deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5176
Published: 2012-12-06
Description: Cross-site scripting (XSS) vulnerability in KENT-WEB ACCESS REPORT 5.02 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to tag embedding.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN23563149/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000107; http://www.kent-web.com/data/report.html
CVE: CVE-2012-5688
Published: 2012-12-06
Description: ISC BIND 9.8.x before 9.8.4-P1 and 9.9.x before 9.9.2-P1, when DNS64 is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://rhn.redhat.com/errata/RHSA-2012-1549.html; http://support.apple.com/kb/HT5880
CVE: CVE-2012-3297
Published: 2012-12-08
Description: Cross-site scripting (XSS) vulnerability in the embedded HTTP server in the Service Console in IBM Tivoli Monitoring 6.2.2 before 6.2.2-TIV-ITM-FP0009 and 6.3.2 before 6.2.3-TIV-ITM-FP0001 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id?1027850; https://exchange.xforce.ibmcloud.com/vulnerabilities/77291; https://www.ibm.com/support/docview.wss?uid=swg21618972
CVE: CVE-2012-4687
Published: 2012-12-08
Description: Post Oak AWAM Bluetooth Reader Traffic System does not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof a device by predicting a key value.
CVSS Score: 7.6 (HIGH)
CWE: CWE-331, CWE-310
References: http://www.postoaktraffic.com/contact.aspx; https://www.cisa.gov/news-events/ics-advisories/icsa-12-335-01; http://www.us-cert.gov/control_systems/pdf/ICSA-12-335-01.pdf
CVE: CVE-2012-4690
Published: 2012-12-08
Description: Rockwell Automation Allen-Bradley MicroLogix controller 1100, 1200, 1400, and 1500; SLC 500 controller platform; and PLC-5 controller platform, when Static status is not enabled, allow remote attackers to cause a denial of service via messages that trigger modification of status bits.
CVSS Score: 7.1 (HIGH)
CWE: CWE-16
References: http://ics-cert.us-cert.gov/advisories/ICSA-12-342-01A; http://www.us-cert.gov/control_systems/pdf/ICSA-12-342-01.pdf; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/511407
CVE: CVE-2012-4838
Published: 2012-12-08
Description: IBM Flex System Chassis Management Module (CMM) and Integrated Management Module 2 (IMM2) allow local users to obtain sensitive information about (1) local accounts, (2) SSH private keys, (3) SSL/TLS private keys, (4) SNMPv3 communities, and (5) LDAP credentials by leveraging unspecified side effects of service or maintenance activity.
CVSS Score: 1.9 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/79020; https://www-947.ibm.com/support/entry/myportal/docdisplay?lndocid=MIGR-5092001; https://www.ibm.com/connections/blogs/PSIRT/entry/flex_system_chassis_management_module_cmm_and_integrated_management_module_2_imm2_potential_security_vulnerability_with_authentication_data_cve_2012_4838_ibm_flex_system8
CVE: CVE-2012-4857
Published: 2012-12-08
Description: Buffer overflow in IBM Informix 11.50 through 11.50.xC9W2 and 11.70 before 11.70.xC7 allows remote authenticated users to execute arbitrary code via a crafted SQL statement.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id?1027849; https://exchange.xforce.ibmcloud.com/vulnerabilities/79737; https://www.ibm.com/support/docview.wss?uid=swg21618994
CVE: CVE-2012-5973
Published: 2012-12-10
Description: CA XCOM Data Transport r11.0 and r11.5 on UNIX and Linux allows remote attackers to execute arbitrary commands via a crafted request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B358F44CA-6354-4427-9088-C57138E9EE11%7D; http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B358F44CA-6354-4427-9088-C57138E9EE11%7D
CVE: CVE-2012-6301
Published: 2012-12-10
Description: The Browser application in Android 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted market: URI in the SRC attribute of an IFRAME element.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.org/files/118539/Android-4.0.3-Browser-Crash.html; http://packetstormsecurity.org/files/118539/Android-4.0.3-Browser-Crash.html
CVE: CVE-2011-4433
Published: 2012-12-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011.  Notes: none
CVE: CVE-2012-1501
Published: 2012-12-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012.  Notes: none
CVE: CVE-2012-4349
Published: 2012-12-11
Description: Unquoted Windows search path vulnerability in Symantec Network Access Control (SNAC) 12.1 before RU2 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/bid/56847; http://www.securitytracker.com/id?1027864; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20121210_00
CVE: CVE-2012-5956
Published: 2012-12-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine AssetExplorer 5.6 before service pack 5614 allow remote attackers to inject arbitrary web script or HTML via fields in XML asset data to discoveryServlet/WsDiscoveryServlet, as demonstrated by the DocRoot/Computer_Information/output element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/571068; http://www.manageengine.com/products/asset-explorer/sp-readme.html; http://www.kb.cert.org/vuls/id/571068
