deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-0878
Published: 2012-05-01
Description: Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-264
References: http://groups.google.com/group/paste-users/browse_thread/thread/2aa651ba331c2471; http://rhn.redhat.com/errata/RHSA-2012-1206.html; http://secunia.com/advisories/48812
CVE: CVE-2012-2162
Published: 2012-05-01
Description: The Web Server Plug-in in IBM WebSphere Application Server (WAS) 8.0 and earlier uses unencrypted HTTP communication after expiration of the plugin-key.kdb password, which allows remote attackers to obtain sensitive information by sniffing the network, or spoof arbitrary servers via a man-in-the-middle attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21588312; http://www-01.ibm.com/support/docview.wss?uid=swg21591172; https://exchange.xforce.ibmcloud.com/vulnerabilities/74900
CVE: CVE-2012-0279
Published: 2012-05-01
Description: Quest Toad for Data Analysts 3.0.1 uses weak permissions (Everyone: Full Control) for the %COMMONPROGRAMFILES%\Quest Shared directory, which allows local users to gain privileges via a Trojan horse file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/48663; http://secunia.com/secunia_research/2012-13/; http://www.securityfocus.com/bid/53276
CVE: CVE-2011-2578
Published: 2012-05-02
Description: Memory leak in Cisco IOS 15.1 and 15.2 allows remote attackers to cause a denial of service (memory consumption) via malformed SIP packets on a NAT interface, aka Bug ID CSCts12366.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151-4MCAVS.html; http://www.securitytracker.com/id?1027005; https://exchange.xforce.ibmcloud.com/vulnerabilities/75338
CVE: CVE-2011-2583
Published: 2012-05-02
Description: Cisco Unified Contact Center Express (aka CCX) 8.0 and 8.5 allows remote attackers to cause a denial of service via network traffic, as demonstrated by an SEC-BE-STABLE test case, aka Bug ID CSCth33834.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.cisco.com/en/US/docs/voice_ip_comm/cust_contact/contact_center/crs/express_8_5/release/guide/uccx851rn.pdf; http://www.securitytracker.com/id?1027009; https://exchange.xforce.ibmcloud.com/vulnerabilities/75339
CVE: CVE-2011-2586
Published: 2012-05-02
Description: The HTTP client in Cisco IOS 12.4 and 15.0 allows user-assisted remote attackers to cause a denial of service (device crash) via a malformed HTTP response to a request for service installation, aka Bug ID CSCts12249.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24436; http://www.securitytracker.com/id?1027005; http://tools.cisco.com/security/center/viewAlert.x?alertId=24436
CVE: CVE-2011-3283
Published: 2012-05-02
Description: Cisco Carrier Routing System 3.9.1 allows remote attackers to cause a denial of service (Metro subsystem crash) via a fragmented GRE packet, aka Bug ID CSCts14887.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.cisco.com/cisco/software/release.html?mdfid=280777815&softwareid=280867577&release=3.9.1; http://www.securitytracker.com/id?1027006; https://exchange.xforce.ibmcloud.com/vulnerabilities/75341
CVE: CVE-2011-3285
Published: 2012-05-02
Description: CRLF injection vulnerability in /+CSCOE+/logon.html on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.0 through 8.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors, aka Bug ID CSCth63101.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-94
References: http://www.cisco.com/web/software/280775065/37740/ASA-805-Interim-Release-Notes.html; http://www.securitytracker.com/id?1027008; https://exchange.xforce.ibmcloud.com/vulnerabilities/75343
