deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-1397
Published: 2012-03-13
Description: Cross-site request forgery (CSRF) vulnerability in the Labor Reporting page in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/48299; http://secunia.com/advisories/48305; http://www-01.ibm.com/support/docview.wss?uid=swg1IV09193
CVE: CVE-2011-4816
Published: 2012-03-13
Description: SQL injection vulnerability in the KPI component in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/48299; http://secunia.com/advisories/48305; http://www-01.ibm.com/support/docview.wss?uid=swg1IV09194
CVE: CVE-2011-4817
Published: 2012-03-13
Description: The About option on the Help menu in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 shows the username, which might allow remote authenticated users to have an unspecified impact via a targeted attack against the corresponding user account.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/48299; http://secunia.com/advisories/48305; http://www-01.ibm.com/support/docview.wss?uid=swg1IV09197
CVE: CVE-2011-4818
Published: 2012-03-13
Description: Open redirect vulnerability in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the uisessionid parameter to an unspecified component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/48299; http://www-01.ibm.com/support/docview.wss?uid=swg1IV09200; http://www.ibm.com/support/docview.wss?uid=swg21584666
CVE: CVE-2011-4819
Published: 2012-03-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allow remote attackers to inject arbitrary web script or HTML via the uisesionid parameter to (1) maximo.jsp or (2) the default URI under ui/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48299; http://www-01.ibm.com/support/docview.wss?uid=swg1IV09202; http://www.ibm.com/support/docview.wss?uid=swg21584666
CVE: CVE-2012-0195
Published: 2012-03-13
Description: Cross-site scripting (XSS) vulnerability in the Start Center Layout and Configuration component in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allows remote attackers to inject arbitrary web script or HTML via the display name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48299; http://secunia.com/advisories/48305; http://www-01.ibm.com/support/docview.wss?uid=swg1IV09198
CVE: CVE-2012-0884
Published: 2012-03-13
Description: The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack (MMA) adaptive chosen ciphertext attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077086.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077221.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077666.html
CVE: CVE-2012-1472
Published: 2012-03-13
Description: VMware vCenter Chargeback Manager (aka CBM) before 2.0.1 does not properly handle XML API requests, which allows remote attackers to read arbitrary files or cause a denial of service via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://www.vmware.com/security/advisories/VMSA-2012-0002.html; http://www.vmware.com/security/advisories/VMSA-2012-0002.html
CVE: CVE-2012-0687
Published: 2012-03-13
Description: TIBCO ActiveMatrix Runtime Platform in Service Grid and Service Bus 2.x before 2.3.2 and BusinessWorks Service Engine before 5.8.2; TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution 3.1.3, Service Grid and Service Bus 3.x before 3.1.5, BusinessWorks Service Engine 5.9.x before 5.9.3, and BPM before 1.3.0; TIBCO BusinessEvents Runtime in Enterprise and Inference Editions 3.x before 3.0.3, Standard Edition 4.x before 4.0.2, and Standard Edition and Express 5.0.0; and TIBCO BusinessWorks Engine in TIBCO Silver Fabric ActiveMatrix BusinessWorks Distribution 5.9.2 and ActiveMatrix BusinessWorks before 5.9.3 allow remote attackers to obtain sensitive information via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.tibco.com/multimedia/activematrix2_advisory_20120308_tcm8-15726.txt; http://www.tibco.com/multimedia/activematrix3_advisory_20120308_tcm8-15728.txt; http://www.tibco.com/multimedia/businessevents_advisory_20120308_tcm8-15729.txt
CVE: CVE-2012-0688
Published: 2012-03-13
Description: Cross-site scripting (XSS) vulnerability in TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution 3.1.3, Service Grid and Service Bus 3.x before 3.1.5, BusinessWorks Service Engine 5.9.x before 5.9.3, and BPM before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.tibco.com/multimedia/activematrix3_advisory_20120308_tcm8-15728.txt; http://www.tibco.com/services/support/advisories/amx-be-spotfire-advisory_20120308.jsp; http://www.tibco.com/multimedia/activematrix3_advisory_20120308_tcm8-15728.txt
CVE: CVE-2012-0689
Published: 2012-03-13
Description: The server in TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution 3.1.3, Service Grid and Service Bus 3.x before 3.1.5, BusinessWorks Service Engine 5.9.x before 5.9.3, and BPM before 1.3.0 allows remote attackers to discover credentials via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.tibco.com/multimedia/activematrix3_advisory_20120308_tcm8-15728.txt; http://www.tibco.com/services/support/advisories/amx-be-spotfire-advisory_20120308.jsp; http://www.tibco.com/multimedia/activematrix3_advisory_20120308_tcm8-15728.txt
CVE: CVE-2012-0690
Published: 2012-03-13