CVE: CVE-2012-6312
Published: 2012-12-11
Description: Cross-site scripting (XSS) vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-12/0060.html; http://wordpress.org/extend/plugins/video-lead-form/changelog/; http://archives.neohapsis.com/archives/bugtraq/2012-12/0060.html
CVE: CVE-2012-6313
Published: 2012-12-11
Description: simple-gmail-login.php in the Simple Gmail Login plugin before 1.1.4 for WordPress allows remote attackers to obtain sensitive information via a request that lacks a timezone, leading to disclosure of the installation path in a stack trace.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2012-12/0061.html; http://wordpress.org/extend/plugins/simple-gmail-login/changelog/; http://archives.neohapsis.com/archives/bugtraq/2012-12/0061.html
CVE: CVE-2012-1537
Published: 2012-12-12
Description: Heap-based buffer overflow in DirectPlay in DirectX 9.0 through 11.1 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a crafted Office document, aka "DirectPlay Heap Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/cas/techalerts/TA12-346A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-082; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16086
CVE: CVE-2012-2539
Published: 2012-12-12
Description: Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "Word RTF 'listoverridecount' Remote Code Execution Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.us-cert.gov/cas/techalerts/TA12-346A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-079; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16073
CVE: CVE-2012-2549
Published: 2012-12-12
Description: The IP-HTTPS server in Windows Server 2008 R2 and R2 SP1 and Server 2012 does not properly validate certificates, which allows remote attackers to bypass intended access restrictions via a revoked certificate, aka "Revoked Certificate Bypass Vulnerability."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.us-cert.gov/cas/techalerts/TA12-346A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-083; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16117
CVE: CVE-2012-2556
Published: 2012-12-12
Description: The OpenType Font (OTF) driver in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows remote attackers to execute arbitrary code via a crafted OpenType font file, aka "OpenType Font Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-346A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-078; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16067
CVE: CVE-2012-4774
Published: 2012-12-12
Description: Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted (1) file name or (2) subfolder name that triggers use of unallocated memory as the destination of a copy operation, aka "Windows Filename Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-346A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-081; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15901
CVE: CVE-2012-4781
Published: 2012-12-12
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "InjectHTMLStream Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-346A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-077; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15731
CVE: CVE-2012-4782
Published: 2012-12-12
Description: Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "CMarkup Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/cas/techalerts/TA12-346A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-077; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16066
CVE: CVE-2012-4786
Published: 2012-12-12
Description: The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code via a crafted TrueType Font (TTF) file, aka "TrueType Font Parsing Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA12-346A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-078; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15845
CVE: CVE-2012-4787
Published: 2012-12-12
Description: Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly initialized or (2) is deleted, aka "Improper Ref Counting Use After Free Vulnerability."
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-399, CWE-416
References: http://www.us-cert.gov/cas/techalerts/TA12-346A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-077; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16211
CVE: CVE-2012-4791
Published: 2012-12-12
Description: Microsoft Exchange Server 2007 SP3 and 2010 SP1 and SP2 allows remote authenticated users to cause a denial of service (Information Store service hang) by subscribing to a crafted RSS feed, aka "RSS Feed May Cause Exchange DoS Vulnerability."
