deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2342
Published: 2012-05-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-5097.  Reason: This candidate is a duplicate of CVE-2010-5097.  Notes: All CVE users should reference CVE-2010-5097 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2343
Published: 2012-05-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-5098.  Reason: This candidate is a duplicate of CVE-2010-5098.  Notes: All CVE users should reference CVE-2010-5098 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2344
Published: 2012-05-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-5099.  Reason: This candidate is a duplicate of CVE-2010-5099.  Notes: All CVE users should reference CVE-2010-5099 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2345
Published: 2012-05-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-5100.  Reason: This candidate is a duplicate of CVE-2010-5100.  Notes: All CVE users should reference CVE-2010-5100 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2346
Published: 2012-05-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-5101.  Reason: This candidate is a duplicate of CVE-2010-5101.  Notes: All CVE users should reference CVE-2010-5101 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2347
Published: 2012-05-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-5102.  Reason: This candidate is a duplicate of CVE-2010-5102.  Notes: All CVE users should reference CVE-2010-5102 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2348
Published: 2012-05-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-5103.  Reason: This candidate is a duplicate of CVE-2010-5103.  Notes: All CVE users should reference CVE-2010-5103 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2561
Published: 2012-05-21
Description: HP Business Service Management (BSM) 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component via a crafted request to TCP port 1098, 1099, or 4444.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6810&w=2; http://osvdb.org/81981; http://secunia.com/advisories/49218
CVE: CVE-2012-2918
Published: 2012-05-21
Description: Cross-site scripting (XSS) vulnerability in Upload/engine.php in Chevereto 1.91 allows remote attackers to inject arbitrary web script or HTML via the v parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112585/Chevreto-Upload-Script-Cross-Site-Scripting-User-Enumeration.html; http://www.securityfocus.com/bid/53448; https://exchange.xforce.ibmcloud.com/vulnerabilities/75476
CVE: CVE-2012-2919
Published: 2012-05-21
Description: Directory traversal vulnerability in Upload/engine.php in Chevereto 1.9.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in the v parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/files/112585/Chevreto-Upload-Script-Cross-Site-Scripting-User-Enumeration.html; http://www.securityfocus.com/bid/53448; https://exchange.xforce.ibmcloud.com/vulnerabilities/75477
CVE: CVE-2012-2920
Published: 2012-05-21
Description: Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plugin before 0.9.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to wp-admin/options-general.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/81806; http://plugins.trac.wordpress.org/changeset?old_path=%2Fuser-photo&old=541880&new_path=%2Fuser-photo&new=541880; http://secunia.com/advisories/49100
CVE: CVE-2012-2921
Published: 2012-05-21
Description: Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://freecode.com/projects/feedparser/releases/344371; http://osvdb.org/81701; http://secunia.com/advisories/49256
CVE: CVE-2012-2922
Published: 2012-05-21
Description: The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q[] parameter to index.php, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2012-05/0052.html; http://archives.neohapsis.com/archives/bugtraq/2012-05/0053.html; http://archives.neohapsis.com/archives/bugtraq/2012-05/0055.html
CVE: CVE-2012-2923
Published: 2012-05-21
Description: SQL injection vulnerability in news.php4 in Hypermethod eLearning Server 4G allows remote attackers to execute arbitrary SQL commands via the nid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/81830; http://secunia.com/advisories/49126; http://www.exploit-db.com/exploits/18858
CVE: CVE-2012-2924
Published: 2012-05-21
Description: PHP remote file inclusion vulnerability in admin/setup.inc.php in Hypermethod eLearning Server 4G allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/18858; http://www.osvdb.org/81831; http://www.securityfocus.com/bid/53472
CVE: CVE-2012-2925
Published: 2012-05-21
Description: SQL injection vulnerability in engine.php in Simple PHP Agenda 2.2.8 allows remote attackers to execute arbitrary SQL commands via the priority parameter in an addTodo action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18845; https://exchange.xforce.ibmcloud.com/vulnerabilities/75501; http://www.exploit-db.com/exploits/18845
CVE: CVE-2012-2562
Published: 2012-05-22
Description: The Xelex MobileTrack application 2.3.7 and earlier for Android does not verify the origin of SMS commands, which allows remote attackers to execute a (1) LOCATE, (2) TRACK, (3) UPDATECFG, (4) UPDATEACCT, (5) STAT, (6) TERM, or (7) WIPE command via an SMS message.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20, CWE-287
References: http://blog.mobiledefense.com/2012/05/mobile-defense-finds-two-security-vulnerabilities-in-xelex-mobiletrack/; http://secunia.com/advisories/49268; http://www.kb.cert.org/vuls/id/464683
CVE: CVE-2012-2567
Published: 2012-05-22
Description: The Xelex MobileTrack application 2.3.7 and earlier for Android uses hardcoded credentials, which allows remote attackers to obtain sensitive information via an unencrypted (1) FTP or (2) HTTP session.
