deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-3994
Published: 2012-10-10
Description: Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to conduct cross-site scripting (XSS) attacks via a binary plugin that uses Object.defineProperty to shadow the top object, and leverages the relationship between top.location and the location property.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86110; http://rhn.redhat.com/errata/RHSA-2012-1351.html
CVE: CVE-2012-3995
Published: 2012-10-10
Description: The IsCSSWordSpacingSpace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://rhn.redhat.com/errata/RHSA-2012-1351.html; http://secunia.com/advisories/50856
CVE: CVE-2012-4179
Published: 2012-10-10
Description: Use-after-free vulnerability in the nsHTMLCSSUtils::CreateCSSPropertyTxn function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://rhn.redhat.com/errata/RHSA-2012-1351.html; http://secunia.com/advisories/50856
CVE: CVE-2012-4180
Published: 2012-10-10
Description: Heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86099; http://rhn.redhat.com/errata/RHSA-2012-1351.html
CVE: CVE-2012-4181
Published: 2012-10-10
Description: Use-after-free vulnerability in the nsSMILAnimationController::DoSample function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86100; http://rhn.redhat.com/errata/RHSA-2012-1351.html
CVE: CVE-2012-4182
Published: 2012-10-10
Description: Use-after-free vulnerability in the nsTextEditRules::WillInsert function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://rhn.redhat.com/errata/RHSA-2012-1351.html; http://secunia.com/advisories/50856
CVE: CVE-2012-4183
Published: 2012-10-10
Description: Use-after-free vulnerability in the DOMSVGTests::GetRequiredFeatures function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86095; http://rhn.redhat.com/errata/RHSA-2012-1351.html
CVE: CVE-2012-4184
Published: 2012-10-10
Description: The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not prevent access to properties of a prototype for a standard class, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86113; http://rhn.redhat.com/errata/RHSA-2012-1351.html
CVE: CVE-2012-4185
Published: 2012-10-10
Description: Buffer overflow in the nsCharTraits::length function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86116; http://rhn.redhat.com/errata/RHSA-2012-1351.html
CVE: CVE-2012-4186
Published: 2012-10-10
Description: Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86117; http://rhn.redhat.com/errata/RHSA-2012-1351.html
CVE: CVE-2012-4187
Published: 2012-10-10
Description: Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly manage a certain insPos variable, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and assertion failure) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://rhn.redhat.com/errata/RHSA-2012-1351.html; http://secunia.com/advisories/50856
CVE: CVE-2012-4188
Published: 2012-10-10
Description: Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html; http://osvdb.org/86096; http://rhn.redhat.com/errata/RHSA-2012-1351.html
CVE: CVE-2012-5354
Published: 2012-10-10
Description: Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly handle navigation away from a web page that has multiple menus of SELECT elements active, which allows remote attackers to conduct clickjacking attacks via vectors involving an XPI file, the window.open method, and the Geolocation API, a different vulnerability than CVE-2012-3984.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/86171; http://secunia.com/advisories/50856; http://secunia.com/advisories/50935
CVE: CVE-2009-5067
Published: 2012-10-10
Description: Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. (dot dot) in the "include file" SSI directive.  NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a user-assisted attacker provides filenames whose contents could cause a denial of service, such as certain devices.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=548633; http://packetstormsecurity.org/files/81614/html2ps-1.0-beta5-File-Disclosure.html; http://user.it.uu.se/~jan/html2ps-1.0b7.tar.gz
CVE: CVE-2012-3040
Published: 2012-10-10
Description: Cross-site scripting (XSS) vulnerability in the web server on Siemens SIMATIC S7-1200 PLCs 2.x through 3.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://en.securitylab.ru/lab/PT-2012-50; http://osvdb.org/86130; http://secunia.com/advisories/50816
CVE: CVE-2012-3504
Published: 2012-10-10
Description: The nssconfigFound function in genkey.pl in crypto-utils 2.4.1-34 allows local users to overwrite arbitrary files via a symlink attack on the "list" file in the current working directory.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2012/10/02/3; http://www.securityfocus.com/bid/55756; https://bugzilla.redhat.com/show_bug.cgi?id=849256
CVE: CVE-2012-4430
Published: 2012-10-10
Description: The dump_resource function in dird/dird_conf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/50535; http://secunia.com/advisories/50808; http://sourceforge.net/projects/bacula/files/bacula/5.2.12/ReleaseNotes/view
CVE: CVE-2012-4445
Published: 2012-10-10
Description: Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in the EAP authentication server in hostapd 0.6 through 1.0 allows remote attackers to cause a denial of service (crash or abort) via a small "TLS Message Length" value in an EAP-TLS message with the "More Fragments" flag set.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/86051; http://secunia.com/advisories/50805; http://secunia.com/advisories/50888
CVE: CVE-2012-4454
Published: 2012-10-10
Description: openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp.
