deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-4506
Published: 2011-11-22
Description: The UPnP IGD implementation on the Thomson (aka Technicolor) TG585 with firmware 7.x before 7.4.3.2 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://toor.do/DEFCON-19-Garcia-UPnP-Mapping-WP.pdf; http://www.kb.cert.org/vuls/id/357851; http://toor.do/DEFCON-19-Garcia-UPnP-Mapping-WP.pdf
CVE: CVE-2011-4507
Published: 2011-11-22
Description: The D-Link DIR-685 router, when certain WPA and WPA2 configurations are used, does not maintain an encrypted wireless network during transfer of a large amount of network traffic, which allows remote attackers to obtain sensitive information or bypass authentication via a Wi-Fi device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/924307; http://www.kb.cert.org/vuls/id/924307
CVE: CVE-2010-5046
Published: 2011-11-23
Description: Cross-site scripting (XSS) vulnerability in admin.php in ecoCMS allows remote attackers to inject arbitrary web script or HTML via the p parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/64308; http://packetstormsecurity.org/1005-exploits/ecocms-xss.txt; http://secunia.com/advisories/39678
CVE: CVE-2010-5047
Published: 2011-11-23
Description: SQL injection vulnerability in page.php in V-EVA Press Release Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/64636; http://packetstormsecurity.org/1005-exploits/pressrelease-sql.txt; http://secunia.com/advisories/39826
CVE: CVE-2010-5048
Published: 2011-11-23
Description: Cross-site scripting (XSS) vulnerability in admin.jcomments.php in the JoomlaTune JComments (com_jcomments) component 2.1.0.0 for Joomla! allows remote authenticated users to inject arbitrary web script or HTML via the name parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1005-exploits/joomlajcomments-xss.txt; http://secunia.com/advisories/39842; http://www.htbridge.ch/advisory/xss_vulnerability_in_jcomments_joomla.html
CVE: CVE-2010-5049
Published: 2011-11-23
Description: SQL injection vulnerability in events.php in Zabbix 1.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the nav_time parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/zabbix181-sql.txt; http://secunia.com/advisories/39119; http://www.securityfocus.com/archive/1/511454/100/0/threaded
CVE: CVE-2010-5050
Published: 2011-11-23
Description: Cross-site scripting (XSS) vulnerability in jsp/admin/tools/remote_share.jsp in ManageEngine ADManager Plus 4.4.0 allows remote attackers to inject arbitrary web script or HTML via the computerName parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/64857; http://secunia.com/advisories/39901; http://www.securityfocus.com/bid/40355
CVE: CVE-2010-5051
Published: 2011-11-23
Description: Cross-site scripting (XSS) vulnerability in admin/core/admin_func.php in razorCMS 1.0 stable allows remote attackers to inject arbitrary web script or HTML via the content parameter in an edit action to admin/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/39961; http://www.htbridge.ch/advisory/xss_vulnerability_in_razorcms.html; http://www.securityfocus.com/archive/1/511457/100/0/threaded
CVE: CVE-2010-5052
Published: 2011-11-23
Description: Cross-site scripting (XSS) vulnerability in admin/components.php in GetSimple CMS 2.01 allows remote attackers to inject arbitrary web script or HTML via the val[] parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.htbridge.ch/advisory/xss_vulnerability_in_getsimple_cms.html; http://www.securityfocus.com/archive/1/511458/100/0/threaded; http://www.securityfocus.com/bid/40374
CVE: CVE-2010-5053
Published: 2011-11-23
Description: SQL injection vulnerability in the XOBBIX (com_xobbix) component 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the prodid parameter in a prod_desc action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/joomlaxobbix-sql.txt; http://secunia.com/advisories/39312; http://www.exploit-db.com/exploits/12097
CVE: CVE-2010-5054
Published: 2011-11-23
Description: Cross-site scripting (XSS) vulnerability in Special:Login in JAMWiki before 0.8.4 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jamwiki.svn.sourceforge.net/viewvc/jamwiki/wiki/branches/0.8.x/jamwiki-war/src/main/webapp/CHANGELOG.txt?view=markup&revision=2995; http://secunia.com/advisories/39335; http://www.securityfocus.com/bid/39225
CVE: CVE-2010-5055
Published: 2011-11-23
Description: SQL injection vulnerability in index.php in Almnzm 2.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/63843; http://packetstormsecurity.org/1004-exploits/almnrzm-sql.txt; http://secunia.com/advisories/39452
CVE: CVE-2010-5056
Published: 2011-11-23
Description: SQL injection vulnerability in the GBU Facebook (com_gbufacebook) component 1.0.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the face_id parameter in a show_face action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/joomlagbufacebook-sql.txt; http://secunia.com/advisories/39487; http://www.exploit-db.com/exploits/12299
CVE: CVE-2010-5057
Published: 2011-11-23
Description: SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL commands via the tipodoc_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/cmsariadna-sql.txt; http://secunia.com/advisories/39486; http://www.exploit-db.com/exploits/12301
CVE: CVE-2010-5058
Published: 2011-11-23
Description: SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL commands via the res_id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/39486; https://exchange.xforce.ibmcloud.com/vulnerabilities/57945; http://secunia.com/advisories/39486
