deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5273
Published: 2012-10-23
Description: Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4173, CVE-2012-4174, and CVE-2012-4175.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/86541; http://www.adobe.com/support/security/bulletins/apsb12-23.html; http://www.securityfocus.com/bid/56187
CVE: CVE-2012-5302
Published: 2012-10-24
Description: The server in TIBCO Formvine 3.1.x and 3.2.x before 3.2.1 does not properly implement access control, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/86606; http://www.securityfocus.com/bid/56225; http://www.tibco.com/multimedia/formvine-advisory-2012-10-23_tcm8-17451.txt
CVE: CVE-2012-5387
Published: 2012-10-24
Description: Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, as demonstrated by a developer name containing XSS sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/86568; http://packetstormsecurity.org/files/117590/White-Label-CMS-1.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://wordpress.org/extend/plugins/white-label-cms/changelog/
CVE: CVE-2012-5388
Published: 2012-10-24
Description: Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-5387.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.org/files/117590/White-Label-CMS-1.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://wordpress.org/extend/plugins/white-label-cms/changelog/; http://www.exploit-db.com/exploits/22156/
CVE: CVE-2012-5456
Published: 2012-10-24
Description: The Zoner AntiVirus Free application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, as demonstrated by a server used for updating virus signature files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www.securityfocus.com/bid/56292; http://www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79591
CVE: CVE-2012-3506
Published: 2012-10-25
Description: Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://ofbiz.apache.org/download.html#vulnerabilities; http://osvdb.org/86556; http://seclists.org/fulldisclosure/2012/Oct/156
CVE: CVE-2012-5339
Published: 2012-10-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html; http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php; http://www.securityfocus.com/bid/55925
CVE: CVE-2012-5368
Published: 2012-10-25
Description: phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html; http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php; http://www.securityfocus.com/bid/55939
CVE: CVE-2012-5672
Published: 2012-10-25
Description: Microsoft Excel Viewer (aka Xlview.exe) and Excel in Microsoft Office 2007 (aka Office 12) allow remote attackers to cause a denial of service (read access violation and application crash) via a crafted spreadsheet file, as demonstrated by a .xls file with battery voltage data.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/524379; http://www.securityfocus.com/archive/1/524379
CVE: CVE-2012-3936
Published: 2012-10-25
Description: Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCua40962.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/86141; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-webex; http://www.securityfocus.com/bid/55866
CVE: CVE-2012-3937
Published: 2012-10-25
Description: Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72967.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/86142; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-webex; http://www.securityfocus.com/bid/55866
CVE: CVE-2012-3938
Published: 2012-10-25
Description: Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz73583.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/86143; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-webex; http://www.securityfocus.com/bid/55866
CVE: CVE-2012-3939
Published: 2012-10-25
Description: Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted WRF file, aka Bug ID CSCua61331.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/86138; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-webex; http://www.securityfocus.com/bid/55866
CVE: CVE-2012-3940
Published: 2012-10-25
Description: Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72958.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/86139; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-webex; http://www.securityfocus.com/bid/55866
CVE: CVE-2012-3941
Published: 2012-10-25
Description: Heap-based buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72850.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/86140; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-webex; http://www.securityfocus.com/bid/55866
CVE: CVE-2011-5213
Published: 2012-10-25
Description: Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login[username] parameter to index.php, (2) parent_id parameter to modules/Documents/version_list.php, or (3) contact_id parameter to modules/Documents/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/77733; http://osvdb.org/77734; http://osvdb.org/77735
CVE: CVE-2011-5214
Published: 2012-10-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) modules/admin/admin_module_index.php, or (3) modules/calendar/customise_calendar_times.php; login[] parameter to (4) index.php or (5) pub/clients.php; or framed parameter to (6) licence/index.php or (7) licence/view.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/77728; http://osvdb.org/77729; http://osvdb.org/77730
CVE: CVE-2011-5215
Published: 2012-10-25
Description: SQL injection vulnerability in index.php in Video Community Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/77946; http://packetstormsecurity.org/files/107970/videoportalneu-sql.txt; http://secunia.com/advisories/47287
