Untrusted search path vulnerability in MunSoft Easy Office Recovery 1.1 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .doc, .xls, or .ppt file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://packetstormsecurity.org/1009-exploits/seasyofficerecovery-dllhijack.txt; http://secunia.com/advisories/41584; http://packetstormsecurity.org/1009-exploits/seasyofficerecovery-dllhijack.txt
CVE: CVE-2010-5268
Published: 2012-09-07
Description: Untrusted search path vulnerability in Amazon Kindle for PC 1.3.0 30884 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current working directory, as demonstrated by a directory that contains a .azw file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/42476; http://www.coresecurity.com/content/amazon-kindle-for-pc-wintab32-dll-hijacking-exploit-10-5; http://secunia.com/advisories/42476
CVE: CVE-2010-5269
Published: 2012-09-07
Description: Untrusted search path vulnerability in tbb.dll in Intel Threading Building Blocks (TBB) 2.2.013 allows local users to gain privileges via a Trojan horse tbbmalloc.dll file in the current working directory, as demonstrated by a directory that contains a .pbk file. NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/42506; http://www.coresecurity.com/content/adobe-pixel-bender-toolkit-tbbmalloc-dll-hijacking-exploit-10-5; http://secunia.com/advisories/42506
CVE: CVE-2010-5270
Published: 2012-09-07
Description: Multiple untrusted search path vulnerabilities in Adobe Device Central CS4 2.0.0 0476 allow local users to gain privileges via a Trojan horse (1) ibfs32.dll or (2) amt_cdb.dll file in the current working directory, as demonstrated by a directory that contains a .adcp file. NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/42525; http://www.coresecurity.com/content/adobe-device-central-cs4-ibfs32-dll-hijacking-exploit-10-5; http://secunia.com/advisories/42525
CVE: CVE-2010-5271
Published: 2012-09-07
Description: Untrusted search path vulnerability in Altova MapForce 2011 Enterprise Edition SP1 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .mfd file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/42548; http://www.coresecurity.com/content/altova-mapforce-2011-enterprise-edition-dwmapi-dll-hijacking-exploit-10-5; http://secunia.com/advisories/42548
CVE: CVE-2010-5272
Published: 2012-09-07
Description: Untrusted search path vulnerability in Altova DatabaseSpy 2011 Enterprise Edition SP1 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .qprj file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/42548; http://www.coresecurity.com/content/altova-databasespy-2011-dwmapi-dll-hijacking-exploit-10-5; http://secunia.com/advisories/42548
CVE: CVE-2010-5273
Published: 2012-09-07
Description: Untrusted search path vulnerability in Altova DiffDog 2011 Enterprise Edition SP1 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .dbdif file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/42548; http://www.coresecurity.com/content/altova-diffdog-2011-dwmapi-dll-hijacking-exploit-10-5; http://secunia.com/advisories/42548
CVE: CVE-2010-5274
Published: 2012-09-07
Description: Untrusted search path vulnerability in PKZIP before 12.50.0014 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .zip file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/41103; http://web.archive.org/web/[PII_REDACTED]0807/http://www.pkware.com/support/desktop/updates/; http://secunia.com/advisories/41103
CVE: CVE-2011-5158
Published: 2012-09-07
Description: Multiple untrusted search path vulnerabilities in the DMTGUI2.EXE and DvInesLogFileViewer.Exe components in DATEV Grundpaket Basis CD23.20 allow local users to gain privileges via a Trojan horse (1) DVBSKNLANG101.dll or (2) DvZediTermSrvInfo004.dll file in the current working directory, as demonstrated by a directory that contains a .dmt, .adl, .c02, .dof, or .jrf file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-426
References: http://secunia.com/advisories/42940; http://sotiriu.de/adv/NSOADV-2010-010.txt; http://secunia.com/advisories/42940
CVE: CVE-2012-4880
Published: 2012-09-07
Description: Multiple untrusted search path vulnerabilities in DVD Architect Pro 5.2 Build 133 and DVD Architect Studio 5.0 Build 156 allow local users to gain privileges via a Trojan horse (1) enc_mp2v.200 or (2) CFHDDecoder.dll file in the current working directory, as demonstrated by a directory that contains a .dar file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/47282; http://secunia.com/advisories/47282
CVE: CVE-2012-4881
Published: 2012-09-07
Description: Untrusted search path vulnerability in moviEZ HD 1.0 Build 2554-29894-A allows local users to gain privileges via a Trojan horse avrt.dll file in the current working directory, as demonstrated by a directory that contains a .mvz file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/47284; http://secunia.com/advisories/47284
CVE: CVE-2012-4882
Published: 2012-09-07
Description: Multiple untrusted search path vulnerabilities in 3D XML Player 6.212.13.12076 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) JT0DevPhase.dll file in the current working directory, as demonstrated by a directory that contains a .3dx file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/48923; http://secunia.com/advisories/48923