CVE: CVE-2011-3289
Published: 2012-05-02
Description: Cisco IOS 12.4 and 15.0 through 15.2 allows physically proximate attackers to bypass the No Service Password-Recovery feature and read the start-up configuration via unspecified vectors, aka Bug ID CSCtr97640.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151-2TCAVS.html; http://www.securitytracker.com/id?1027005; http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151-2TCAVS.html
CVE: CVE-2011-3293
Published: 2012-05-02
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.2 allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences, aka Bug ID CSCtr78143.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/49101; http://www.cisco.com/web/software/282766937/37718/Acs-5-2-0-26-9-Readme.txt; http://www.securityfocus.com/bid/53436
CVE: CVE-2011-3295
Published: 2012-05-02
Description: The NETIO and IPV4_IO processes in Cisco IOS XR 3.8 through 4.1, as used in Cisco Carrier Routing System and other products, allow remote attackers to cause a denial of service (CPU consumption) via crafted network traffic, aka Bug ID CSCti59888.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www-europe.cisco.com/cisco/software/release.html?mdfid=279879106&reltype=all&relind=AVAILABLE&release=3.9.2&softwareid=280867577&sortparam=7; http://www.securitytracker.com/id?1027005; http://www.securitytracker.com/id?1027006
CVE: CVE-2011-3309
Published: 2012-05-02
Description: Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 through 8.4 process IKE requests despite a vpnclient mode configuration, which allows remote attackers to obtain potentially sensitive information by reading IKE responder traffic, aka Bug ID CSCtt07749.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.cisco.com/web/software/280775065/45357/ASA-825-Interim-Release-Notes.html; http://www.securitytracker.com/id?1027008; http://www.cisco.com/web/software/280775065/45357/ASA-825-Interim-Release-Notes.html
CVE: CVE-2011-3317
Published: 2012-05-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCtr78192.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49101; http://www.cisco.com/web/software/282766937/37718/Acs-5-2-0-26-9-Readme.txt; http://www.securityfocus.com/bid/53436
CVE: CVE-2011-4006
Published: 2012-05-02
Description: The ESMTP inspection feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 through 8.5 allows remote attackers to cause a denial of service (CPU consumption) via an unspecified closing sequence, aka Bug ID CSCtt32565.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.cisco.com/web/software/283878312/88166/ASA-851-Interim-Release-Notes.html; http://www.securitytracker.com/id?1027008; http://www.cisco.com/web/software/283878312/88166/ASA-851-Interim-Release-Notes.html
CVE: CVE-2011-4007
Published: 2012-05-02
Description: Cisco IOS 15.0 and 15.1 and IOS XE 3.x do not properly handle the "set mpls experimental imposition" command, which allows remote attackers to cause a denial of service (device crash) via network traffic that triggers (1) fragmentation or (2) reassembly, aka Bug ID CSCtr56576.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://www.cisco.com/en/US/docs/ios/ios_xe/3/release/notes/asr1k_caveats_33s.html; http://www.securitytracker.com/id?1027005; http://www.cisco.com/en/US/docs/ios/ios_xe/3/release/notes/asr1k_caveats_33s.html
CVE: CVE-2011-4012
Published: 2012-05-02
Description: Cisco IOS 12.0, 15.0, and 15.1, when a Policy Feature Card 3C (PFC3C) is used, does not create a fragment entry during processing of an ICMPv6 ACL, which has unspecified impact and remote attack vectors, aka Bug ID CSCtj90091.
