deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-4879
Published: 2012-02-03
Description: miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime does not properly handle URIs beginning with a 0xfa character, which allows remote attackers to read data from arbitrary memory locations or cause a denial of service (application crash) via a crafted POST request.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://aluigi.org/adv/winccflex_1-adv.txt; http://www.exploit-db.com/exploits/18166; http://www.osvdb.org/77384
CVE: CVE-2010-4559
Published: 2012-02-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-4670, CVE-2010-4671. Reason: This candidate is a duplicate of CVE-2010-4670 and CVE-2010-4671. Notes: All CVE users should reference CVE-2010-4670 and/or CVE-2010-4671 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-4560
Published: 2012-02-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-4669. Reason: This candidate is a duplicate of CVE-2010-4669. Notes: All CVE users should reference CVE-2010-4669 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-4872
Published: 2012-02-05
Description: Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0002.html; http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html; http://secunia.com/advisories/47837
CVE: CVE-2011-4041
Published: 2012-02-06
Description: webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long string in an RPC request to TCP port 4592.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://reversemode.com/index.php?option=com_content&task=view&id=72&Itemid=1; http://www.reversemode.com/downloads/Scada_Trojans_Ruben_Rootedcon.pdf; http://www.reversemode.com/downloads/exploit_advantech.zip
CVE: CVE-2012-0194
Published: 2012-02-06
Description: The TCP implementation in IBM AIX 5.3, 6.1, and 7.1, when the Large Send Offload option is enabled, allows remote attackers to cause a denial of service (assertion failure and panic) via an unspecified series of packets.
CVSS Score: 7.1 (HIGH)
References: http://aix.software.ibm.com/aix/efixes/security/large_send_advisory.asc; http://secunia.com/advisories/47865; http://securitytracker.com/id?1026640
CVE: CVE-2012-0290
Published: 2012-02-06
Description: Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Altiris Client Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), and Altiris Deployment Solution Remote pcAnywhere Solution 7.1 (aka 12.5.x and 12.6.x) do not properly handle the client state after abnormal termination of a remote session, which allows remote attackers to obtain access to the client by leveraging an "open client session."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/48092; http://www.securityfocus.com/bid/51862; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120124_00
CVE: CVE-2012-0396
Published: 2012-02-06
Description: EMC Documentum xPlore 1.0, 1.1 before P07, and 1.2 does not properly enforce the requirement for BROWSE permission, which allows remote authenticated users to determine the existence of an object, or read object metadata, via a search.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0020.html; http://secunia.com/advisories/47920; http://securitytracker.com/id?1026639
CVE: CVE-2012-0830
Published: 2012-02-06
Description: The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041; http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html
CVE: CVE-2012-1003
Published: 2012-02-07
Description: Multiple integer overflows in Opera 11.60 and earlier allow remote attackers to cause a denial of service (application crash) via a large integer argument to the (1) Int32Array, (2) Float32Array, (3) Float64Array, (4) Uint32Array, (5) Int16Array, or (6) ArrayBuffer function.  NOTE: the vendor reportedly characterizes this as "a stability issue, not a security issue."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://blog.vulnhunt.com/index.php/2012/02/02/cal-2012-0004-opera-array-integer-overflow/; https://exchange.xforce.ibmcloud.com/vulnerabilities/73027; http://blog.vulnhunt.com/index.php/2012/02/02/cal-2012-0004-opera-array-integer-overflow/
CVE: CVE-2012-1006
Published: 2012-02-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secpod.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt; http://secpod.org/blog/?p=450; http://www.securityfocus.com/bid/51902
CVE: CVE-2012-1007
Published: 2012-02-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secpod.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt; http://secpod.org/blog/?p=450; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2012-0990
Published: 2012-02-07