CVSS Score: 2.9 (LOW)
CWE: CWE-264
References: http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=58345488c9351d9be9a4be27c8b407c2706a33a9; http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=b7fcb3eb[PII_REDACTED]f1f4fb90ede4edd6487c30; http://secunia.com/advisories/50702
CVE: CVE-2012-4455
Published: 2012-10-10
Description: openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) LCK..opencryptoki or (2) LCK..opencryptoki_stdll file in /var/lock/.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-59
References: http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=5667edb52cd27b7e512f48f823b4bcc6b872ab15; http://secunia.com/advisories/50702; http://sourceforge.net/mailarchive/message.php?msg_id=29191022
CVE: CVE-2012-4463
Published: 2012-10-10
Description: Midnight Commander (mc) 4.8.5 does not properly handle the (1) MC_EXT_SELECTED or (2) MC_EXT_ONLYTAGGED environment variables when multiple files are selected, which allows user-assisted remote attackers to execute arbitrary commands via a crafted file name.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2012/10/03/4; http://www.openwall.com/lists/oss-security/2012/10/03/5; http://www.securityfocus.com/bid/55777
CVE: CVE-2012-4465
Published: 2012-10-10
Description: Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the "Author" field in a commit.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://git.zx2c4.com/cgit/commit/?id=7757d1b046ecb67b830151d20715c658867df1ec; http://hjemli.net/pipermail/cgit/2012-July/000652.html; http://secunia.com/advisories/50734
CVE: CVE-2012-4899
Published: 2012-10-10
Description: WellinTech KingView 6.5.3 and earlier uses a weak password-hashing algorithm, which makes it easier for local users to discover credentials by reading an unspecified file.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-283-02.pdf; http://www.wellintech.com/index.php/news/33-patch-for-kingview653; http://www.us-cert.gov/control_systems/pdf/ICSA-12-283-02.pdf
CVE: CVE-2012-5355
Published: 2012-10-10
Description: welcome.py in xdiagnose before 2.5.2ubuntu0.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://osvdb.org/85882; http://secunia.com/advisories/50854; http://www.ubuntu.com/usn/USN-1591-1
CVE: CVE-2012-5356
Published: 2012-10-10
Description: The apt-add-repository tool in Ubuntu Software Properties 0.75.x before 0.75.10.3, 0.80.x before 0.80.9.2, 0.81.x before 0.81.13.5, 0.82.x before 0.82.7.3, and 0.92.x before 0.92.8 does not properly check PPA GPG keys imported from a keyserver, which allows remote attackers to install arbitrary package repository GPG keys via a man-in-the-middle (MITM) attack.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/55736; http://www.ubuntu.com/usn/USN-1588-1; https://bugs.launchpad.net/ubuntu/+source/software-properties/+bug/1016643
CVE: CVE-2012-2286
Published: 2012-10-10
Description: Unspecified vulnerability in EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 before SP3 P3 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 2.9 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2012-10/0036.html; http://www.securityfocus.com/bid/55842; http://archives.neohapsis.com/archives/bugtraq/2012-10/0036.html
CVE: CVE-2012-4467
Published: 2012-10-10
Description: The (1) do_siocgstamp and (2) do_siocgstampns functions in net/socket.c in the Linux kernel before 3.5.4 use an incorrect argument order, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a crafted ioctl call.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ed6fe9d614fc1bca95eb8c0ccd0e92db00ef9d5d; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.4; http://www.openwall.com/lists/oss-security/2012/10/04/2
CVE: CVE-2012-5166
Published: 2012-10-10
Description: ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://aix.software.ibm.com/aix/efixes/security/bind9_advisory5.asc; http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090346.html
CVE: CVE-2012-5112
Published: 2012-10-11
Description: Use-after-free vulnerability in the SVG implementation in WebKit, as used in Google Chrome before 22.0.1229.94, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0012.html; http://archives.neohapsis.com/archives/bugtraq/2012-11/0013.html; http://blog.chromium.org/2012/10/pwnium-2-results-and-wrap-up_10.html
CVE: CVE-2012-5376
Published: 2012-10-11
Description: The Inter-process Communication (IPC) implementation in Google Chrome before 22.0.1229.94 allows remote attackers to bypass intended sandbox restrictions and write to arbitrary files by leveraging access to a renderer process, a different vulnerability than CVE-2012-5112.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-269
References: http://blog.chromium.org/2012/10/pwnium-2-results-and-wrap-up_10.html; http://code.google.com/p/chromium/issues/detail?id=154983; http://code.google.com/p/chromium/issues/detail?id=154987
CVE: CVE-2012-5377
Published: 2012-10-11
Description: Untrusted search path vulnerability in the installation functionality in ActivePerl 5.16.1.1601, when installed in the top-level C:\ directory, allows local users to gain privileges via a Trojan horse DLL in the C:\Perl\Site\bin directory, which is added to the PATH system environment variable, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview.
