deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-1879
Published: 2012-06-12
Description: Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access an undefined memory location, aka "insertAdjacentText Remote Code Execution Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-94, CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15588
CVE: CVE-2012-1880
Published: 2012-06-12
Description: Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "insertRow Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14975
CVE: CVE-2012-1881
Published: 2012-06-12
Description: Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnRowsInserted Event Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-164A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15378
CVE: CVE-2012-1882
Published: 2012-06-12
Description: Microsoft Internet Explorer 6 through 9 does not block cross-domain scrolling events, which allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Scrolling Events Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15367; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-037
CVE: CVE-2012-1889
Published: 2012-06-13
Description: Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://technet.microsoft.com/security/advisory/2719615; http://www.us-cert.gov/cas/techalerts/TA12-174A.html; http://www.us-cert.gov/cas/techalerts/TA12-192A.html
CVE: CVE-2012-2041
Published: 2012-06-13
Description: CRLF injection vulnerability in the Component Browser in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://www.adobe.com/support/security/bulletins/apsb12-15.html; http://www.adobe.com/support/security/bulletins/apsb12-15.html
CVE: CVE-2011-1759
Published: 2012-06-13
Description: Integer overflow in the sys_oabi_semtimedop function in arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 2.6.39 on the ARM platform, when CONFIG_OABI_COMPAT is enabled, allows local users to gain privileges or cause a denial of service (heap memory corruption) by providing a crafted argument and leveraging a race condition.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-189
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0f22072ab50cac7983f9660d33974b45184da4f9; http://www.openwall.com/lists/oss-security/2011/05/02/16
CVE: CVE-2011-1767
Published: 2012-06-13
Description: net/ipv4/ip_gre.c in the Linux kernel before 2.6.34, when ip_gre is configured as a module, allows remote attackers to cause a denial of service (OOPS) by sending a packet during module loading.
CVSS Score: 5.4 (MEDIUM)
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c2892f02712e9516d72841d5c019ed[PII_REDACTED]; http://www.openwall.com/lists/oss-security/2011/05/05/6
CVE: CVE-2011-1768
Published: 2012-06-13
Description: The tunnels implementation in the Linux kernel before 2.6.34, when tunnel functionality is configured as a module, allows remote attackers to cause a denial of service (OOPS) by sending a packet during module loading.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-362
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d5aa407f59f5b83d2c50ec88f5bf56d40f1f8978; http://www.openwall.com/lists/oss-security/2011/05/05/6
CVE: CVE-2011-1927
Published: 2012-06-13
Description: The ip_expire function in net/ipv4/ip_fragment.c in the Linux kernel before 2.6.39 does not properly construct ICMP_TIME_EXCEEDED packets after a timeout, which allows remote attackers to cause a denial of service (invalid pointer dereference) via crafted fragmented packets.
CVSS Score: 5.0 (MEDIUM)
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=64f3b9e203bd06855072e295557dca1485a2ecba; http://www.openwall.com/lists/oss-security/2011/05/18/2
CVE: CVE-2011-2182
Published: 2012-06-13
Description: The ldm_frag_add function in fs/partitions/ldm.c in the Linux kernel before 2.6.39.1 does not properly handle memory allocation for non-initial fragments, which might allow local users to conduct buffer overflow attacks, and gain privileges or obtain sensitive information, via a crafted LDM partition table.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1017.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.1; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=cae13fe4cc3f24820ffb990c[PII_REDACTED]7e85d4; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6211&w=2
CVE: CVE-2011-2183
Published: 2012-06-13
Description: Race condition in the scan_get_next_rmap_item function in mm/ksm.c in the Linux kernel before 2.6.39.3, when Kernel SamePage Merging (KSM) is enabled, allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted application.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-362
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.3; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2b472611a32a72f4a118c069c2d62a1a3f087afd; http://www.openwall.com/lists/oss-security/2011/06/06/1
CVE: CVE-2011-2208
Published: 2012-06-13
Description: Integer signedness error in the osf_getdomainname function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform allows local users to obtain sensitive information from kernel memory via a crafted call.