Description: Cross-site request forgery (CSRF) vulnerability in admin/settings/update in DClassifieds 0.1 final allows remote attackers to hijack the authentication of administrators for requests that modify account settings such as the administrator password or email via certain Settings[] parameters.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0158.html; http://secunia.com/advisories/47691; http://sourceforge.net/projects/dclassifieds/files/csrf_fix_120105.rar/download
CVE: CVE-2012-0991
Published: 2012-02-07
Description: Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in interface/patient_file/encounter.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0004.html; http://osvdb.org/78727; http://osvdb.org/78728
CVE: CVE-2012-0992
Published: 2012-02-07
Description: interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0004.html; http://osvdb.org/78731; http://secunia.com/advisories/47781
CVE: CVE-2012-1005
Published: 2012-02-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sphinx Software Mobile Web Server 3.1.2.47 allow remote attackers to inject arbitrary web script or HTML via the comment parameter to a blog, as demonstrated using (1) Blog/MyFirstBlog.txt or (2) Blog/AboutSomething.txt.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secpod.org/blog/?p=453; http://secunia.com/advisories/47876; http://www.securityfocus.com/bid/51820
CVE: CVE-2012-1010
Published: 2012-02-07
Description: Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html; http://secunia.com/advisories/47659; http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog/
CVE: CVE-2012-1011
Published: 2012-02-07
Description: actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html; http://secunia.com/advisories/47659; http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog/
CVE: CVE-2011-5076
Published: 2012-02-08
Description: SQL injection vulnerability in model/comment.class.php in HDWiki 5.0, 5.1, and possibly other versions allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bbs.wolvez.org/viewtopic.php?id=208; http://secunia.com/advisories/47907; http://www.securityfocus.com/bid/51871
CVE: CVE-2011-5077
Published: 2012-02-08
Description: Unrestricted file upload vulnerability in attachement.php in HDWiki 5.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in image directory.
CVSS Score: 7.5 (HIGH)
References: http://bbs.wolvez.org/viewtopic.php?id=208; http://bbs.wolvez.org/viewtopic.php?id=208
CVE: CVE-2012-1017
Published: 2012-02-08
Description: Multiple SQL injection vulnerabilities in base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbitrary SQL commands via the (1) ip_addr[0][1], (2) ip_addr[0][2], or (3) ip_addr[0][9] parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/47857; http://www.exploit-db.com/exploits/18465; http://www.securityfocus.com/bid/51874
CVE: CVE-2012-1018
Published: 2012-02-08
Description: Cross-site scripting (XSS) vulnerability in includes/convert.php in D-Mack Media Currency Converter (mod_currencyconverter) module 1.0.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the from parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dl.packetstormsecurity.net/1202-exploits/joomlacurrencyconverter-xss.txt; http://www.securityfocus.com/bid/51804; https://exchange.xforce.ibmcloud.com/vulnerabilities/72917
CVE: CVE-2012-1019
Published: 2012-02-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in XWiki Enterprise 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) XWiki.XWikiComments_comment parameter to xwiki/bin/commentadd/Main/WebHome, (2) XWiki.XWikiUsers_0_company parameter when editing a user profile, or (3) projectVersion parameter to xwiki/bin/view/DownloadCode/DownloadFeedback.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/109447/XWiki-Enterprise-3.4-Cross-Site-Scripting.html; http://secunia.com/advisories/47885; http://st2tea.blogspot.com/2012/02/xwiki-cross-site-scripting.html
CVE: CVE-2012-1020
Published: 2012-02-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in login.php in NexorONE Online Banking allow remote attackers to inject arbitrary web script or HTML via the (1) visitor_language parameter to register.php or (2) message parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1072&w=2; http://secunia.com/advisories/47897; http://www.securityfocus.com/bid/51876
CVE: CVE-2012-1021
Published: 2012-02-08
Description: Cross-site scripting (XSS) vulnerability in admin/categories.php in 4images 1.7.10 allows remote attackers to inject arbitrary web script or HTML via the cat_parent_id parameter in an addcat action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/78711; http://packetstormsecurity.org/files/109290/4images-xss.txt; http://secunia.com/advisories/47811