CVSS Score: 3.5 (LOW)
CWE: CWE-94
References: http://www.securityfocus.com/bid/56836; http://www.us-cert.gov/cas/techalerts/TA12-346A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-080
CVE: CVE-2012-4971
Published: 2012-12-12
Description: Multiple SQL injection vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) reqclass parameter to editrequestenduser.asp; the (2) sys_request_id parameter to editrequestuser.asp; the (3) sys_request_id parameter to enduseractions.asp; the (4) sys_request_id or (5) confirm parameter to enduserreopenrequeststatus.asp; the (6) searchsql, (7) back, or (8) status parameter to enduserrequests.asp; the (9) sys_userpwd parameter to validateenduserlogin.asp; the (10) sys_userpwd parameter to validateuserlogin.asp; the (11) sql parameter to editenduseruser.asp; the (12) sql parameter to manageenduserrequestclasses.asp; the (13) sql parameter to resetpwdenduser.asp; the (14) sql parameter to disableloginenduser.asp; the (15) sql parameter to deleteenduseruser.asp; the (16) sql parameter to manageendusers.asp; or the (17) site parameter to statsrequestagereport.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.reactionpenetrationtesting.co.uk/helpbox-sql-injection.html; http://www.reactionpenetrationtesting.co.uk/helpbox-sql-injection.html
CVE: CVE-2012-4972
Published: 2012-12-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) sys_solution_id, (2) sys_requesttype_id, (3) sys_problem_desc, (4) sys_solution_desc, (5) sys_problemsummary, (6) usr_Action_testing, (7) usr_Escalation, or (8) usr_Additional_Resources parameter to writesolutionuser.asp or the (9) sys_solution_id parameter to deletesolution.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.reactionpenetrationtesting.co.uk/helpbox-embedded-xss.html; http://www.reactionpenetrationtesting.co.uk/helpbox-reflected-xss.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/79658
CVE: CVE-2012-4974
Published: 2012-12-12
Description: Layton Helpbox 4.4.0 allows remote authenticated users to change the login context and gain privileges via a modified (1) loggedinenduser, (2) loggedinendusername, (3) loggedinuserusergroup, (4) loggedinuser, or (5) loggedinusername cookie.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.reactionpenetrationtesting.co.uk/helpbox-login-bypass.html; http://www.reactionpenetrationtesting.co.uk/helpbox-login-bypass.html
CVE: CVE-2012-4975
Published: 2012-12-12
Description: editrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to change arbitrary support-ticket data via a modified sys_request_id parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www.reactionpenetrationtesting.co.uk/helpbox-auth-bypass.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/79644; http://www.reactionpenetrationtesting.co.uk/helpbox-auth-bypass.html
CVE: CVE-2012-4976
Published: 2012-12-12
Description: selectawasset.asp in Layton Helpbox 4.4.0 allows remote attackers to discover ODBC database credentials via an element=sys_asset_id request, which is not properly handled during construction of an error page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.reactionpenetrationtesting.co.uk/helpbox-creds-error-page.html; http://www.reactionpenetrationtesting.co.uk/helpbox-creds-error-page.html
CVE: CVE-2012-4977
Published: 2012-12-12
Description: Layton Helpbox 4.4.0 allows remote attackers to discover cleartext credentials for the login page by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.reactionpenetrationtesting.co.uk/helpbox-cleartext-login.html; http://www.reactionpenetrationtesting.co.uk/helpbox-cleartext-login.html
CVE: CVE-2012-5139
Published: 2012-12-12
Description: Use-after-free vulnerability in Google Chrome before 23.0.1271.97 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to visibility events.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2012/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2012-12/msg00073.html; https://code.google.com/p/chromium/issues/detail?id=158204
CVE: CVE-2012-5140
Published: 2012-12-12
Description: Use-after-free vulnerability in Google Chrome before 23.0.1271.97 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the URL loader.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2012/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2012-12/msg00073.html; https://code.google.com/p/chromium/issues/detail?id=159429
CVE: CVE-2012-5141
Published: 2012-12-12
Description: Google Chrome before 23.0.1271.97 does not properly restrict instantiation of the Chromoting client plug-in, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2012/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2012-12/msg00073.html; https://code.google.com/p/chromium/issues/detail?id=160456
CVE: CVE-2012-5142
Published: 2012-12-12
Description: Google Chrome before 23.0.1271.97 does not properly handle history navigation, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://googlechromereleases.blogspot.com/2012/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2012-12/msg00073.html; https://code.google.com/p/chromium/issues/detail?id=160803
CVE: CVE-2012-5143
Published: 2012-12-12
Description: Integer overflow in Google Chrome before 23.0.1271.97 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to PPAPI image buffers.