Description: TIBCO Spotfire Web Application, Web Player Application, Automation Services Application, and Analytics Client Application in Spotfire Analytics Server before 10.1.2; Server before 3.3.3; and Web Player, Automation Services, and Professional before 4.0.2 allow remote attackers to obtain sensitive information via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.tibco.com/multimedia/spotfire_advisory_20120308_tcm8-15731.txt; http://www.tibco.com/services/support/advisories/amx-be-spotfire-advisory_20120308.jsp; http://www.tibco.com/multimedia/spotfire_advisory_20120308_tcm8-15731.txt
CVE: CVE-2012-1098
Published: 2012-03-13
Description: Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://groups.google.com/group/rubyonrails-security/msg/1c2e01a5e42722c9?dmode=source&output=gplain; http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075675.html; http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released
CVE: CVE-2012-1099
Published: 2012-03-13
Description: Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://groups.google.com/group/rubyonrails-security/msg/6fca4f5c47705488?dmode=source&output=gplain; http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075675.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075740.html
CVE: CVE-2012-0002
Published: 2012-03-13
Description: The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly process packets in memory, which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to an object that (1) was not properly initialized or (2) is deleted, aka "Remote Desktop Protocol Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://blogs.quickheal.com/remote-desktop-protocol-vulnerability-cve-2012-0002-not-dead-yet/; http://www.securitytracker.com/id?1026790; http://www.us-cert.gov/cas/techalerts/TA12-073A.html
CVE: CVE-2012-0006
Published: 2012-03-13
Description: The DNS server in Microsoft Windows Server 2003 SP2 and Server 2008 SP2, R2, and R2 SP1 does not properly handle objects in memory during record lookup, which allows remote attackers to cause a denial of service (daemon restart) via a crafted query, aka "DNS Denial of Service Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/80005; http://secunia.com/advisories/48394; http://www.securityfocus.com/bid/52374
CVE: CVE-2012-0008
Published: 2012-03-13
Description: Untrusted search path vulnerability in Microsoft Visual Studio 2008 SP1, 2010, and 2010 SP1 allows local users to gain privileges via a Trojan horse add-in in an unspecified directory, aka "Visual Studio Add-In Vulnerability."
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/48396; http://www.securityfocus.com/bid/52329; http://www.securitytracker.com/id?1026792
CVE: CVE-2012-0016
Published: 2012-03-13
Description: Untrusted search path vulnerability in Microsoft Expression Design; Expression Design SP1; and Expression Design 2, 3, and 4 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .xpr or .DESIGN file, aka "Expression Design Insecure Library Loading Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.us-cert.gov/cas/techalerts/TA12-073A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-022; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14973
CVE: CVE-2012-0152
Published: 2012-03-13
Description: The Remote Desktop Protocol (RDP) service in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to cause a denial of service (application hang) via a series of crafted packets, aka "Terminal Server Denial of Service Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/52354; http://www.securitytracker.com/id?1026790; http://www.us-cert.gov/cas/techalerts/TA12-073A.html
CVE: CVE-2012-0156
Published: 2012-03-13
Description: DirectWrite in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly render Unicode characters, which allows remote attackers to cause a denial of service (application hang) via a (1) instant message or (2) web site, aka "DirectWrite Application Denial of Service Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/80003; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-019; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14807
CVE: CVE-2012-0157
Published: 2012-03-13
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle window messaging, which allows local users to gain privileges via a crafted application that calls the PostMessage function, aka "PostMessage Function Vulnerability."
CVSS Score: 8.4 (HIGH)
CWE: CWE-20
References: http://osvdb.org/80002; http://www.us-cert.gov/cas/techalerts/TA12-073A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-018
CVE: CVE-2012-0770
Published: 2012-03-13
Description: Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix.html; http://osvdb.org/80008; http://secunia.com/advisories/48393
CVE: CVE-2012-1663
Published: 2012-03-13
Description: Double free vulnerability in libgnutls in GnuTLS before 3.0.14 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted certificate list.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5866; http://www.exploit-db.com/exploits/24865; https://exchange.xforce.ibmcloud.com/vulnerabilities/74099
CVE: CVE-2012-0121
Published: 2012-03-14
Description: Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1392.
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/archive/1/521944; http://www.securityfocus.com/archive/1/521944
CVE: CVE-2012-0122
Published: 2012-03-14
Description: Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1393.