CVE: CVE-2012-1022
Published: 2012-02-08
Description: SQL injection vulnerability in admin/categories.php in 4images 1.7.10 remote attackers to execute arbitrary SQL commands via the cat_parent_id parameter in an addcat action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/109290/4images-xss.txt; http://www.securityfocus.com/bid/51774; https://exchange.xforce.ibmcloud.com/vulnerabilities/72932
CVE: CVE-2012-1023
Published: 2012-02-08
Description: Open redirect vulnerability in admin/index.php in 4images 1.7.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/78779; http://packetstormsecurity.org/files/109290/4images-xss.txt; http://www.securityfocus.com/bid/51774
CVE: CVE-2012-1024
Published: 2012-02-08
Description: Directory traversal vulnerability in file in Enigma2 Webinterface 1.5rc1 and 1.5beta4 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/18343; https://exchange.xforce.ibmcloud.com/vulnerabilities/73109; http://www.exploit-db.com/exploits/18343
CVE: CVE-2012-1025
Published: 2012-02-08
Description: Absolute path traversal vulnerability in file in Enigma2 Webinterface 1.6.0 through 1.6.8, 1.6rc3, and 1.7.0 allows remote attackers to read arbitrary files via a full pathname in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/18343; http://www.exploit-db.com/exploits/18343
CVE: CVE-2012-1026
Published: 2012-02-08
Description: Multiple SQL injection vulnerabilities in login2.php in XRay CMS 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0068.html; http://sourceforge.net/tracker/?func=detail&aid=3488241&group_id=298778&atid=1260461; http://www.exploit-db.com/exploits/18467
CVE: CVE-2012-1027
Published: 2012-02-08
Description: Cross-site scripting (XSS) vulnerability in account-closed.tcl in ]project-open[ (aka ]po[) 3.4.x, 3.5.0.1-2, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the message parameter to register/account-closed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dl.packetstormsecurity.net/1202-exploits/projectopen-xss.txt; http://osvdb.org/78823; http://secunia.com/advisories/47854
CVE: CVE-2012-1028
Published: 2012-02-08
Description: Cross-site scripting (XSS) vulnerability in bin/index.php in SimpleGroupware 0.742 and other versions before 0.743 allows remote attackers to inject arbitrary web script or HTML via the export parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0028.html; http://voxel.dl.sourceforge.net/project/simplgroup/README.md; http://www.securityfocus.com/bid/51882
CVE: CVE-2012-1029
Published: 2012-02-08
Description: SQL injection vulnerability in mobile/search/index.php in Tube Ace (Adult PHP Tube Script) 1.6 allows remote attackers to execute arbitrary SQL commands via the q parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/78900; http://packetstormsecurity.org/files/109485/Tube-Ace-SQL-Injection.html; http://secunia.com/advisories/47874
CVE: CVE-2012-1002
Published: 2012-02-08
Description: SQL injection vulnerability in author/edit.php in OpenConf 4.x before 4.12 allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVSS Score: 10.0 (HIGH)
References: http://www.exploit-db.com/exploits/18820; http://www.openconf.com/news/#20120202; http://www.securityfocus.com/bid/51927
CVE: CVE-2012-1004
Published: 2012-02-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in UI/Register.pm in Foswiki before 1.1.5 allow remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via the (1) text, (2) FirstName, (3) LastName, (4) OrganisationName, (5) OrganisationUrl, (6) Profession, (7) Country, (8) State, (9) Address, (10) Location, (11) Telephone, (12) VoIP, (13) InstantMessagingIM, (14) Email, (15) HomePage, or (16) Comment parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://foswiki.org/Support/SecurityAlert-CVE-2012-1004; http://foswiki.org/Tasks/Item11498; http://foswiki.org/Tasks/Item11501
CVE: CVE-2012-1008
Published: 2012-02-08
Description: OfficeSIP Server 3.1 allows remote attackers to cause a denial of service (daemon crash) via a crafted To header in a SIP INVITE message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secpod.org/advisories/SecPod_Exploit_OfficeSIP_Server_DOS_Vuln.txt; http://secpod.org/blog/?p=461; http://secpod.org/exploits/SecPod_Exploit_OfficeSIP_Server_DOS.py
CVE: CVE-2012-1031
Published: 2012-02-08
Description: Unspecified vulnerability in EPiServer CMS 5 and 6 through 6R2, in certain configurations using Forms Authentication, allows remote authenticated users to obtain WebAdmins access by leveraging Edit Mode privileges, a different vulnerability than CVE-2011-3416 and CVE-2011-3417.
