deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2031
Published: 2012-05-09
Description: Adobe Shockwave Player before 11.6.5.635 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2029, CVE-2012-2030, CVE-2012-2032, and CVE-2012-2033.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/49086; http://www.adobe.com/support/security/bulletins/apsb12-13.html; http://www.securityfocus.com/bid/53420
CVE: CVE-2012-2032
Published: 2012-05-09
Description: Adobe Shockwave Player before 11.6.5.635 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2029, CVE-2012-2030, CVE-2012-2031, and CVE-2012-2033.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/49086; http://www.adobe.com/support/security/bulletins/apsb12-13.html; http://www.securityfocus.com/bid/53420
CVE: CVE-2012-2033
Published: 2012-05-09
Description: Adobe Shockwave Player before 11.6.5.635 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2029, CVE-2012-2030, CVE-2012-2031, and CVE-2012-2032.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/49086; http://www.adobe.com/support/security/bulletins/apsb12-13.html; http://www.securityfocus.com/bid/53420
CVE: CVE-2011-4031
Published: 2012-05-09
Description: Integer underflow in the asfrtp_parse_packet function in libavformat/rtpdec_asf.c in FFmpeg before 0.8.3 allows remote attackers to execute arbitrary code via a crafted ASF packet.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-191
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=c2a2ad133eb9d42361804a568dee336992349a5e; http://git.videolan.org/?p=ffmpeg.git%3Ba=shortlog%3Bh=n0.8.3; http://technet.microsoft.com/en-us/security/msvr/msvr11-012
CVE: CVE-2012-0684
Published: 2012-05-09
Description: Integer overflow in XnViewer (aka XnView) before 1.98.5 allows remote attackers to execute arbitrary code via a crafted file containing PSD record types, a different vulnerability than CVE-2012-0685.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://technet.microsoft.com/en-us/security/msvr/msvr12-001; http://technet.microsoft.com/en-us/security/msvr/msvr12-001
CVE: CVE-2012-0685
Published: 2012-05-09
Description: Integer overflow in XnViewer (aka XnView) before 1.98.5 allows remote attackers to execute arbitrary code via a crafted file containing PSD record types, a different vulnerability than CVE-2012-0684.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://technet.microsoft.com/en-us/security/msvr/msvr12-001; http://technet.microsoft.com/en-us/security/msvr/msvr12-001
CVE: CVE-2012-1977
Published: 2012-05-09
Description: WellinTech KingSCADA 3.0 uses a cleartext base64 format for storage of passwords in user.db, which allows context-dependent attackers to obtain sensitive information by reading this file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-311, CWE-255
References: https://www.cisa.gov/news-events/ics-advisories/icsa-12-129-01; http://dsecrg.com/pages/vul/show.php?id=405; http://www.us-cert.gov/control_systems/pdf/ICSA-12-129-01.pdf
CVE: CVE-2012-2007
Published: 2012-05-09
Description: SQL injection vulnerability in HP Performance Insight for Networks 5.3.x, 5.41, 5.41.001, and 5.41.002 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03312417; http://secunia.com/advisories/49079; http://www.securityfocus.com/bid/53415
CVE: CVE-2012-2008
Published: 2012-05-09
Description: Cross-site scripting (XSS) vulnerability in HP Performance Insight for Networks 5.3.x, 5.41, 5.41.001, and 5.41.002 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03312417; http://secunia.com/advisories/49079; http://www.securityfocus.com/bid/53415
CVE: CVE-2012-2009
Published: 2012-05-09
Description: Unspecified vulnerability in HP Performance Insight for Networks 5.3.x, 5.41, 5.41.001, and 5.41.002 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03312417; http://secunia.com/advisories/49079; http://www.securityfocus.com/bid/53415
CVE: CVE-2012-0649
Published: 2012-05-11
Description: Race condition in the initialization routine in blued in Bluetooth in Apple Mac OS X before 10.7.4 allows local users to gain privileges via vectors involving a temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://support.apple.com/kb/HT5281; http://www.securityfocus.com/bid/53445
CVE: CVE-2012-0651
Published: 2012-05-11
Description: The directory server in Directory Service in Apple Mac OS X 10.6.8 allows remote attackers to obtain sensitive information from process memory via a crafted message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://support.apple.com/kb/HT5281; http://www.securityfocus.com/bid/53445
CVE: CVE-2012-0652
Published: 2012-05-11
Description: Login Window in Apple Mac OS X 10.7.3, when Legacy File Vault or networked home directories are enabled, does not properly restrict what is written to the system log for network logins, which allows local users to obtain sensitive information by reading the log.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html; http://support.apple.com/kb/HT5281
CVE: CVE-2012-0654
Published: 2012-05-11
Description: libsecurity in Apple Mac OS X before 10.7.4 accesses uninitialized memory locations during the processing of X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted certificate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://support.apple.com/kb/HT5281; http://www.securityfocus.com/bid/53445
CVE: CVE-2012-0655
Published: 2012-05-11