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/archive/1/521944; http://www.securityfocus.com/archive/1/521944
CVE: CVE-2012-0123
Published: 2012-03-14
Description: Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1498.
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/archive/1/521944; https://exchange.xforce.ibmcloud.com/vulnerabilities/73947; http://www.securityfocus.com/archive/1/521944
CVE: CVE-2012-0124
Published: 2012-03-14
Description: Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/archive/1/521944; http://www.securityfocus.com/archive/1/521944
CVE: CVE-2012-1408
Published: 2012-03-14
Description: Unspecified vulnerability in the App Lock (com.cc.applock) application 1.7.5 and 1.7.6 for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1408-vulnerability-in-AppLock.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1408-vulnerability-in-AppLock.html
CVE: CVE-2012-1409
Published: 2012-03-14
Description: Unspecified vulnerability in the Tiny Password (com.tinycouch.android.freepassword) application 1.64 for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1409-vulnerability-in-TinyPassword.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1409-vulnerability-in-TinyPassword.html
CVE: CVE-2012-1474
Published: 2012-03-14
Description: Unspecified vulnerability in the Youni SMS (com.snda.youni) application 2.1.0c and 2.1.0d for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1474-vulnerability-in-YouniSMS.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1474-vulnerability-in-YouniSMS.html
CVE: CVE-2012-1475
Published: 2012-03-14
Description: Unspecified vulnerability in the YagattaTalk Messenger (com.iskoot.yagatta.yagattatalk) application 1.00.01.08 for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1475-vulnerability-in-YagattaTalkMessenger.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1475-vulnerability-in-YagattaTalkMessenger.html
CVE: CVE-2012-1476
Published: 2012-03-14
Description: Unspecified vulnerability in the KKtalk (com.kkliaotian.android) application 4.0.0 and 4.1.5 for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1476-vulnerability-in-KKtalk.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1476-vulnerability-in-KKtalk.html
CVE: CVE-2012-1477
Published: 2012-03-14
Description: Unspecified vulnerability in the Cnectd (mci.cnectd) application 3.1.0 for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1477-vulnerability-in-Cnectd.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1477-vulnerability-in-Cnectd.html
CVE: CVE-2012-1478
Published: 2012-03-14
Description: Unspecified vulnerability in the UCMobile BloveStorm (com.blovestorm) application 2.2.0 and 3.2.1 for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1478-vulnerability-in-UCMobileBloveStorm.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/74024; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1478-vulnerability-in-UCMobileBloveStorm.html
CVE: CVE-2012-1479
Published: 2012-03-14
Description: Unspecified vulnerability in the AContact (com.movester.quickcontact) application 1.8.2 for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1479-vulnerability-in-AContact.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/74025; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1479-vulnerability-in-AContact.html
CVE: CVE-2012-1480
Published: 2012-03-14
Description: Unspecified vulnerability in the Pansi SMS (com.pansi.msg) application 1.97, 2.01, and 2.07 for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1480-vulnerability-in-PansiSMS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/73963; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1480-vulnerability-in-PansiSMS.html
CVE: CVE-2012-0451
Published: 2012-03-14
Description: CRLF injection vulnerability in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote web servers to bypass intended Content Security Policy (CSP) restrictions and possibly conduct cross-site scripting (XSS) attacks via crafted HTTP headers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html; http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html; http://rhn.redhat.com/errata/RHSA-2012-0387.html
CVE: CVE-2012-0454
Published: 2012-03-14
Description: Use-after-free vulnerability in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 on 32-bit Windows 7 platforms allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving use of the file-open dialog in a child window, related to the IUnknown_QueryService function in the Windows shlwapi.dll library.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html; http://secunia.com/advisories/48402; http://secunia.com/advisories/48561
CVE: CVE-2012-0455
Published: 2012-03-14
Description: Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict drag-and-drop operations on javascript: URLs, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web page, related to a "DragAndDropJacking" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html; http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
CVE: CVE-2012-0456
Published: 2012-03-14
Description: The SVG Filters implementation in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 might allow remote attackers to obtain sensitive information from process memory via vectors that trigger an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html; http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
CVE: CVE-2012-0457
Published: 2012-03-14
Description: Use-after-free vulnerability in the nsSMILTimeValueSpec::ConvertBetweenTimeContainer function in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 might allow remote attackers to execute arbitrary code via an SVG animation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html; http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
CVE: CVE-2012-0458
Published: 2012-03-14
Description: Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict setting the home page through the dragging of a URL to the home button, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a javascript: URL that is later interpreted in the about:sessionrestore context.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html; http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html