deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-1927
Published: 2012-03-28
Description: Opera before 11.62 allows remote attackers to spoof the address field by triggering the launch of a dialog window associated with a different domain.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00012.html; http://osvdb.org/80623; http://secunia.com/advisories/48535
CVE: CVE-2012-1928
Published: 2012-03-28
Description: Opera before 11.62 allows remote attackers to spoof the address field by triggering a page reload followed by a redirect to a different domain.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00012.html; http://osvdb.org/80624; http://secunia.com/advisories/48535
CVE: CVE-2012-1929
Published: 2012-03-28
Description: Opera before 11.62 on Mac OS X allows remote attackers to spoof the address field and security dialogs via crafted styling that causes page content to be displayed outside of the intended content area.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00012.html; http://secunia.com/advisories/48535; http://www.opera.com/docs/changelogs/mac/1162/
CVE: CVE-2012-1930
Published: 2012-03-28
Description: Opera before 11.62 on UNIX uses world-readable permissions for temporary files during printing, which allows local users to obtain sensitive information by reading these files.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00012.html; http://secunia.com/advisories/48535; http://www.opera.com/docs/changelogs/unix/1162/
CVE: CVE-2012-1931
Published: 2012-03-28
Description: Opera before 11.62 on UNIX, when used in conjunction with an unspecified printing application, allows local users to overwrite arbitrary files via a symlink attack on a temporary file during printing.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00012.html; http://secunia.com/advisories/48535; http://www.opera.com/docs/changelogs/unix/1162/
CVE: CVE-2007-6752
Published: 2012-03-28
Description: Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI.  NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/144538; http://groups.drupal.org/node/216314; http://ivanobinetti.blogspot.it/2012/03/drupal-cms-712-latest-stable-release.html
CVE: CVE-2012-0125
Published: 2012-03-28
Description: Unspecified vulnerability in the WBEM implementation in HP HP-UX 11.31 allows local users to obtain access to diagnostic information via unknown vectors, a related issue to CVE-2012-0126.
CVSS Score: 3.3 (LOW)
References: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03221589; http://secunia.com/advisories/48593; http://www.securityfocus.com/bid/52733
CVE: CVE-2012-0126
Published: 2012-03-28
Description: Unspecified vulnerability in the WBEM implementation in HP HP-UX 11.11 and 11.23 allows remote attackers to obtain access to diagnostic information via unknown vectors, a related issue to CVE-2012-0125.
CVSS Score: 5.8 (MEDIUM)
References: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03221589; http://secunia.com/advisories/48593; http://www.securityfocus.com/bid/52734
CVE: CVE-2012-1570
Published: 2012-03-28
Description: The resolver in MaraDNS before 1.3.0.7.15 and 1.4.x before 1.4.12 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/80192; http://secunia.com/advisories/48492; http://www.maradns.org/changelog.html
CVE: CVE-2012-1904
Published: 2012-03-28
Description: mp4fformat.dll in the QuickTime File Format plugin in RealNetworks RealPlayer 15 and earlier, and RealPlayer SP 1.1.4 Build 12.0.0.756 and earlier, allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted MP4 file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.org/files/111162/RealPlayer-1.1.4-Memory-Corruption.html; http://secunia.com/advisories/49193; http://www.securitytracker.com/id?1027076
CVE: CVE-2012-1907
Published: 2012-03-28
Description: The scanner engine in PrivaWall Antivirus 5.6 and earlier does not recognize the Office XML (aka Open Document XML) file format, which allows remote attackers to bypass malware detection via a crafted file embedded in a WordML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/521948/30/0/threaded; http://www.securityfocus.com/archive/1/521948/30/0/threaded
CVE: CVE-2012-1913
Published: 2012-03-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-0754.  Reason: This candidate is a reservation duplicate of CVE-2010-0754.  Notes: All CVE users should reference CVE-2010-0754 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-6753
Published: 2012-03-28
Description: Untrusted search path vulnerability in Shell32.dll in Microsoft Windows 2000, Windows XP, Windows Vista, Windows Server 2008, and Windows 7, when using an environment configured with a string such as %APPDATA% or %PROGRAMFILES% in a certain way, allows local users to gain privileges via a Trojan horse DLL under the current working directory, as demonstrated by iTunes and Safari.