CVE: CVE-2010-5059
Published: 2011-11-23
Description: SQL injection vulnerability in index.php in CMScout 2.0.8 allows remote attackers to execute arbitrary SQL commands via the album parameter in a photos action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/cmscout-sql.txt; http://secunia.com/advisories/39602; http://www.exploit-db.com/exploits/12407
CVE: CVE-2010-5060
Published: 2011-11-23
Description: SQL injection vulnerability in Nus.php in NUs Newssystem 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1003-exploits/nusnewssystem-sql.txt; http://secunia.com/advisories/38890; http://www.exploit-db.com/exploits/11674
CVE: CVE-2010-5061
Published: 2011-11-23
Description: SQL injection vulnerability in index.php in RSStatic allows remote attackers to execute arbitrary SQL commands via the maxarticles parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1003-exploits/rsstatic-sql.txt; http://www.exploit-db.com/exploits/11665; http://www.securityfocus.com/bid/38623
CVE: CVE-2010-5062
Published: 2011-11-23
Description: SQL injection vulnerability in search.php in MH Products kleinanzeigenmarkt allows remote attackers to execute arbitrary SQL commands via the c parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1003-exploits/mhproducts-sql.txt; http://secunia.com/advisories/38897; http://www.exploit-db.com/exploits/11671
CVE: CVE-2011-2708
Published: 2011-11-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-2710.  Reason: This candidate is a duplicate of CVE-2011-2710.  Notes: All CVE users should reference CVE-2011-2710 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-4331
Published: 2011-11-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-4110.  Reason: This candidate is a duplicate of CVE-2011-4110.  Notes: All CVE users should reference CVE-2011-4110 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-4321
Published: 2011-11-23
Description: The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://developer.joomla.org/security/news/9-security/10-core-security/[PII_REDACTED]3-core-password-change; http://www.openwall.com/lists/oss-security/2011/11/21/1; http://developer.joomla.org/security/news/9-security/10-core-security/[PII_REDACTED]3-core-password-change
CVE: CVE-2011-4332
Published: 2011-11-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.6.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/news/[PII_REDACTED]1-xss-vulnerabilities.html; http://seclists.org/fulldisclosure/2011/Nov/142; http://www.mavitunasecurity.com/xss-vulnerability-in-joomla-163/
CVE: CVE-2011-4160
Published: 2011-11-24
Description: Unspecified vulnerability in HP Operations Agent 11.00 and Performance Agent 4.73 and 5.0 on AIX, HP-UX, Linux, and Solaris allows local users to bypass intended directory-access restrictions via unknown vectors.
CVSS Score: 3.2 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0785&w=2; http://secunia.com/advisories/46971; http://www.securityfocus.com/bid/50761
CVE: CVE-2011-4312
Published: 2011-11-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in the commenting system in Review Board before 1.5.7 and 1.6.x before 1.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) diff viewer or (2) screenshot component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-November/070091.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/070176.html; http://secunia.com/advisories/46840
CVE: CVE-2011-4548
Published: 2011-11-24
Description: Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.44 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2011/11/beta-channel-update-for-chromebooks_22.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/71613; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14107
CVE: CVE-2011-4244
Published: 2011-11-24
Description: Heap-based buffer overflow in the RealVideo renderer in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4245
Published: 2011-11-24
Description: The RealVideo renderer in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4246
Published: 2011-11-24
Description: The AAC codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4247
Published: 2011-11-24
Description: RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted QCELP stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4248
Published: 2011-11-24
Description: RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a malformed AAC file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4249
Published: 2011-11-24
Description: Array index error in the RV30 codec in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4250
Published: 2011-11-24
Description: Unspecified vulnerability in the ATRC codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4251
Published: 2011-11-24
Description: RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted sample size in a RealAudio file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4252
Published: 2011-11-24
Description: The RV10 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via a crafted sample height.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4253
Published: 2011-11-24
Description: Unspecified vulnerability in the RV20 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4254
Published: 2011-11-24
Description: RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted RTSP SETUP request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4255
Published: 2011-11-24
Description: Unspecified vulnerability in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via an invalid codec name.