CVSS Score: 9.3 (HIGH)
References: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/release/notes/caveats_SXJ.html; http://www.securitytracker.com/id?1027005; http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/release/notes/caveats_SXJ.html
CVE: CVE-2011-4014
Published: 2012-05-02
Description: The TAC Case Attachment tool in Cisco Wireless Control System (WCS) 7.0 allows remote authenticated users to read arbitrary files under webnms/Temp/ via unspecified vectors, aka Bug ID CSCtq86807.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.cisco.com/en/US/docs/wireless/wcs/release/notes/WCS_RN7_0_230.html; http://www.securitytracker.com/id?1027011; http://www.cisco.com/en/US/docs/wireless/wcs/release/notes/WCS_RN7_0_230.html
CVE: CVE-2011-4015
Published: 2012-05-02
Description: Cisco IOS 15.2S allows remote attackers to cause a denial of service (interface queue wedge) via malformed UDP traffic on port 465, aka Bug ID CSCts48300.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.cisco.com/en/US/docs/ios/15_2s/release/notes/15_2s_caveats_15_2_2s.html; http://www.securitytracker.com/id?1027005; http://www.cisco.com/en/US/docs/ios/15_2s/release/notes/15_2s_caveats_15_2_2s.html
CVE: CVE-2011-4016
Published: 2012-05-02
Description: The PPP implementation in Cisco IOS 12.2 and 15.0 through 15.2, when Point-to-Point Termination and Aggregation (PTA) and L2TP are used, allows remote attackers to cause a denial of service (device crash) via crafted network traffic, aka Bug ID CSCtf71673.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-284
References: http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151-2TCAVS.html; http://www.securitytracker.com/id?1027005; http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151-2TCAVS.html
CVE: CVE-2012-0333
Published: 2012-05-02
Description: Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www-europe.cisco.com/en/US/docs/voice_ip_comm/csbpipp/ip_phones/release/notes/spa525g_relnote_7_5_1.pdf; http://www.securitytracker.com/id?1027012; http://www-europe.cisco.com/en/US/docs/voice_ip_comm/csbpipp/ip_phones/release/notes/spa525g_relnote_7_5_1.pdf
CVE: CVE-2012-0335
Published: 2012-05-02
Description: Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.2 through 8.4 do not properly perform proxy authentication during attempts to cut through a firewall, which allows remote attackers to obtain sensitive information via a connection attempt, aka Bug ID CSCtx42746.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/49139; http://www.cisco.com/web/software/280775065/89203/ASA-843-Interim-Release-Notes.html; http://www.securityfocus.com/bid/53558
CVE: CVE-2012-0337
Published: 2012-05-02
Description: SQL injection vulnerability in the web component in Cisco Unified MeetingPlace 7.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtx08939.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.cisco.com/en/US/docs/voice_ip_comm/meetingplace/7_1/english/release_notes/mp71rn.html; http://www.cisco.com/en/US/docs/voice_ip_comm/meetingplace/7_1/english/release_notes/mp71rn.html
CVE: CVE-2012-0338
Published: 2012-05-02
Description: Cisco IOS 12.2 through 12.4 and 15.0 does not recognize the vrf-also keyword during enforcement of access-class commands, which allows remote attackers to establish SSH connections from arbitrary source IP addresses via a standard SSH client, aka Bug ID CSCsv86113.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/release/notes/caveats_SXH_rebuilds.html; http://www.securitytracker.com/id?1027005; https://supportforums.cisco.com/thread/2030226
CVE: CVE-2012-0339
Published: 2012-05-02
Description: Cisco IOS 12.2 through 12.4 and 15.0 does not recognize the vrf-also keyword during enforcement of access-class commands, which allows remote attackers to establish TELNET connections from arbitrary source IP addresses via a standard TELNET client, aka Bug ID CSCsi77774.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/release/notes/caveats_SXF_rebuilds.html; http://www.securitytracker.com/id?1027005; http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/release/notes/caveats_SXF_rebuilds.html
CVE: CVE-2012-0361
Published: 2012-05-02
Description: The sccp-protocol component in Cisco IP Communicator (CIPC) 7.0 through 8.6 does not limit the rate of SCCP messages to Cisco Unified Communications Manager (CUCM), which allows remote attackers to cause a denial of service via vectors that trigger (1) on hook and (2) off hook messages, as demonstrated by a Plantronics headset, aka Bug ID CSCti40315.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.cisco.com/en/US/docs/voice_ip_comm/cipc/8_5/english/release_notes/CIPC8x_RN.html; http://www.securitytracker.com/id?1027013; http://www.cisco.com/en/US/docs/voice_ip_comm/cipc/8_5/english/release_notes/CIPC8x_RN.html
CVE: CVE-2012-0362
Published: 2012-05-02
