deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-2711
Published: 2011-08-03
Description: Cross-site scripting (XSS) vulnerability in the print_fileinfo function in ui-diff.c in cgit 0.9.0.2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the filename associated with the rename hint.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://hjemli.net/git/cgit/commit/?h=stable&id=bebe89d7c11a92bf206bf6e528c51ffa8ecbc0d5; http://hjemli.net/pipermail/cgit/2011-July/000276.html; http://secunia.com/advisories/45358
CVE: CVE-2011-2782
Published: 2011-08-03
Description: The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://code.google.com/p/chromium/issues/detail?id=81307; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74232
CVE: CVE-2011-2783
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 does not ensure that developer-mode NPAPI extension installations are confirmed by a browser dialog, which makes it easier for remote attackers to modify the product's functionality via a Trojan horse extension.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=83273; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74233
CVE: CVE-2011-2784
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 allows remote attackers to obtain sensitive information via a request for the GL program log, which reveals a local path in an unspecified log entry.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=83841; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74234
CVE: CVE-2011-2785
Published: 2011-08-03
Description: The extensions implementation in Google Chrome before 13.0.782.107 does not properly validate the URL for the home page, which allows remote attackers to have an unspecified impact via a crafted extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=84402; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74235
CVE: CVE-2011-2786
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 does not ensure that the speech-input bubble is shown on the product's screen, which might make it easier for remote attackers to make audio recordings via a crafted web page containing an INPUT element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=84600; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74236
CVE: CVE-2011-2787
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 does not properly address re-entrancy issues associated with the GPU lock, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=84805; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74237
CVE: CVE-2011-2788
Published: 2011-08-03
Description: Buffer overflow in the inspector serialization functionality in Google Chrome before 13.0.782.107 allows user-assisted remote attackers to have an unspecified impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: http://code.google.com/p/chromium/issues/detail?id=85559; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-2789
Published: 2011-08-03
Description: Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to instantiation of the Pepper plug-in.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=85808; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74239
CVE: CVE-2011-2790
Published: 2011-08-03
Description: Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving floating styles.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=86502; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-2791
Published: 2011-08-03
Description: The International Components for Unicode (ICU) functionality in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://code.google.com/p/chromium/issues/detail?id=86900; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74241
CVE: CVE-2011-2792
Published: 2011-08-03
Description: Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to float removal.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=87148; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-2793
Published: 2011-08-03
Description: Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to media selectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=87227; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74243
CVE: CVE-2011-2794
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 does not properly perform text iteration, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=87298; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74244
CVE: CVE-2011-2795
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 does not prevent calls to functions in other frames, which allows remote attackers to bypass intended access restrictions via a crafted web site, related to a "cross-frame function leak."
CVSS Score: 4.3 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=87339; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74245
CVE: CVE-2011-2796
Published: 2011-08-03
Description: Use-after-free vulnerability in Skia, as used in Google Chrome before 13.0.782.107, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=87548; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74246
CVE: CVE-2011-2797
Published: 2011-08-03
Description: Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to resource caching.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=87729; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-2798
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 does not properly restrict access to internal schemes, which allows remote attackers to have an unspecified impact via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=87815; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74248
CVE: CVE-2011-2799
Published: 2011-08-03
Description: Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to HTML range handling.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=87925; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-2800
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 allows remote attackers to obtain potentially sensitive information about client-side redirect targets via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=88337; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
CVE: CVE-2011-2801
Published: 2011-08-03
Description: Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the frame loader.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=88846; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74252
CVE: CVE-2011-2802
Published: 2011-08-03
Description: Google V8, as used in Google Chrome before 13.0.782.107, does not properly perform const lookups, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=88591; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74253
CVE: CVE-2011-2803
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 does not properly handle Skia paths, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=88827; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74254
CVE: CVE-2011-2804
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 does not properly handle nested functions in PDF documents, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=89142; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://osvdb.org/74256
CVE: CVE-2011-2805
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 allows remote attackers to bypass the Same Origin Policy and conduct script injection attacks via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-74
References: http://code.google.com/p/chromium/issues/detail?id=89520; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
CVE: CVE-2011-2818
Published: 2011-08-03
Description: Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to display box rendering.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=88889; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-2819
Published: 2011-08-03
Description: Google Chrome before 13.0.782.107 allows remote attackers to bypass the Same Origin Policy via vectors related to handling of the base URI.