CVSS Score: 2.1 (LOW)
CWE: CWE-189
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.4; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=21c5977a836e399fc710ff2c5367845ed5c2527f; http://www.openwall.com/lists/oss-security/2011/06/15/7
CVE: CVE-2011-2209
Published: 2012-06-13
Description: Integer signedness error in the osf_sysinfo function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform allows local users to obtain sensitive information from kernel memory via a crafted call.
CVSS Score: 2.1 (LOW)
CWE: CWE-189
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.4; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=21c5977a836e399fc710ff2c5367845ed5c2527f; http://www.openwall.com/lists/oss-security/2011/06/15/7
CVE: CVE-2011-2210
Published: 2012-06-13
Description: The osf_getsysinfo function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform does not properly restrict the data size for GSI_GET_HWRPB operations, which allows local users to obtain sensitive information from kernel memory via a crafted call.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.4; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=21c5977a836e399fc710ff2c5367845ed5c2527f; http://www.openwall.com/lists/oss-security/2011/06/15/7
CVE: CVE-2011-2211
Published: 2012-06-13
Description: The osf_wait4 function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform uses an incorrect pointer, which allows local users to gain privileges by writing a certain integer value to kernel memory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.4; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=21c5977a836e399fc710ff2c5367845ed5c2527f; http://www.openwall.com/lists/oss-security/2011/06/15/7
CVE: CVE-2011-2493
Published: 2012-06-13
Description: The ext4_fill_super function in fs/ext4/super.c in the Linux kernel before 2.6.39 does not properly initialize a certain error-report data structure, which allows local users to cause a denial of service (OOPS) by attempting to mount a crafted ext4 filesystem.
CVSS Score: 2.1 (LOW)
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=[PII_REDACTED]f5652b344ef6fa39fa019d7e94660a; http://www.openwall.com/lists/oss-security/2011/06/24/4
CVE: CVE-2011-2494
Published: 2012-06-13
Description: kernel/taskstats.c in the Linux kernel before 3.1 allows local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another user's password.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1a51410abe7d0ee4b1d112780f46df87d3621043; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00021.html; http://secunia.com/advisories/48898
CVE: CVE-2011-2495
Published: 2012-06-13
Description: fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc/#####/io files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by discovering the length of another user's password.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.4; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1d1221f375c94ef961ba8574ac4f85c8870ddd51; http://rhn.redhat.com/errata/RHSA-2011-1212.html
CVE: CVE-2011-2496
Published: 2012-06-13
Description: Integer overflow in the vma_to_resize function in mm/mremap.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (BUG_ON and system crash) via a crafted mremap system call that expands a memory mapping.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=982134ba62618c2d69fbbbd166d0a11ee3b7e3d8; http://www.openwall.com/lists/oss-security/2011/06/27/2
CVE: CVE-2012-2313
Published: 2012-06-13
Description: The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call.
CVSS Score: 1.2 (LOW)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1bb57e940e1958e40d51f2078f50c3a96a9b2d75; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6211&w=2
CVE: CVE-2012-2375
Published: 2012-06-13
Description: The __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words in an FATTR4_ACL reply.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-4131.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=20e0fa98b751facf9a1101edaefbc19c82616a68; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6211&w=2; http://rhn.redhat.com/errata/RHSA-2012-1580.html
CVE: CVE-2012-2383
Published: 2012-06-13
Description: Integer overflow in the i915_gem_execbuffer2 function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ed8cd3b2cd61004cab85380c52b1817aca1ca49b; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6211&w=2; http://rhn.redhat.com/errata/RHSA-2012-1156.html
CVE: CVE-2012-2384
Published: 2012-06-13
Description: Integer overflow in the i915_gem_do_execbuffer function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=44afb3a04391a74309d16180d1e4f8386fdfa745; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6211&w=2; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.5
CVE: CVE-2012-2390
Published: 2012-06-13
Description: Memory leak in mm/hugetlb.c in the Linux kernel before 3.4.2 allows local users to cause a denial of service (memory consumption or system crash) via invalid MAP_HUGETLB mmap operations.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c50ac050811d6485616a193eb0f37bfbd191cc89; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.2; http://www.openwall.com/lists/oss-security/2012/05/23/14
CVE: CVE-2012-1820
Published: 2012-06-13
Description: The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message.