CVE: CVE-2012-4883
Published: 2012-09-07
Description: Multiple untrusted search path vulnerabilities in 3DVIA Composer V6R2012 HF1 Build 6.8.1.1652 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) ibfs32.dll file in the current working directory, as demonstrated by a directory that contains a .smg file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/48924; http://secunia.com/advisories/48924
CVE: CVE-2012-4388
Published: 2012-09-07
Description: The sapi_header_op function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1398.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://article.gmane.org/gmane.comp.php.devel/70584; http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.html; http://openwall.com/lists/oss-security/2012/08/29/5
CVE: CVE-2012-0254
Published: 2012-09-08
Description: Stack-based buffer overflow in the HMIWeb Browser HSCDSPRenderDLL ActiveX control in Honeywell Process Solutions (HPS) Experion R2xx, R30x, R31x, and R400.x; Honeywell Building Solutions (HBS) Enterprise Building Manager R400 and R410.1; and Honeywell Environmental Combustion and Controls (ECC) SymmetrE R410.1 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-150-01.pdf; https://www.honeywellprocess.com/en-US/support/pages/all-notifications.aspx; http://www.us-cert.gov/control_systems/pdf/ICSA-12-150-01.pdf
CVE: CVE-2012-1666
Published: 2012-09-08
Description: Untrusted search path vulnerability in VMware Tools in VMware Workstation before 8.0.4, VMware Player before 4.0.4, VMware Fusion before 4.1.2, VMware View before 5.1, and VMware ESX 4.1 before U3 and 5.0 before P03 allows local users to gain privileges via a Trojan horse tpfc.dll file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2012-09/0013.html; https://www.vmware.com/support/vsphere4/doc/vsp_esxi41_u3_rel_notes.html#resolvedissuessecurity; http://archives.neohapsis.com/archives/bugtraq/2012-09/0013.html
CVE: CVE-2012-3004
Published: 2012-09-08
Description: Multiple untrusted search path vulnerabilities in RealFlex RealWin before 2.1.13, FlexView before 3.1.86, and RealWinDemo before 2.1.13 allow local users to gain privileges via a Trojan horse (1) realwin.dll or (2) keyhook.dll file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-251-01.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-251-01.pdf
CVE: CVE-2012-3255
Published: 2012-09-08
Description: Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 8.07 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03475750; http://osvdb.org/85250; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03475750
CVE: CVE-2012-3256
Published: 2012-09-08
Description: Cross-site request forgery (CSRF) vulnerability in HP Business Availability Center (BAC) 8.07 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03475750; http://osvdb.org/85251; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03475750
CVE: CVE-2012-3257
Published: 2012-09-08
Description: HP Business Availability Center (BAC) 8.07 allows remote authenticated users to hijack web sessions via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03475750; http://osvdb.org/85252; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03475750
CVE: CVE-2012-4011
Published: 2012-09-08
Description: The Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://cs.cybozu.co.jp/information/20120910up01.php; http://jvn.jp/en/jp/JVN23568423/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000083
CVE: CVE-2012-4012
Published: 2012-09-08
Description: The WebView class in the Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://cs.cybozu.co.jp/information/20120910up02.php; http://jvn.jp/en/jp/JVN59652356/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000084
CVE: CVE-2011-4942
Published: 2012-09-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/configuration.php in Geeklog before 1.7.1sr1 allow remote attackers to inject arbitrary web script or HTML via the (1) subgroup or (2) conf_group parameters.  NOTE: this vulnerability might require a user-assisted attack or a bypass of a CSRF protection mechanism.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/42775; http://www.geeklog.net/article.php/geeklog-1.7.1sr1; http://www.openwall.com/lists/oss-security/2011/03/18/8
CVE: CVE-2011-5159
Published: 2012-09-09
Description: Cross-site scripting (XSS) vulnerability in admin/configuration.php in Geeklog before 1.7.1sr1 allows remote attackers to inject arbitrary web script or HTML via the sub_group parameter, a different vulnerability than CVE-2011-4942.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/42775; http://www.geeklog.net/article.php/geeklog-1.7.1sr1; http://www.osvdb.org/70245
CVE: CVE-2011-5160
Published: 2012-09-09
Description: Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/18274; https://exchange.xforce.ibmcloud.com/vulnerabilities/71982; http://www.exploit-db.com/exploits/18274
CVE: CVE-2011-5161
Published: 2012-09-09
Description: Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the patient directory under documents/.