CVSS Score: 6.8 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=90222; http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
CVE: CVE-2011-0245
Published: 2011-08-04
Description: Buffer overflow in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted pict file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15755; http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html
CVE: CVE-2011-0246
Published: 2011-08-04
Description: Heap-based buffer overflow in Apple QuickTime before 7.7 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted GIF file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15681; http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html
CVE: CVE-2011-0247
Published: 2011-08-04
Description: Multiple stack-based buffer overflows in Apple QuickTime before 7.7 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted H.264 movie.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16186; http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html
CVE: CVE-2011-0248
Published: 2011-08-04
Description: Stack-based buffer overflow in the QuickTime ActiveX control in Apple QuickTime before 7.7 on Windows, when Internet Explorer is used, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted QTL file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html; http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html
CVE: CVE-2011-0249
Published: 2011-08-04
Description: Heap-based buffer overflow in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted STSC atoms in a QuickTime movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html; http://support.apple.com/kb/HT5002
CVE: CVE-2011-0250
Published: 2011-08-04
Description: Heap-based buffer overflow in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted STSS atoms in a QuickTime movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html; http://support.apple.com/kb/HT5002
CVE: CVE-2011-0251
Published: 2011-08-04
Description: Heap-based buffer overflow in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted STSZ atoms in a QuickTime movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html; http://support.apple.com/kb/HT5002
CVE: CVE-2011-0252
Published: 2011-08-04
Description: Heap-based buffer overflow in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted STTS atoms in a QuickTime movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html; http://support.apple.com/kb/HT5002
CVE: CVE-2011-1412
Published: 2011-08-04
Description: sys/sys_unix.c in the ioQuake3 engine on Unix and Linux, as used in World of Padman 1.5.x before 1.5.1.1 and OpenArena 0.8.x-15 and 0.8.x-16, allows remote game servers to execute arbitrary commands via shell metacharacters in a long fs_game variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063460.html; http://secunia.com/advisories/45417
CVE: CVE-2011-2701
Published: 2011-08-04
Description: The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/45425; http://securityreason.com/securityalert/8325; http://securitytracker.com/id?1025833
CVE: CVE-2011-2764
Published: 2011-08-04
Description: The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063460.html; http://secunia.com/advisories/45539
CVE: CVE-2011-1340
Published: 2011-08-05
Description: Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the type_name parameter to Members/ipa/createObject.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dev.plone.org/plone/changeset/12262; http://dev.plone.org/plone/ticket/6110; http://jvn.jp/en/jp/JVN41222793/index.html
CVE: CVE-2011-2591
Published: 2011-08-05
Description: Multiple buffer overflows in the Provideo ActiveX controls allow remote attackers to execute arbitrary code via crafted input fields, as demonstrated by (1) a long strIp argument to the voice method in 2way.dll in the alarm 1.0.3.1 ActiveX control, (2) a network response to AXPlayer.ocx in the GMAXPlayer 2.0.8.2 ActiveX control, the (3) UserName or (4) Password parameter to AXPlayer.ocx in the GMAXPlayer 2.0.8.2 ActiveX control, (5) a long Id parameter to the GetString method in PAxPlayer.ocx in the PAxPlayer 3.0.0.9 ActiveX control, or (6) a long strAdr parameter to the ConnectIPCam method in PAxPlayer.ocx in the PAxPlayer 3.0.0.9 ActiveX control.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/74310; http://osvdb.org/74311; http://osvdb.org/74312
CVE: CVE-2011-2686
Published: 2011-08-05
Description: Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900.  NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html; http://redmine.ruby-lang.org/issues/show/4338
CVE: CVE-2011-2705
Published: 2011-08-05
Description: The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html; http://redmine.ruby-lang.org/issues/4579
CVE: CVE-2011-2720
Published: 2011-08-05
Description: The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063408.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063679.html; http://secunia.com/advisories/45366
CVE: CVE-2011-2721
Published: 2011-08-05
Description: Off-by-one error in the cli_hm_scan function in matcher-hash.c in libclamav in ClamAV before 0.97.2 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message that is not properly handled during certain hash calculations.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=clamav-0.97.2; http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=commit%3Bh=4842733eb3f09be61caeed83778bb6679141dbc5; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/068940.html
CVE: CVE-2011-2900
Published: 2011-08-05
Description: Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) _shttpd_put_dir function in io_dir.c in Simple HTTPD (shttpd) 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT request, as exploited in the wild in 2011.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065273.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065505.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065537.html
CVE: CVE-2011-3008
Published: 2011-08-05
Description: The default configuration of Avaya Secure Access Link (SAL) Gateway 1.5, 1.8, and 2.0 contains certain domain names in the Secondary Core Server URL and Secondary Remote Server URL fields, which allows remote attackers to obtain sensitive information by leveraging administrative access to these domain names, as demonstrated by alarm and log information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://support.avaya.com/css/P8/documents/100140483; http://www.kb.cert.org/vuls/id/690315; http://www.securityfocus.com/bid/48942
CVE: CVE-2011-3009
Published: 2011-08-05
Description: Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://redmine.ruby-lang.org/issues/show/4338; http://rhn.redhat.com/errata/RHSA-2012-0070.html; http://www.openwall.com/lists/oss-security/2011/07/20/1