CVSS Score: 2.9 (LOW)
References: http://rhn.redhat.com/errata/RHSA-2012-1259.html; http://secunia.com/advisories/50941; http://www.debian.org/security/2012/dsa-2497
CVE: CVE-2012-2604
Published: 2012-06-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in GuestAccess.jsp in the Guest/Contractor access component in the administrative interface in Bradford Network Sentry before 5.3.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified fields.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/709939; http://www.kb.cert.org/vuls/id/MAPG-8TJKAF; https://na3.salesforce.com/sfc/#version?selectedDocumentId=[PII_REDACTED]0IyBX
CVE: CVE-2012-2605
Published: 2012-06-13
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface in Bradford Network Sentry before 5.3.3 allow remote attackers to hijack the authentication of administrators for requests that (1) insert XSS sequences or (2) send messages to clients.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/709939; http://www.kb.cert.org/vuls/id/MAPG-8TJKAF; https://na3.salesforce.com/sfc/#version?selectedDocumentId=[PII_REDACTED]0IySO
CVE: CVE-2012-2606
Published: 2012-06-13
Description: The agent in Bradford Network Sentry before 5.3.3 does not require authentication for messages, which allows remote attackers to trigger the display of arbitrary text on a workstation via a crafted packet to UDP port 4567, as demonstrated by a replay attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/709939; http://www.kb.cert.org/vuls/id/MAPG-8TJKAF; https://na3.salesforce.com/sfc/#version?id=[PII_REDACTED]0JDx3
CVE: CVE-2012-1827
Published: 2012-06-13
Description: The web service in AutoFORM PDM Archive before 7.1 does not have authorization requirements, which allows remote authenticated users to perform database operations via a SOAP request, as demonstrated by the initializeQueryDatabase2 request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/49335; http://www.kb.cert.org/vuls/id/773035; http://www.kb.cert.org/vuls/id/MAPG-8RQL83
CVE: CVE-2012-1828
Published: 2012-06-13
Description: The administrative functions in AutoFORM PDM Archive before 7.1 do not have authorization requirements, which allows remote authenticated users to perform administrative actions by leveraging knowledge of a hidden function, as demonstrated by the password-change function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/49335; http://www.kb.cert.org/vuls/id/773035; http://www.kb.cert.org/vuls/id/MAPG-8RQL83
CVE: CVE-2012-1829
Published: 2012-06-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in AutoFORM PDM Archive before 6.920 allow remote authenticated users to inject arbitrary web script or HTML via unspecified fields.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/49335; http://www.kb.cert.org/vuls/id/773035; http://www.kb.cert.org/vuls/id/MAPG-8RQL83
CVE: CVE-2012-3287
Published: 2012-06-13
Description: Poul-Henning Kamp md5crypt has insufficient algorithmic complexity and a consequently short runtime, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack, as demonstrated by an attack using GPU hardware.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://phk.freebsd.dk/sagas/md5crypt_eol.html; https://phk.freebsd.dk/sagas/md5crypt_eol/; http://phk.freebsd.dk/sagas/md5crypt_eol.html
CVE: CVE-2012-3347
Published: 2012-06-13
Description: AutoFORM PDM Archive before 7.0 implements user accounts in a way that allows for JMX Console authentication, which allows remote authenticated users to bypass intended access restrictions via the /jmx-console URI, and then upload and execute arbitrary JSP code via a JBoss remote-deployment mechanism, a different vulnerability than CVE-2012-1828.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/49335; http://www.kb.cert.org/vuls/id/773035; http://www.kb.cert.org/vuls/id/MAPG-8RQL83
CVE: CVE-2011-2545
Published: 2012-06-13
Description: Cross-site scripting (XSS) vulnerability in the SIP implementation on the Cisco SPA8000 and SPA8800 before 6.1.11, SPA2102 and SPA3102 before 5.2.13, and SPA 500 series IP phones before 7.4.9 allows remote attackers to inject arbitrary web script or HTML via the FROM field of an INVITE message, aka Bug IDs CSCtr27277, CSCtr27256, CSCtr27274, and CSCtr14715.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=26037; http://tools.cisco.com/security/center/viewAlert.x?alertId=26037
CVE: CVE-2012-2011
Published: 2012-06-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in HP Web Jetadmin 8.x allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03331603; http://www.securitytracker.com/id?1027138; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03331603
CVE: CVE-2012-3555
Published: 2012-06-14
Description: Opera before 11.65 does not ensure that keyboard sequences are associated with a visible window, which makes it easier for user-assisted remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary code via a crafted web site, related to a "hidden keyboard navigation" issue.