CVSS Score: 2.6 (LOW)
CWE: CWE-255
References: http://blog.mobiledefense.com/2012/05/mobile-defense-finds-two-security-vulnerabilities-in-xelex-mobiletrack/; http://secunia.com/advisories/49268; http://www.kb.cert.org/vuls/id/464683
CVE: CVE-2012-2926
Published: 2012-05-22
Description: Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
CVSS Score: 9.1 (CRITICAL)
References: http://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2012-05-17; http://confluence.atlassian.com/display/CROWD/Crowd+Security+Advisory+2012-05-17; http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17
CVE: CVE-2012-2927
Published: 2012-05-22
Description: The TM Software Tempo plugin before 6.4.3.1, 6.5.x before 6.5.0.2, and 7.x before 7.0.3 for Atlassian JIRA does not properly restrict the capabilities of third-party XML parsers, which allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17; http://osvdb.org/81993; http://secunia.com/advisories/49166
CVE: CVE-2012-2928
Published: 2012-05-22
Description: The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17; http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17; http://osvdb.org/81993
CVE: CVE-2012-1990
Published: 2012-05-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric Kerweb before 3.0.1 and Kerwin before 6.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the evtvariablename parameter in an evts.xml action to kw.dll, (2) unspecified search fields, or (3) unspecified content-display fields.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49041; http://www.phocean.net/2012/05/08/cve-2012-1990-kerwebkerwin-xss-vulnerabilities.html; http://www.securityfocus.com/bid/53409
CVE: CVE-2012-2759
Published: 2012-05-22
Description: Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter in a lostpassword action to wp-login.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/81712; http://plugins.trac.wordpress.org/changeset/541069; http://wordpress.org/extend/plugins/login-with-ajax/changelog/
CVE: CVE-2012-2369
Published: 2012-05-23
Description: Format string vulnerability in the log_message_cb function in otr-plugin.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 3.2.1 for Pidgin might allow remote attackers to execute arbitrary code via format string specifiers in data that generates a log message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00003.html; http://openwall.com/lists/oss-security/2012/05/16/2; http://security.gentoo.org/glsa/glsa-201207-05.xml
CVE: CVE-2012-2374
Published: 2012-05-23
Description: CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://openwall.com/lists/oss-security/2012/05/18/12; http://secunia.com/advisories/49185; http://www.openwall.com/lists/oss-security/2012/05/18/6
CVE: CVE-2012-0289
Published: 2012-05-23
Description: Buffer overflow in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.710x and Symantec Network Access Control (SNAC) 11.0.600x through 11.0.710x allows local users to gain privileges, and modify data or cause a denial of service, via a crafted script.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/51795; http://www.securitytracker.com/id?1027093; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_01
CVE: CVE-2012-0294
Published: 2012-05-23
Description: Directory traversal vulnerability in the Manager service in the management console in Symantec Endpoint Protection (SEP) 12.1 before 12.1 RU1-MP1 allows remote attackers to delete files via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/53182; http://www.securitytracker.com/id?1027093; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_01
CVE: CVE-2012-0295
Published: 2012-05-23
Description: The Manager service in the management console in Symantec Endpoint Protection (SEP) 12.1 before 12.1 RU1-MP1 allows remote attackers to conduct file-insertion attacks and execute arbitrary code by leveraging exploitation of CVE-2012-0294.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/53183; http://www.securityfocus.com/bid/53184; http://www.securitytracker.com/id?1027093
CVE: CVE-2011-5090
Published: 2012-05-24
Description: GR Board (aka grboard) 1.8.6.5 Community Edition does not require authentication for certain database actions, which allows remote attackers to modify or delete data via a request to (1) mod_rewrite.php, (2) comment_write_ok.php, (3) poll/index.php, (4) update/index.php, (5) trackback.php, or (6) an arbitrary poll.php script under theme/.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://sirini.net/grboard/board.php?id=developer&articleNo=591; https://exchange.xforce.ibmcloud.com/vulnerabilities/75856; http://sirini.net/grboard/board.php?id=developer&articleNo=591
CVE: CVE-2011-5091
Published: 2012-05-24
Description: Multiple SQL injection vulnerabilities in GR Board (aka grboard) 1.8.6.5 Community Edition allow remote attackers to execute arbitrary SQL commands via the (1) tableType or (2) blindTarget parameter to view.php, (3) the delTargets[0] parameter to view_memo.php, or (4) the isReported parameter to write_ok.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://sirini.net/grboard/board.php?id=developer&articleNo=591; https://exchange.xforce.ibmcloud.com/vulnerabilities/75855; http://sirini.net/grboard/board.php?id=developer&articleNo=591
CVE: CVE-2012-1172
Published: 2012-05-24
Description: The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://isisblogs.poly.edu/2011/08/11/php-not-properly-checking-params/; http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080037.html
CVE: CVE-2012-1821
Published: 2012-05-24
Description: The Network Threat Protection module in the Manager component in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.700x on Windows Server 2003 allows remote attackers to cause a denial of service (web-server outage, or daemon crash or hang) via a flood of packets that triggers automated blocking of network traffic.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/82147; http://secunia.com/advisories/49221; http://www.kb.cert.org/vuls/id/149070