CVSS Score: 10.0 (HIGH)
CWE: CWE-190
References: http://googlechromereleases.blogspot.com/2012/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2012-12/msg00073.html; https://code.google.com/p/chromium/issues/detail?id=160926
CVE: CVE-2012-5144
Published: 2012-12-12
Description: Google Chrome before 23.0.1271.97, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5, do not properly perform AAC decoding, which allows remote attackers to cause a denial of service (stack memory corruption) or possibly have unspecified other impact via vectors related to "an off-by-one overwrite when switching to LTP profile from MAIN."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/12/stable-channel-update.html; http://libav.org/releases/libav-0.7.7.changelog; http://libav.org/releases/libav-0.8.5.changelog
CVE: CVE-2012-5675
Published: 2012-12-12
Description: Adobe ColdFusion 9.0 through 9.0.2, and 10, allows local users to bypass intended shared-hosting sandbox permissions via unspecified vectors.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://www.adobe.com/support/security/bulletins/apsb12-26.html; http://www.adobe.com/support/security/bulletins/apsb12-26.html
CVE: CVE-2012-5676
Published: 2012-12-12
Description: Buffer overflow in Adobe Flash Player before 10.3.183.48 and 11.x before 11.5.502.135 on Windows, before 10.3.183.48 and 11.x before 11.5.502.136 on Mac OS X, before 10.3.183.48 and 11.x before 11.2.202.258 on Linux, before 11.1.111.29 on Android 2.x and 3.x, and before 11.1.115.34 on Android 4.x; Adobe AIR before 3.5.0.880 on Windows and before 3.5.0.890 on Mac OS X; and Adobe AIR SDK before 3.5.0.880 on Windows and before 3.5.0.890 on Mac OS X allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00033.html; http://www.adobe.com/support/security/bulletins/apsb12-27.html
CVE: CVE-2012-5677
Published: 2012-12-12
Description: Integer overflow in Adobe Flash Player before 10.3.183.48 and 11.x before 11.5.502.135 on Windows, before 10.3.183.48 and 11.x before 11.5.502.136 on Mac OS X, before 10.3.183.48 and 11.x before 11.2.202.258 on Linux, before 11.1.111.29 on Android 2.x and 3.x, and before 11.1.115.34 on Android 4.x; Adobe AIR before 3.5.0.880 on Windows and before 3.5.0.890 on Mac OS X; and Adobe AIR SDK before 3.5.0.880 on Windows and before 3.5.0.890 on Mac OS X allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00033.html; http://www.adobe.com/support/security/bulletins/apsb12-27.html
CVE: CVE-2012-5678
Published: 2012-12-12
Description: Adobe Flash Player before 10.3.183.48 and 11.x before 11.5.502.135 on Windows, before 10.3.183.48 and 11.x before 11.5.502.136 on Mac OS X, before 10.3.183.48 and 11.x before 11.2.202.258 on Linux, before 11.1.111.29 on Android 2.x and 3.x, and before 11.1.115.34 on Android 4.x; Adobe AIR before 3.5.0.880 on Windows and before 3.5.0.890 on Mac OS X; and Adobe AIR SDK before 3.5.0.880 on Windows and before 3.5.0.890 on Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00033.html; http://www.adobe.com/support/security/bulletins/apsb12-27.html
CVE: CVE-2011-3131
Published: 2012-12-13
Description: Xen 4.1.1 and earlier allows local guest OS kernels with control of a PCI[E] device to cause a denial of service (CPU consumption and host hang) via many crafted DMA requests that are denied by the IOMMU, which triggers a livelock.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-399
References: http://old-list-archives.xen.org/archives/html/xen-devel/2011-06/msg01106.html; http://old-list-archives.xen.org/archives/html/xen-devel/2011-08/msg00450.html; http://secunia.com/advisories/45622
CVE: CVE-2012-3276
Published: 2012-12-13
Description: HP OpenVMS 8.3, 8.3-1H1, and 8.4 on the Itanium platform and 7.3-2, 8.2, 8.3, and 8.4 on the Alpha platform does not properly implement the LOGIN and ACME_SERVER ACMELOGIN programs, which allows local users to cause a denial of service via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-16
References: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03599086; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03599086