CVSS Score: 6.2 (MEDIUM)
References: http://blog.acrossecurity.com/2010/10/breaking-setdlldirectory-protection.html; http://secunia.com/advisories/41984; http://support.microsoft.com/kb/329308
CVE: CVE-2012-0772
Published: 2012-03-28
Description: An unspecified ActiveX control in Adobe Flash Player before 10.3.183.18 and 11.x before 11.2.202.228, and AIR before 3.2.0.2070, on Windows does not properly perform URL security domain checking, which allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/80706; http://secunia.com/advisories/48618; http://www.adobe.com/support/security/bulletins/apsb12-07.html
CVE: CVE-2012-0773
Published: 2012-03-28
Description: The NetStream class in Adobe Flash Player before 10.3.183.18 and 11.x before 11.2.202.228 on Windows, Mac OS X, and Linux; Flash Player before 10.3.183.18 and 11.x before 11.2.202.223 on Solaris; Flash Player before 11.1.111.8 on Android 2.x and 3.x; and AIR before 3.2.0.2070 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00018.html; http://secunia.com/advisories/48618
CVE: CVE-2012-0381
Published: 2012-03-29
Description: The IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS through 3.4.xS before 3.4.2S, 3.5.xS before 3.5.1S, and 3.2.xSG before 3.2.2SG allows remote attackers to cause a denial of service (device reload) by sending IKE UDP packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCts38429.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://osvdb.org/80700; http://secunia.com/advisories/48605; http://secunia.com/advisories/48607
CVE: CVE-2012-0382
Published: 2012-03-29
Description: The Multicast Source Discovery Protocol (MSDP) implementation in Cisco IOS 12.0, 12.2 through 12.4, and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS through 3.4.xS before 3.4.1S and 3.1.xSG and 3.2.xSG before 3.2.2SG allows remote attackers to cause a denial of service (device reload) via encapsulated IGMP data in an MSDP packet, aka Bug ID CSCtr28857.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://osvdb.org/80693; http://secunia.com/advisories/48630; http://secunia.com/advisories/48633
CVE: CVE-2012-0383
Published: 2012-03-29
Description: Memory leak in the NAT feature in Cisco IOS 12.4, 15.0, and 15.1 allows remote attackers to cause a denial of service (memory consumption, and device hang or reload) via SIP packets that require translation, related to a "memory starvation vulnerability," aka Bug ID CSCti35326.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/80701; http://secunia.com/advisories/48515; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-nat
CVE: CVE-2012-0384
Published: 2012-03-29
Description: Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS before 3.1.2S, 3.2.xS through 3.4.xS before 3.4.2S, 3.5.xS before 3.5.1S, and 3.1.xSG and 3.2.xSG before 3.2.2SG, when AAA authorization is enabled, allow remote authenticated users to bypass intended access restrictions and execute commands via a (1) HTTP or (2) HTTPS session, aka Bug ID CSCtr91106.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: http://osvdb.org/80704; http://secunia.com/advisories/48614; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai
CVE: CVE-2012-0385
Published: 2012-03-29
Description: The Smart Install feature in Cisco IOS 12.2, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (device reload) by sending a malformed Smart Install message over TCP, aka Bug ID CSCtt16051.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/80694; http://secunia.com/advisories/48610; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-smartinstall
CVE: CVE-2012-0386
Published: 2012-03-29
Description: The SSHv2 implementation in Cisco IOS 12.2, 12.4, 15.0, 15.1, and 15.2 and IOS XE 2.3.x through 2.6.x and 3.1.xS through 3.4.xS before 3.4.2S allows remote attackers to cause a denial of service (device reload) via a crafted username in a reverse SSH login attempt, aka Bug ID CSCtr49064.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://osvdb.org/80695; http://secunia.com/advisories/48609; http://secunia.com/advisories/48641
CVE: CVE-2012-0387
Published: 2012-03-29
Description: Memory leak in the HTTP Inspection Engine feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit HTTP traffic, aka Bug ID CSCtq36153.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/80697; http://secunia.com/advisories/48608; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
CVE: CVE-2012-0388
Published: 2012-03-29
Description: Memory leak in the H.323 inspection feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via malformed transit H.323 traffic, aka Bug ID CSCtq45553.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/48608; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw; http://www.securityfocus.com/bid/52753