Description: libsecurity in Apple Mac OS X before 10.7.4 does not properly restrict the length of RSA keys within X.509 certificates, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by conducting a spoofing or network-sniffing attack during communication with a site that uses a short key.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://support.apple.com/kb/HT5281; http://www.securityfocus.com/bid/53445
CVE: CVE-2012-0656
Published: 2012-05-11
Description: Race condition in LoginUIFramework in Apple Mac OS X 10.7.x before 10.7.4, when the Guest account is enabled, allows physically proximate attackers to login to arbitrary accounts by entering the account name and no password.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://support.apple.com/kb/HT5281; http://www.securityfocus.com/bid/53445
CVE: CVE-2012-0657
Published: 2012-05-11
Description: Quartz Composer in Apple Mac OS X before 10.7.4, when the RSS Visualizer screensaver is enabled, allows physically proximate attackers to bypass screen locking and launch a Safari process via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://support.apple.com/kb/HT5281; http://www.securityfocus.com/bid/53445
CVE: CVE-2012-0658
Published: 2012-05-11
Description: Buffer overflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted audio sample tables in a movie file that is progressively downloaded.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://lists.apple.com/archives/security-announce/2012/May/msg00005.html; http://support.apple.com/kb/HT5261
CVE: CVE-2012-0659
Published: 2012-05-11
Description: Integer overflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://lists.apple.com/archives/security-announce/2012/May/msg00005.html; http://support.apple.com/kb/HT5261
CVE: CVE-2012-0660
Published: 2012-05-11
Description: Buffer underflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://lists.apple.com/archives/security-announce/2012/May/msg00005.html; http://support.apple.com/kb/HT5261
CVE: CVE-2012-0661
Published: 2012-05-11
Description: Use-after-free vulnerability in QuickTime in Apple Mac OS X 10.7.x before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with JPEG2000 encoding.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://lists.apple.com/archives/security-announce/2012/May/msg00005.html; http://support.apple.com/kb/HT5261
CVE: CVE-2012-0662
Published: 2012-05-11
Description: Integer overflow in the Security Framework in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://support.apple.com/kb/HT5281; http://www.securityfocus.com/bid/53445
CVE: CVE-2012-0675
Published: 2012-05-11
Description: Time Machine in Apple Mac OS X before 10.7.4 does not require continued use of SRP-based authentication after this authentication method is first used, which allows remote attackers to read Time Capsule credentials by spoofing the backup volume.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://support.apple.com/kb/HT5281; http://www.securityfocus.com/bid/53445
CVE: CVE-2012-0676
Published: 2012-05-11
Description: WebKit in Apple Safari before 5.1.7 does not properly track state information during the processing of form input, which allows remote attackers to fill in form fields on the pages of arbitrary web sites via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2012/May/msg00002.html; http://osvdb.org/81787; http://secunia.com/advisories/47292
CVE: CVE-2012-1823
Published: 2012-05-11
Description: sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041; http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
CVE: CVE-2012-2311
Published: 2012-05-11
Description: sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/; http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html
CVE: CVE-2012-2329
Published: 2012-05-11
Description: Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in the header of an HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/49014; http://www.php.net/ChangeLog-5.php#5.4.3; http://www.php.net/archive/2012.php#id2012-05-08-1
CVE: CVE-2012-2335
Published: 2012-05-11
Description: php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/; http://git.php.net/?p=php-src.git%3Ba=blob%3Bf=sapi/cgi/cgi_main.c%3Bh=a7ac26f0#l1569; http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00004.html
CVE: CVE-2012-2336
Published: 2012-05-11
Description: sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html; http://secunia.com/advisories/49014
CVE: CVE-2012-1804
Published: 2012-05-14
Description: The OPC server in Progea Movicon before 11.3 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a crafted HTTP request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://osvdb.org/81814; http://secunia.com/advisories/49092; http://www.securityfocus.com/bid/53484
CVE: CVE-2011-1390
Published: 2012-05-14
Description: SQL injection vulnerability in the Maintenance tool in IBM Rational ClearQuest 7.1.1.x before 7.1.1.9, 7.1.2.x before 7.1.2.6, and 8.x before 8.0.0.2 allows remote attackers to execute arbitrary SQL commands by leveraging an error in the user-database upgrade feature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/81815; http://secunia.com/advisories/49093; http://www-01.ibm.com/support/docview.wss?uid=swg21594717
CVE: CVE-2012-2276
Published: 2012-05-14
Description: The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via input data that (1) lacks FIPS fields or (2) has an invalid version number.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/irm_1-adv.txt; http://secunia.com/advisories/48690; http://www.exploit-db.com/exploits/18734