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/47910; http://world.episerver.com/Blogs/Jens-N/Dates/2012/1/Security-vulnerability---Elevation-of-privilege/; http://world.episerver.com/Blogs/Shahid-Nawaz/Dates/2012/1/General-Hotfix-CMS-6-R2/
CVE: CVE-2012-1034
Published: 2012-02-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in the admin interface in EPiServer CMS through 6R2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/47910; http://world.episerver.com/Blogs/Shahid-Nawaz/Dates/2012/1/General-Hotfix-CMS-6-R2/; http://world.episerver.com/PageFiles/110367/BugList.txt
CVE: CVE-2012-0922
Published: 2012-02-08
Description: rvrender.dll in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via crafted flags in an RMFF file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/78911; http://secunia.com/advisories/47896; http://service.real.com/realplayer/security/02062012_player/en/
CVE: CVE-2012-0923
Published: 2012-02-08
Description: The RV20 codec in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, does not properly handle the frame size array, which allows remote attackers to execute arbitrary code via a crafted RV20 RealVideo video stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/78912; http://secunia.com/advisories/47896; http://service.real.com/realplayer/security/02062012_player/en/
CVE: CVE-2012-0924
Published: 2012-02-08
Description: RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via vectors involving a VIDOBJ_START_CODE code in a header within a video stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/47896; http://service.real.com/realplayer/security/02062012_player/en/; http://secunia.com/advisories/47896
CVE: CVE-2012-0925
Published: 2012-02-08
Description: Unspecified vulnerability in the RV40 codec in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via a crafted RV40 RealVideo video stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/78914; http://secunia.com/advisories/47896; http://service.real.com/realplayer/security/02062012_player/en/
CVE: CVE-2012-0926
Published: 2012-02-08
Description: The RV10 codec in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, does not properly handle height and width values, which allows remote attackers to execute arbitrary code via a crafted RV10 RealVideo video stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/47896; http://service.real.com/realplayer/security/02062012_player/en/; http://secunia.com/advisories/47896
CVE: CVE-2012-0927
Published: 2012-02-08
Description: Unspecified vulnerability in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via vectors involving the coded_frame_size value in a RealAudio audio stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/47896; http://service.real.com/realplayer/security/02062012_player/en/; http://secunia.com/advisories/47896
CVE: CVE-2012-0928
Published: 2012-02-08
Description: The ATRAC codec in RealNetworks RealPlayer 11.x and 14.x through 14.0.7, RealPlayer SP 1.0 through 1.1.5, and Mac RealPlayer 12.x before 12.0.0.1703 does not properly decode samples, which allows remote attackers to execute arbitrary code via a crafted ATRAC audio file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://service.real.com/realplayer/security/02062012_player/en/; http://service.real.com/realplayer/security/02062012_player/en/
CVE: CVE-2012-0839
Published: 2012-02-08
Description: OCaml 3.12.1 and earlier computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://openwall.com/lists/oss-security/2012/02/07/1; http://openwall.com/lists/oss-security/2012/02/07/2; http://secunia.com/advisories/47853
CVE: CVE-2012-1033
Published: 2012-02-08
Description: The resolver in ISC BIND 9 through 9.8.1-P1 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9878&w=2; http://osvdb.org/78916; http://rhn.redhat.com/errata/RHSA-2012-0717.html