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/86177; https://www.htbridge.com/advisory/HTB23108; http://osvdb.org/86177
CVE: CVE-2012-5378
Published: 2012-10-11
Description: Untrusted search path vulnerability in the installation functionality in ActiveTcl 8.5.12, when installed in the top-level C:\ directory, allows local users to gain privileges via a Trojan horse DLL in the C:\TD\bin directory, which is added to the PATH system environment variable, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview.
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/86179; https://www.htbridge.com/advisory/HTB23108; http://osvdb.org/86179
CVE: CVE-2012-5379
Published: 2012-10-11
Description: Untrusted search path vulnerability in the installation functionality in ActivePython 3.2.2.3, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Python27 or C:\Python27\Scripts directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview.  NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the ActivePython installation
CVSS Score: 7.3 (HIGH)
References: https://www.htbridge.com/advisory/HTB23108; https://www.htbridge.com/advisory/HTB23108
CVE: CVE-2012-5380
Published: 2012-10-11
Description: Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Ruby193\bin directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview.  NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the Ruby installation
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-22
References: https://www.htbridge.com/advisory/HTB23108; https://www.htbridge.com/advisory/HTB23108
CVE: CVE-2012-5381
Published: 2012-10-11
Description: Untrusted search path vulnerability in the installation functionality in PHP 5.3.17, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\PHP directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview.  NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the PHP installation
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/86172; https://www.htbridge.com/advisory/HTB23108; http://osvdb.org/86172
CVE: CVE-2012-5382
Published: 2012-10-11
Description: Untrusted search path vulnerability in the installation functionality in Zend Server 5.6.0 SP4, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Zend\ZendServer\share\ZendFramework\bin directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the choice of C:\ (and the resulting unsafe PATH) is established by an administrative action that is not a default part of the Zend Server installation
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/86174; https://www.htbridge.com/advisory/HTB23108; http://osvdb.org/86174
CVE: CVE-2012-5383
Published: 2012-10-11
Description: Untrusted search path vulnerability in the installation functionality in Oracle MySQL 5.5.28, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the "C:\MySQL\MySQL Server 5.5\bin" directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the MySQL installation
CVSS Score: 6.2 (MEDIUM)
References: http://osvdb.org/86175; https://www.htbridge.com/advisory/HTB23108; http://osvdb.org/86175
CVE: CVE-2012-5384
Published: 2012-10-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in Craig Knudsen WebCalendar allow remote attackers to inject arbitrary web script or HTML via the (1) $name or (2) $description variables in edit_entry_handler.php, or (3) $url, (4) $tempfullname, or (5) $ext_users[] variables in view_entry.php, different vectors than CVE-2012-0846.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://sourceforge.net/projects/webcalendar/files/webcalendar%201.2/1.2.5/README.txt/download; http://sourceforge.net/tracker/?func=detail&aid=3488543&group_id=3870&atid=303870; http://sourceforge.net/projects/webcalendar/files/webcalendar%201.2/1.2.5/README.txt/download
CVE: CVE-2012-5385
Published: 2012-10-11
Description: install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://webcalendar.cvs.sourceforge.net/viewvc/webcalendar/webcalendar/ChangeLog?pathrev=REL_1_2; http://webcalendar.cvs.sourceforge.net/viewvc/webcalendar/webcalendar/ChangeLog?pathrev=REL_1_2
CVE: CVE-2012-5386
Published: 2012-10-11
Description: Directory traversal vulnerability in index.php in phpPaleo 4.8b180 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phppaleo4_lang cookie, a different vulnerability than CVE-2012-1671.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/48398; http://secunia.com/advisories/48398