CVE: CVE-2012-2277
Published: 2012-05-14
Description: The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote attackers to cause a denial of service (pvcontrol.exe process hang) via \n (line feed) characters in the Id fields of many "batch begin untethered" commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/irm_1-adv.txt; http://secunia.com/advisories/48690; http://www.exploit-db.com/exploits/18734
CVE: CVE-2012-2333
Published: 2012-05-14
Description: Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted TLS packet that is not properly handled during a certain explicit IV calculation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://cvs.openssl.org/chngview?cn=22538; http://cvs.openssl.org/chngview?cn=22547; http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
CVE: CVE-2012-2511
Published: 2012-05-15
Description: The DiagTraceAtoms function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://scn.sap.com/docs/DOC-8218; http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities; http://www.securitytracker.com/id?1027052
CVE: CVE-2012-2512
Published: 2012-05-15
Description: The DiagTraceStreamI function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://scn.sap.com/docs/DOC-8218; http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities; http://www.securitytracker.com/id?1027052
CVE: CVE-2012-2513
Published: 2012-05-15
Description: The Diaginput function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://scn.sap.com/docs/DOC-8218; http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities; http://www.securitytracker.com/id?1027052
CVE: CVE-2012-2514
Published: 2012-05-15
Description: The DiagiEventSource function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://scn.sap.com/docs/DOC-8218; http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities; http://www.securitytracker.com/id?1027052
CVE: CVE-2012-2611
Published: 2012-05-15
Description: The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2, when a certain Developer Trace configuration is enabled, allows remote attackers to execute arbitrary code via a crafted SAP Diag packet.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://scn.sap.com/docs/DOC-8218; http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities; http://www.securitytracker.com/id?1027052
CVE: CVE-2012-2612
Published: 2012-05-15
Description: The DiagTraceHex function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://scn.sap.com/docs/DOC-8218; http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities; http://www.securitytracker.com/id?1027052
CVE: CVE-2012-1246
Published: 2012-05-15
Description: Cross-site scripting (XSS) vulnerability in KENT-WEB WEB MART 1.7 and earlier might allow remote attackers to inject arbitrary web script or HTML via a crafted cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN47536971/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000041; http://www.kent-web.com/cart/mart.html
CVE: CVE-2012-1247
Published: 2012-05-15
Description: Cross-site scripting (XSS) vulnerability in KENT-WEB WEB MART 1.7 and earlier, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML by leveraging support for Cascading Style Sheets (CSS) expressions.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN63941302/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000042; http://www.kent-web.com/cart/mart.html
CVE: CVE-2012-1248
Published: 2012-05-15
Description: app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-264
References: http://basercms.net/security/1; http://jvn.jp/en/jp/JVN53465692/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000043
CVE: CVE-2011-3083
Published: 2012-05-16
Description: browser/profiles/profile_impl_io_data.cc in Google Chrome before 19.0.1084.46 does not properly handle a malformed ftp URL in the SRC attribute of a VIDEO element, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted web page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=112983; http://code.google.com/p/chromium/issues/detail?id=127924; http://codereview.chromium.org/9372002
CVE: CVE-2011-3084
Published: 2012-05-16
Description: Google Chrome before 19.0.1084.46 does not use a dedicated process for the loading of links found on an internal page, which might allow attackers to bypass intended sandbox restrictions via a crafted page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://code.google.com/p/chromium/issues/detail?id=113496; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00017.html
CVE: CVE-2011-3085
Published: 2012-05-16
Description: The Autofill feature in Google Chrome before 19.0.1084.46 does not properly restrict field values, which allows remote attackers to cause a denial of service (UI corruption) and possibly conduct spoofing attacks via vectors involving long values.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=118374; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00017.html
CVE: CVE-2011-3086
Published: 2012-05-16
Description: Use-after-free vulnerability in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a STYLE element.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=118642; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3087
Published: 2012-05-16
Description: Google Chrome before 19.0.1084.46 does not properly perform window navigation, which has unspecified impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=118664; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00017.html