CVE: CVE-2012-2042
Published: 2012-05-24
Description: Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0780, CVE-2012-2023, CVE-2012-2024, CVE-2012-2025, and CVE-2012-2026.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb12-10.html; http://www.securitytracker.com/id?1027047; http://www.adobe.com/support/security/bulletins/apsb12-10.html
CVE: CVE-2011-3103
Published: 2012-05-24
Description: Google V8, as used in Google Chrome before 19.0.1084.52, does not properly perform garbage collection, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=117409; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update_23.html; http://secunia.com/advisories/49277
CVE: CVE-2011-3104
Published: 2012-05-24
Description: Skia, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=118018; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update_23.html; http://secunia.com/advisories/49277
CVE: CVE-2011-3105
Published: 2012-05-24
Description: Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the :first-letter pseudo-element.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=120912; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update_23.html; http://lists.apple.com/archives/security-announce/2012/Sep/msg00001.html
CVE: CVE-2011-3106
Published: 2012-05-24
Description: The WebSockets implementation in Google Chrome before 19.0.1084.52 does not properly handle use of SSL, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=122654; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update_23.html; http://osvdb.org/82251
CVE: CVE-2011-3107
Published: 2012-05-24
Description: Google Chrome before 19.0.1084.52 does not properly implement JavaScript bindings for plug-ins, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=124625; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update_23.html; http://osvdb.org/82252
CVE: CVE-2011-3108
Published: 2012-05-24
Description: Use-after-free vulnerability in Google Chrome before 19.0.1084.52 allows remote attackers to execute arbitrary code via vectors related to the browser cache.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=125159; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update_23.html; http://secunia.com/advisories/49277
CVE: CVE-2011-3109
Published: 2012-05-24
Description: Google Chrome before 19.0.1084.52 on Linux does not properly perform a cast of an unspecified variable, which allows remote attackers to cause a denial of service or possibly have unknown other impact by leveraging an error in the GTK implementation of the UI.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=126296; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update_23.html; http://secunia.com/advisories/49277
CVE: CVE-2011-3110
Published: 2012-05-24
Description: The PDF functionality in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=126337; http://code.google.com/p/chromium/issues/detail?id=126343; http://code.google.com/p/chromium/issues/detail?id=126378
CVE: CVE-2011-3111
Published: 2012-05-24
Description: Google V8, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service (invalid read operation) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=126414; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update_23.html; http://secunia.com/advisories/49277
CVE: CVE-2011-3112
Published: 2012-05-24
Description: Use-after-free vulnerability in the PDF functionality in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via an invalid encrypted document.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=127331; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update_23.html; http://osvdb.org/82247
CVE: CVE-2011-3113
Published: 2012-05-24
Description: The PDF functionality in Google Chrome before 19.0.1084.52 does not properly perform a cast of an unspecified variable during handling of color spaces, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=127883; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update_23.html; http://osvdb.org/82248
CVE: CVE-2011-3114
Published: 2012-05-24
Description: Multiple buffer overflows in the PDF functionality in Google Chrome before 19.0.1084.52 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unknown function calls.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=128014; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update_23.html; http://osvdb.org/82249
CVE: CVE-2011-3115
Published: 2012-05-24
Description: Google V8, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger "type corruption."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=128018; http://googlechromereleases.blogspot.com/2012/05/stable-channel-update_23.html; http://secunia.com/advisories/49277
CVE: CVE-2011-2517
Published: 2012-05-24
Description: Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID value.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.2; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=208c72f4fe44fe09577e7975ba0e7fa0278f3d03; http://rhn.redhat.com/errata/RHSA-2011-1212.html
CVE: CVE-2011-2518
Published: 2012-05-24
Description: The tomoyo_mount_acl function in security/tomoyo/mount.c in the Linux kernel before 2.6.39.2 calls the kern_path function with arguments taken directly from a mount system call, which allows local users to cause a denial of service (OOPS) or possibly have unspecified other impact via a NULL value for the device name.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.2; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4e78c724d47e2342aa8fde61f6b8536f662f795f; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6211&w=2