Description: The extended ACL functionality in Cisco IOS 12.2(58)SE2 and 15.0(1)SE discards all lines that end with a log or time keyword, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by sending network traffic, aka Bug ID CSCts01106.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://puck.nether.net/pipermail/cisco-nsp/2012-February/083517.html; http://www.securitytracker.com/id?1027005; http://puck.nether.net/pipermail/cisco-nsp/2012-February/083517.html
CVE: CVE-2012-2000
Published: 2012-05-02
Description: Multiple unspecified vulnerabilities in HP System Health Application and Command Line Utilities before 9.0.0 allow remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/81670; http://secunia.com/advisories/49051; http://www.securityfocus.com/archive/1/522549
CVE: CVE-2012-1819
Published: 2012-05-02
Description: Untrusted search path vulnerability in WellinTech KingView 6.53 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVSS Score: 9.3 (HIGH)
References: http://en.wellintech.com/news/detail.aspx?contentid=168; http://www.securityfocus.com/bid/53316; http://www.us-cert.gov/control_systems/pdf/ICSA-12-122-01.pdf
CVE: CVE-2012-2001
Published: 2012-05-02
Description: Cross-site scripting (XSS) vulnerability in HP SNMP Agents for Linux before 9.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/81696; http://secunia.com/advisories/48978; http://www.securityfocus.com/archive/1/522546
CVE: CVE-2012-2002
Published: 2012-05-02
Description: Open redirect vulnerability in HP SNMP Agents for Linux before 9.0.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20
References: http://osvdb.org/81697; http://secunia.com/advisories/48978; http://www.securityfocus.com/archive/1/522546
CVE: CVE-2012-2003
Published: 2012-05-02
Description: Cross-site request forgery (CSRF) vulnerability in HP Insight Management Agents before 9.0.0.0 on Windows Server 2003 and 2008 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/81666; http://secunia.com/advisories/49054; http://www.securityfocus.com/archive/1/522548
CVE: CVE-2012-2004
Published: 2012-05-02
Description: Open redirect vulnerability in HP Insight Management Agents before 9.0.0.0 on Windows Server 2003 and 2008 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20
References: http://osvdb.org/81667; http://secunia.com/advisories/49054; http://www.securityfocus.com/archive/1/522548
CVE: CVE-2012-2005
Published: 2012-05-02
Description: Cross-site scripting (XSS) vulnerability in HP Insight Management Agents before 9.0.0.0 on Windows Server 2003 and 2008 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/81668; http://secunia.com/advisories/49054; http://www.securityfocus.com/archive/1/522548
CVE: CVE-2012-2006
Published: 2012-05-02
Description: Unspecified vulnerability in HP Insight Management Agents before 9.0.0.0 on Windows Server 2003 and 2008 allows remote attackers to modify data or cause a denial of service via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/81669; http://secunia.com/advisories/49054; http://www.securityfocus.com/archive/1/522548
CVE: CVE-2012-0729
Published: 2012-05-03
Description: Unrestricted file upload vulnerability in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allows remote authenticated users to execute arbitrary ASP.NET code by uploading a .aspx file, and then accessing it via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/48967; http://secunia.com/advisories/48968; http://www.ibm.com/support/docview.wss?uid=swg21592188
CVE: CVE-2012-0730
Published: 2012-05-03
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allow remote attackers to hijack the authentication of administrators for requests that create administrative accounts.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/48967; http://secunia.com/advisories/48968; http://www.ibm.com/support/docview.wss?uid=swg21592188
CVE: CVE-2012-0731
Published: 2012-05-03
Description: IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not prevent service-account impersonation, which allows remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/48967; http://secunia.com/advisories/48968; http://www.ibm.com/support/docview.wss?uid=swg21592188
CVE: CVE-2012-0732
Published: 2012-05-03
Description: The Enterprise Console client in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/48967; http://secunia.com/advisories/48968; http://www.ibm.com/support/docview.wss?uid=swg21592188
CVE: CVE-2012-0733
Published: 2012-05-03
Description: IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1, when Integrated Windows authentication is used, allows remote authenticated users to obtain administrative privileges by hijacking a session associated with the service account.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/48967; http://secunia.com/advisories/48968; http://www.ibm.com/support/docview.wss?uid=swg21592188
CVE: CVE-2012-0734
Published: 2012-05-03
Description: IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly import jobs, which allows man-in-the-middle attackers to obtain sensitive information or possibly have unspecified other impact via a crafted job.