CVE: CVE-2011-5216
Published: 2012-10-25
Description: SQL injection vulnerability in ajax.php in SCORM Cloud For WordPress plugin before 1.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the active parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://plugins.trac.wordpress.org/changeset/435356/scormcloud; http://secunia.com/advisories/47198; http://wordpress.org/extend/plugins/scormcloud/changelog/
CVE: CVE-2011-5217
Published: 2012-10-25
Description: Directory traversal vulnerability in the PXE Mtftp service in Hitachi JP1/ServerConductor/DeploymentManager before 08-55 Japanese and before 08-51 English allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/77739; http://secunia.com/advisories/47221; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS11-026/index.html
CVE: CVE-2011-5218
Published: 2012-10-25
Description: SQL injection vulnerability in DotA OpenStats 1.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/77944; http://secunia.com/advisories/47261; http://www.exploit-db.com/exploits/18250
CVE: CVE-2011-5219
Published: 2012-10-25
Description: Directory traversal vulnerability in examples/show_code.php in mPDF 5.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/77939; http://secunia.com/advisories/47262; http://www.exploit-db.com/exploits/18248
CVE: CVE-2011-5220
Published: 2012-10-25
Description: Cross-site scripting (XSS) vulnerability in templates/default/Admin/Login.html in PHP-SCMS 1.6.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/77692; http://secunia.com/advisories/46766; http://www.rul3z.de/advisories/SSCHADV2011-035.txt
CVE: CVE-2011-5221
Published: 2012-10-25
Description: Cross-site scripting (XSS) vulnerability in the getLog function in svnlook.php in WebSVN before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to (1) comp.php, (2) diff.php, or (3) revision.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/77941; http://osvdb.org/77942; http://osvdb.org/77943
CVE: CVE-2011-5222
Published: 2012-10-25
Description: SQL injection vulnerability in rub2_w.php in PHP Flirt-Projekt 4.8 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the rub parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/77945; http://packetstormsecurity.org/files/107971/flirtportal-sql.txt; http://secunia.com/advisories/47290
CVE: CVE-2011-5223
Published: 2012-10-25
Description: Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti before 0.8.7i allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.cacti.net/view.php?id=2062; http://forums.cacti.net/viewtopic.php?f=21&t=44116; http://forums.cacti.net/viewtopic.php?f=4&t=45871
CVE: CVE-2011-5224
Published: 2012-10-25
Description: SQL injection vulnerability in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/77779; http://plugins.trac.wordpress.org/changeset?reponame=&new=475315%40wordpress-sentinel&old=474998%40wordpress-sentinel; http://wordpress.org/extend/plugins/wordpress-sentinel/changelog/
CVE: CVE-2011-5225
Published: 2012-10-25
Description: Cross-site scripting (XSS) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/77777; http://plugins.trac.wordpress.org/changeset?reponame=&new=475315%40wordpress-sentinel&old=474998%40wordpress-sentinel; http://secunia.com/advisories/47020
CVE: CVE-2011-5226
Published: 2012-10-25
Description: Cross-site request forgery (CSRF) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to hijack the authentication of an administrator for requests that trigger snapshots.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/77778; http://plugins.trac.wordpress.org/changeset?reponame=&new=475315%40wordpress-sentinel&old=474998%40wordpress-sentinel; http://secunia.com/advisories/47020
CVE: CVE-2011-5227
Published: 2012-10-25
Description: Stack-based buffer overflow in the Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 allows remote attackers to execute arbitrary code via a long PRIO field in a message to UDP port 514.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/47263; http://www.securitytracker.com/id?1026440; http://www.zerodayinitiative.com/advisories/ZDI-11-350/
CVE: CVE-2011-5228
Published: 2012-10-25
Description: Cross-site scripting (XSS) vulnerability in the Search module (quickstart/search) in appRain CMF 0.1.5 allows remote attackers to inject arbitrary web script or HTML via the ss parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/18249; http://www.securityfocus.com/bid/51105; http://www.vulnerability-lab.com/get_content.php?id=362
CVE: CVE-2011-5229
Published: 2012-10-25
Description: SQL injection vulnerability in quickstart/profile/index.php in the Forum module in appRain CMF 0.1.5 allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18249; http://www.securityfocus.com/bid/51105; http://www.vulnerability-lab.com/get_content.php?id=362
CVE: CVE-2011-5230
Published: 2012-10-25
Description: Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/LoginModel.php in Seotoaster 1.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to sys/login/index or (2) memberLoginName parameter to sys/login/member.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/77736; http://secunia.com/advisories/46881; http://www.exploit-db.com/exploits/18246
CVE: CVE-2011-5231
Published: 2012-10-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-0023.  Reason: This candidate is a duplicate of CVE-2012-0023.  Notes: All CVE users should reference CVE-2012-0023 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-5232
Published: 2012-10-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-0025.  Reason: This candidate is a duplicate of CVE-2012-0025.  Notes: All CVE users should reference CVE-2012-0025 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-5233