CVSS Score: 7.6 (HIGH)
References: http://www.opera.com/docs/changelogs/mac/1165/; http://www.opera.com/docs/changelogs/mac/1200/; http://www.opera.com/docs/changelogs/unix/1200/
CVE: CVE-2012-3556
Published: 2012-06-14
Description: Opera before 11.65 does not properly restrict the opening of a pop-up window in response to the first click of a double-click action, which makes it easier for user-assisted remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary code via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.opera.com/docs/changelogs/mac/1165/; http://www.opera.com/docs/changelogs/mac/1200/; http://www.opera.com/docs/changelogs/unix/1200/
CVE: CVE-2012-3557
Published: 2012-06-14
Description: Opera before 11.65 does not properly restrict the reading of JSON strings, which allows remote attackers to perform cross-domain loading of JSON resources and consequently obtain sensitive information via a crafted web site.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.opera.com/docs/changelogs/mac/1165/; http://www.opera.com/docs/changelogs/mac/1200/; http://www.opera.com/docs/changelogs/unix/1200/
CVE: CVE-2012-3558
Published: 2012-06-14
Description: Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during unusually timed changes to this field, which makes it easier for user-assisted remote attackers to conduct spoofing attacks via vectors involving navigation, reloads, and redirects.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://www.opera.com/docs/changelogs/mac/1165/; http://www.opera.com/docs/changelogs/mac/1200/; http://www.opera.com/docs/changelogs/unix/1200/
CVE: CVE-2012-3559
Published: 2012-06-14
Description: Unspecified vulnerability in Opera before 12.00 on Mac OS X has unknown impact and attack vectors, related to a "moderate severity issue."
CVSS Score: 10.0 (HIGH)
References: http://www.opera.com/docs/changelogs/mac/1200/; http://www.opera.com/docs/changelogs/mac/1200/
CVE: CVE-2012-3560
Published: 2012-06-14
Description: Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during blocked navigation, which makes it easier for remote attackers to conduct spoofing attacks by detecting and preventing attempts to load a different web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://blog.vulnhunt.com/index.php/2012/06/14/cal-2012-0015-opera-website-spoof/; http://www.opera.com/docs/changelogs/mac/1165/; http://www.opera.com/docs/changelogs/mac/1200/
CVE: CVE-2012-3561
Published: 2012-06-14
Description: Opera before 11.64 does not properly allocate memory for URL strings, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted string.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/81809; http://www.opera.com/docs/changelogs/mac/1164/; http://www.opera.com/docs/changelogs/unix/1164/
CVE: CVE-2012-3562
Published: 2012-06-14
Description: Opera before 12.00 Beta allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web page that is not properly handled during a reload, as demonstrated by a "multiple origin camera test" page.
CVSS Score: 4.3 (MEDIUM)
References: http://www.opera.com/docs/changelogs/windows/1200b/; https://exchange.xforce.ibmcloud.com/vulnerabilities/76357; http://www.opera.com/docs/changelogs/windows/1200b/