CVSS Score: 7.6 (HIGH)
References: http://secunia.com/advisories/48967; http://secunia.com/advisories/48968; http://www.ibm.com/support/docview.wss?uid=swg21592188
CVE: CVE-2012-0735
Published: 2012-05-03
Description: IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly scan file: URLs, which allows man-in-the-middle attackers to obtain sensitive information or possibly have unspecified other impact via a crafted URI.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/48967; http://secunia.com/advisories/48968; http://www.ibm.com/support/docview.wss?uid=swg21592188
CVE: CVE-2012-0736
Published: 2012-05-03
Description: IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly create scan jobs, which allows remote attackers to execute arbitrary code via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/48967; http://secunia.com/advisories/48968; http://www.ibm.com/support/docview.wss?uid=swg21592188
CVE: CVE-2012-0737
Published: 2012-05-03
Description: Cross-site scripting (XSS) vulnerability in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/48967; http://secunia.com/advisories/48968; http://www.ibm.com/support/docview.wss?uid=swg21592188
CVE: CVE-2012-1190
Published: 2012-05-03
Description: Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html
CVE: CVE-2011-4019
Published: 2012-05-03
Description: Memory leak in Cisco IOS 12.4 and 15.0 through 15.2, and Cisco Unified Communications Manager (CUCM) 7.x, allows remote attackers to cause a denial of service (memory consumption) via a crafted response to a SIP SUBSCRIBE message, aka Bug IDs CSCto93837 and CSCtj61883.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-399
References: http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151TCAVS.html; http://www.cisco.com/web/software/282074295/90289/cucm-readme-715bsu5.pdf; http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151TCAVS.html
CVE: CVE-2011-4022
Published: 2012-05-03
Description: The sensor in Cisco Intrusion Prevention System (IPS) 7.0 and 7.1 allows remote attackers to cause a denial of service (file-handle exhaustion and mainApp hang) by making authentication attempts that exceed the configured limit, aka Bug ID CSCto51204.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www.cisco.com/web/software/282549709/56954/IPS-7-1-3-E4_readme.txt; http://www.cisco.com/web/software/282549709/56954/IPS-7-1-3-E4_readme.txt
CVE: CVE-2011-4023
Published: 2012-05-03
Description: Memory leak in libcmd in Cisco NX-OS 5.0 on Nexus switches allows remote authenticated users to cause a denial of service (memory consumption) via SNMP requests, aka Bug ID CSCtr65682.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/release/notes/Rel_5_0_3_N2_1/Nexus5000_Release_Notes_5_0_3_N2.html; http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/release/notes/Rel_5_0_3_N2_1/Nexus5000_Release_Notes_5_0_3_N2.html
CVE: CVE-2011-4231
Published: 2012-05-03
Description: Cisco IOS 15.1 and 15.2 and IOS XE 3.x, when configured as an IPsec hub with X.509 certificates in use, allows remote authenticated users to cause a denial of service (segmentation fault and device crash) via unspecified vectors, aka Bug ID CSCtq61128.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151-4MCAVS.html; http://www.cisco.com/en/US/docs/ios/ios_xe/3/release/notes/asr1k_caveats_34s.html; http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151-4MCAVS.html