CVSS Score: 10.0 (HIGH)
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4256
Published: 2011-11-24
Description: The RV30 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 does not initialize an unspecified index value, which allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4257
Published: 2011-11-24
Description: The Cook codec in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via crafted channel data.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4258
Published: 2011-11-24
Description: RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted length of an MLTI chunk in an IVR file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4259
Published: 2011-11-24
Description: Integer underflow in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted width value in an MPG file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4260
Published: 2011-11-24
Description: RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a malformed header in an MP4 file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4261
Published: 2011-11-24
Description: RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted video dimensions in an MP4 file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-4262
Published: 2011-11-24
Description: Unspecified vulnerability in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted MP4 file.
CVSS Score: 9.3 (HIGH)
References: http://service.real.com/realplayer/security/11182011_player/en/; http://service.real.com/realplayer/security/11182011_player/en/
CVE: CVE-2011-1378
Published: 2011-11-26
Description: IBM WebSphere MQ 6.0 on OpenVMS, when the default rights of the MQM group are established, does not properly verify User Authorization File (UAF) data, which allows local users to kill listener processes and the command server via a control command.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/46837; http://www-01.ibm.com/support/docview.wss?uid=swg1IC78034; https://exchange.xforce.ibmcloud.com/vulnerabilities/71336
CVE: CVE-2011-3828
Published: 2011-11-26
Description: DVRemoteAx.ax 2.1.0.39 in the DVR Remote ActiveX control allows remote attackers to execute arbitrary code via a crafted DVRobot.dll file in a manifest directory on a web server.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/secunia_research/2011-80/; http://www.securityfocus.com/archive/1/520549/100/100/threaded; http://secunia.com/secunia_research/2011-80/
CVE: CVE-2011-4275
Published: 2011-11-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in iTop (aka IT Operations Portal) 1.1.181 and 1.2.0-RC-282 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted company name, (2) a crafted database server name, (3) a crafted CSV file, (4) a crafted copy-and-paste action, (5) the auth_user parameter in a suggest_pwd action to UI.php, (6) the c[menu] parameter to UniversalSearch.php, (7) the description parameter in a SearchFormToAdd_document_list action to UI.php, (8) the category parameter in an errors action to audit.php, or (9) the suggest_pwd parameter to UI.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/520632; http://www.securityfocus.com/archive/1/520632/100/0/threaded; http://www.tele-consulting.com/advisories/TC-SA-2011-02.txt
CVE: CVE-2011-1372
Published: 2011-11-28
Description: The Web User Interface on the IBM TS3100 and TS3200 tape libraries with firmware before A.60 allows remote attackers to bypass authentication and obtain administrative access via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://www.ibm.com/support/docview.wss?uid=ssg1S1003938; https://exchange.xforce.ibmcloud.com/vulnerabilities/71026; http://www.ibm.com/support/docview.wss?uid=ssg1S1003938
CVE: CVE-2011-4319
Published: 2011-11-28
Description: Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b61d70fb73c7cc5?pli=1; http://groups.google.com/group/rubyonrails-security/msg/c65c24fbc4b6dd82?dmode=source&output=gplain; http://openwall.com/lists/oss-security/2011/11/18/8
CVE: CVE-2011-4329
Published: 2011-11-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter in a setup action to admin/company.php, or the PATH_INFO to (2) admin/security_other.php, (3) admin/events.php, or (4) admin/user.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2011-11/0052.html; http://archives.neohapsis.com/archives/bugtraq/2011-11/0138.html; http://www.securityfocus.com/bid/50617
CVE: CVE-2011-4335
Published: 2011-11-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php in a (1) teachers.html or (2) teachers/ action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dev.contao.org/projects/typolight/repository/revisions/1041; http://openwall.com/lists/oss-security/2011/11/21/30; http://openwall.com/lists/oss-security/2011/11/22/1
CVE: CVE-2011-4559
Published: 2011-11-28
Description: SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/76138; http://seclists.org/fulldisclosure/2011/Oct/224; http://www.securityfocus.com/archive/1/520006/100/0/threaded
CVE: CVE-2011-4560
Published: 2011-11-28
Description: Cross-site scripting (XSS) vulnerability in the Petition Node module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to signing a petition.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1300238; http://osvdb.org/76094; http://secunia.com/advisories/46333