CVSS Score: 6.8 (MEDIUM)
References: http://www.exploit-db.com/exploits/18274; https://exchange.xforce.ibmcloud.com/vulnerabilities/71981; http://www.exploit-db.com/exploits/18274
CVE: CVE-2012-1151
Published: 2012-09-09
Description: Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a denial of service (process crash) via format string specifiers in (1) a crafted database warning to the pg_warn function or (2) a crafted DBD statement to the dbd_st_prepare function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-134
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661536; http://cpansearch.perl.org/src/TURNSTEP/DBD-Pg-2.19.1/Changes; http://rhn.redhat.com/errata/RHSA-2012-1116.html
CVE: CVE-2012-1152
Published: 2012-09-09
Description: Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and perl-YAML-LibYAML) module 0.38 for Perl allow remote attackers to cause a denial of service (process crash) via format string specifiers in a (1) YAML stream to the Load function, (2) YAML node to the load_node function, (3) YAML mapping to the load_mapping function, or (4) YAML sequence to the load_sequence function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-134
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661548; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077004.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077023.html
CVE: CVE-2012-1578
Published: 2012-09-09
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or (2) unblock a user via a request to the Unblock module.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.html; http://osvdb.org/80361
CVE: CVE-2012-1579
Published: 2012-09-09
Description: The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.html; http://secunia.com/advisories/48504
CVE: CVE-2012-1580
Published: 2012-09-09
Description: Cross-site request forgery (CSRF) vulnerability in Special:Upload in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to hijack the authentication of unspecified victims for requests that upload files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.html; http://osvdb.org/80364
CVE: CVE-2012-1581
Published: 2012-09-09
Description: MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.html; http://secunia.com/advisories/48504
CVE: CVE-2012-1582
Published: 2012-09-09
Description: Cross-site scripting (XSS) vulnerability in the wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to inject arbitrary web script or HTML via a crafted page with "forged strip item markers," as demonstrated using the CharInsert extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.html; http://osvdb.org/80363
CVE: CVE-2012-1648
Published: 2012-09-09
Description: Cross-site scripting (XSS) vulnerability in the Cool Aid module before 6.x-1.9 for Drupal allows remote authenticated users with the administer coolaid permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1417186; http://drupal.org/node/1461438; http://osvdb.org/79712
CVE: CVE-2012-1649
Published: 2012-09-09
Description: Cool Aid module before 6.x-1.9 for Drupal does not enforce access restrictions, which allows remote authenticated users with the administer coolaid permission to modify arbitrary pages via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1417186; http://drupal.org/node/1461438; http://secunia.com/advisories/48196
CVE: CVE-2012-1911
Published: 2012-09-09
Description: Multiple SQL injection vulnerabilities in PHP Address Book 6.2.12 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) to_group parameter to group.php or (2) id parameter to vcard.php.  NOTE: the edit.php vector is already covered by CVE-2008-2565.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://sourceforge.net/tracker/?func=detail&aid=3496653&group_id=157964&atid=805929; http://sourceforge.net/tracker/?func=detail&aid=3501716&group_id=157964&atid=805929; http://www.darksecurity.de/advisories/2012/SSCHADV2012-007.txt
CVE: CVE-2012-1912
Published: 2012-09-09
Description: Cross-site scripting (XSS) vulnerability in preferences.php in PHP Address Book 7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the from parameter.  NOTE: the index.php vector is already covered by CVE-2008-2566.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/42781; http://secunia.com/advisories/49212; http://sourceforge.net/tracker/?func=detail&aid=3496653&group_id=157964&atid=805929
CVE: CVE-2012-2115
Published: 2012-09-09
Description: SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0013.html; http://seclists.org/fulldisclosure/2012/Jan/27; http://www.exploit-db.com/exploits/18274
CVE: CVE-2012-2315
Published: 2012-09-09
Description: admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authenticated users to assign administrator privileges to arbitrary users via the userEdit action.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0007.html; http://archives.neohapsis.com/archives/bugtraq/2012-01/0021.html; http://osvdb.org/78105
CVE: CVE-2012-2316
Published: 2012-09-09
Description: Cross-site request forgery (CSRF) vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7 and other versions before 5.1.8-2 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary code via the script parameter to admin/scripting.jsp.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0008.html; http://openkm.svn.sourceforge.net/viewvc/openkm?view=revision&revision=7406; http://secunia.com/advisories/47420
CVE: CVE-2012-4885
Published: 2012-09-09
Description: The wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to cause a denial of service (infinite loop) via certain input, as demonstrated by the padleft function.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.html; http://secunia.com/advisories/48504
CVE: CVE-2012-0714
Published: 2012-09-10
Description: Cross-site request forgery (CSRF) vulnerability in IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/85179; http://secunia.com/advisories/50551; http://www-01.ibm.com/support/docview.wss?uid=swg1IV16085