CVE: CVE-2012-1310
Published: 2012-03-29
Description: Memory leak in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted IP packets, aka Bug ID CSCto89536.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/80696; http://secunia.com/advisories/48608; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
CVE: CVE-2012-1311
Published: 2012-03-29
Description: The RSVP feature in Cisco IOS 15.0 and 15.1 and IOS XE 3.2.xS through 3.4.xS before 3.4.2S, when a VRF interface is configured, allows remote attackers to cause a denial of service (interface queue wedge and service outage) via crafted RSVP packets, aka Bug ID CSCts80643.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/80692; http://secunia.com/advisories/48611; http://secunia.com/advisories/48621
CVE: CVE-2012-1312
Published: 2012-03-29
Description: The MACE feature in Cisco IOS 15.1 and 15.2 allows remote attackers to cause a denial of service (device reload) via crafted transit traffic, aka Bug IDs CSCtq64987 and CSCtu57226.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://osvdb.org/80703; http://secunia.com/advisories/48595; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-mace
CVE: CVE-2012-1314
Published: 2012-03-29
Description: The WAAS Express feature in Cisco IOS 15.1 and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit traffic, aka Bug ID CSCtt45381.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/80702; http://secunia.com/advisories/48595; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-mace
CVE: CVE-2012-1315
Published: 2012-03-29
Description: Memory leak in the SIP inspection feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit SIP traffic, aka Bug ID CSCti46171.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/80699; http://secunia.com/advisories/48608; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
CVE: CVE-2011-3058
Published: 2012-03-30
Description: Google Chrome before 18.0.1025.142 does not properly handle the EUC-JP encoding system, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://code.google.com/p/chromium/issues/detail?id=109574; http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-and-beta-channel.html; http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html
CVE: CVE-2011-3059
Published: 2012-03-30
Description: Google Chrome before 18.0.1025.142 does not properly handle SVG text elements, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=112317; http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-and-beta-channel.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3060
Published: 2012-03-30
Description: Google Chrome before 18.0.1025.142 does not properly handle text fragments, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=114056; http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-and-beta-channel.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3061
Published: 2012-03-30
Description: Google Chrome before 18.0.1025.142 does not properly check X.509 certificates before use of a SPDY proxy, which might allow man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-295
References: http://code.google.com/p/chromium/issues/detail?id=116398; http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-and-beta-channel.html; http://osvdb.org/80739
CVE: CVE-2011-3062
Published: 2012-03-30
Description: Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted OpenType file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-682
References: http://code.google.com/p/chromium/issues/detail?id=116524; http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-and-beta-channel.html; http://osvdb.org/80740
CVE: CVE-2011-3063
Published: 2012-03-30
Description: Google Chrome before 18.0.1025.142 does not properly validate the renderer's navigation requests, which has unspecified impact and remote attack vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=117417; http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-and-beta-channel.html; http://secunia.com/advisories/48618
CVE: CVE-2011-3064
Published: 2012-03-30
Description: Use-after-free vulnerability in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG clipping.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=117471; http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-and-beta-channel.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3065
Published: 2012-03-30
Description: Skia, as used in Google Chrome before 18.0.1025.142, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-190