Published: 2012-10-25
Description: Heap-based buffer overflow in IrfanView before 4.32 allows remote attackers to execute arbitrary code via crafted "Rows Per Strip" and "Samples Per Pixel" values in a TIFF image file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/47065; http://www.exploit-db.com/exploits/18257; http://www.irfanview.com/history_old.htm
CVE: CVE-2011-5234
Published: 2012-10-25
Description: SQL injection vulnerability in user.php in Social Network Community 2 allows remote attackers to execute arbitrary SQL commands via the userId parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/107972/social2-sql.txt; http://secunia.com/advisories/47289; http://www.osvdb.org/77950
CVE: CVE-2011-5235
Published: 2012-10-25
Description: SQL injection vulnerability in mnoGoSearch before 3.3.12 allows remote attackers to execute arbitrary SQL commands via the hostname in a hypertext link.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/47272; http://www.mnogosearch.org/doc33/msearch-changelog.html#changelog-3-3-12; http://www.osvdb.org/77949
CVE: CVE-2012-4019
Published: 2012-10-26
Description: Cross-site scripting (XSS) vulnerability in tokyo_bbs.cgi in Come on Girls Interface (CGI) Tokyo BBS allows remote attackers to inject arbitrary web script or HTML via vectors related to the error page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN00322303/995209/index.html; http://jvn.jp/en/jp/JVN00322303/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000093
CVE: CVE-2012-4501
Published: 2012-10-26
Description: Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-10/0062.html; http://cloudstack.org/blog/185-cloudstack-configuration-vulnerability-discovered.html; http://markmail.org/thread/yfuxgymdqwg3kcg4
CVE: CVE-2012-4729
Published: 2012-10-26
Description: Wing FTP Server before 4.1.1 allows remote authenticated users to cause a denial of service (daemon crash) via two zip commands.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-10/0052.html; http://osvdb.org/86132; http://www.securityfocus.com/bid/55847
CVE: CVE-2012-5470
Published: 2012-10-26
Description: libpng_plugin in VideoLAN VLC media player 2.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted PNG file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://openwall.com/lists/oss-security/2012/10/24/3; http://www.exploit-db.com/exploits/21889/; http://www.securityfocus.com/bid/55850
CVE: CVE-2012-4447
Published: 2012-10-28
Description: Heap-based buffer overflow in tif_pixarlog.c in LibTIFF before 4.0.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted TIFF image using the PixarLog Compression format.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2013-01/msg00076.html; http://rhn.redhat.com/errata/RHSA-2012-1590.html; http://secunia.com/advisories/49938
CVE: CVE-2012-4194
Published: 2012-10-29
Description: Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 do not prevent use of the valueOf method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00025.html; http://rhn.redhat.com/errata/RHSA-2012-1407.html
CVE: CVE-2012-4195
Published: 2012-10-29
Description: The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, and makes it easier for remote attackers to execute arbitrary JavaScript code by leveraging certain add-on behavior.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00025.html; http://rhn.redhat.com/errata/RHSA-2012-1407.html
CVE: CVE-2012-4196
Published: 2012-10-29
Description: Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy and read the Location object via a prototype property-injection attack that defeats certain protection mechanisms for this object.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-74
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00025.html; http://rhn.redhat.com/errata/RHSA-2012-1407.html
CVE: CVE-2012-4643
Published: 2012-10-29
Description: The DHCP server on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 7.0 before 7.2(5.8), 7.1 before 7.2(5.8), 7.2 before 7.2(5.8), 8.0 before 8.0(5.28), 8.1 before 8.1(2.56), 8.2 before 8.2(5.27), 8.3 before 8.3(2.31), 8.4 before 8.4(3.10), 8.5 before 8.5(1.9), and 8.6 before 8.6(1.5) does not properly allocate memory for DHCP packets, which allows remote attackers to cause a denial of service (device reload) via a series of crafted IPv4 packets, aka Bug ID CSCtw84068.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://osvdb.org/86145; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-asa; http://www.securityfocus.com/bid/55861
CVE: CVE-2012-4659
Published: 2012-10-29
Description: The AAA functionality in the IPv4 SSL VPN implementations on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.2 before 8.2(5.30) and 8.3 before 8.3(2.34) allows remote attackers to cause a denial of service (device reload) via a crafted authentication response, aka Bug ID CSCtz04566.
CVSS Score: 7.1 (HIGH)
CWE: CWE-287
References: http://osvdb.org/86137; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-asa; http://www.securityfocus.com/bid/55865
CVE: CVE-2012-4660
Published: 2012-10-29
Description: The SIP inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.2 before 8.2(5.17), 8.3 before 8.3(2.28), 8.4 before 8.4(2.13), 8.5 before 8.5(1.4), and 8.6 before 8.6(1.5) allows remote attackers to cause a denial of service (device reload) via a crafted SIP media-update packet, aka Bug ID CSCtr63728.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://osvdb.org/86144; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-asa; http://www.securityfocus.com/bid/55864