References: http://code.google.com/p/chromium/issues/detail?id=117588; http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-and-beta-channel.html; http://osvdb.org/80743
CVE: CVE-2012-0127
Published: 2012-03-31
Description: Unspecified vulnerability in HP Performance Manager 9.00 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/80657; http://secunia.com/advisories/48586; http://www.securityfocus.com/archive/1/522101
CVE: CVE-2012-1670
Published: 2012-03-31
Description: admin/index.php in PHP Grade Book before 1.9.5 BETA allows remote attackers to read the database via a SaveSQL action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0115.html; http://downloads.sourceforge.net/project/php-gradebook/phpGradeBook%20-%20BETA/1.9.5/phpGradeBook1.9.5.zip; http://osvdb.org/80311
CVE: CVE-2012-0246
Published: 2012-04-02
Description: Directory traversal vulnerability in an unspecified ActiveX control in Ecava IntegraXor before 3.71.4200 allows remote attackers to execute arbitrary code via vectors involving an HTML document on the server.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://osvdb.org/80650; http://secunia.com/advisories/48558; http://www.us-cert.gov/control_systems/pdf/ICSA-12-083-01.pdf
CVE: CVE-2012-1515
Published: 2012-04-02
Description: VMware ESXi 3.5, 4.0, and 4.1 and ESX 3.5, 4.0, and 4.1 do not properly implement port-based I/O operations, which allows guest OS users to gain guest OS privileges by overwriting memory locations in a read-only memory block associated with the Virtual DOS Machine.
CVSS Score: 8.3 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/52820; http://www.securitytracker.com/id?1026875; http://www.us-cert.gov/cas/techalerts/TA12-164A.html
CVE: CVE-2011-5084
Published: 2012-04-02
Description: Cross-site scripting (XSS) vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2012/dsa-2423; http://www.movabletype.org/2011/05/movable_type_51_and_505_436_security_update.html; http://www.debian.org/security/2012/dsa-2423
CVE: CVE-2011-5085
Published: 2012-04-02
Description: Unspecified vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to read or modify data via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2012/dsa-2423; http://www.movabletype.org/2011/05/movable_type_51_and_505_436_security_update.html; http://www.debian.org/security/2012/dsa-2423
CVE: CVE-2012-0221
Published: 2012-04-02
Description: The FactoryTalk (FT) RNADiagReceiver service in Rockwell Automation Allen-Bradley FactoryTalk CPR9 through SR5 and RSLogix 5000 17 through 20 does not properly handle the return value from an unspecified function, which allows remote attackers to cause a denial of service (service outage) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://rockwellautomation.custhelp.com/app/answers/detail/a_id/469937; http://www.us-cert.gov/control_systems/pdf/ICSA-12-088-01.pdf; http://rockwellautomation.custhelp.com/app/answers/detail/a_id/469937
CVE: CVE-2012-0222
Published: 2012-04-02
Description: The FactoryTalk (FT) RNADiagReceiver service in Rockwell Automation Allen-Bradley FactoryTalk CPR9 through SR5 and RSLogix 5000 17 through 20 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://rockwellautomation.custhelp.com/app/answers/detail/a_id/469937; http://www.us-cert.gov/control_systems/pdf/ICSA-12-088-01.pdf; http://rockwellautomation.custhelp.com/app/answers/detail/a_id/469937
CVE: CVE-2012-0225
Published: 2012-04-02
Description: Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/80888; http://secunia.com/advisories/48603; http://www.securityfocus.com/bid/52851
CVE: CVE-2012-0226
Published: 2012-04-02
Description: SQL injection vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/80889; http://secunia.com/advisories/48603; http://www.securityfocus.com/bid/52851
CVE: CVE-2012-0228
Published: 2012-04-02
Description: Invensys Wonderware Information Server 4.0 SP1 and 4.5 does not properly implement client controls, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/80890; http://secunia.com/advisories/48603; http://www.securityfocus.com/bid/52851
CVE: CVE-2012-0257
Published: 2012-04-02
Description: Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the Open member, leading to a function-pointer overwrite.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/80891; http://secunia.com/advisories/48675; http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf
CVE: CVE-2012-0258
Published: 2012-04-02
Description: Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the AddFile member.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/80891; http://secunia.com/advisories/48675; http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf