deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2319
Published: 2012-05-17
Description: Multiple buffer overflows in the hfsplus filesystem implementation in the Linux kernel before 3.3.5 allow local users to gain privileges via a crafted HFS plus filesystem, a related issue to CVE-2009-4020.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6f24f892871acc47b40dd594c63606a17c714f77; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html; http://rhn.redhat.com/errata/RHSA-2012-1323.html
CVE: CVE-2012-2337
Published: 2012-05-18
Description: sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended command restrictions in opportunistic circumstances by executing a command on a host that has an IPv4 address.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081432.html; http://secunia.com/advisories/49219; http://secunia.com/advisories/49244
CVE: CVE-2012-2406
Published: 2012-05-18
Description: RealNetworks RealPlayer before 15.0.4.53, and RealPlayer SP 1.0 through 1.1.5, does not properly parse ASMRuleBook data in RealMedia files, which allows remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/81943; http://secunia.com/advisories/49193; http://service.real.com/realplayer/security/05152012_player/en/
CVE: CVE-2012-2411
Published: 2012-05-18
Description: Buffer overflow in RealNetworks RealPlayer before 15.0.4.53, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via a crafted RealJukebox Media file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/81944; http://secunia.com/advisories/49193; http://service.real.com/realplayer/security/05152012_player/en/
CVE: CVE-2012-1589
Published: 2012-05-18
Description: Open redirect vulnerability in the Form API in Drupal 7.x before 7.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted parameters in a destination URL.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://drupal.org/node/1557938; http://jvn.jp/en/jp/JVN45898075/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000045
CVE: CVE-2012-2010
Published: 2012-05-18
Description: The ACMELOGIN implementation in HP OpenVMS 8.3 and 8.4 on the Alpha platform, and 8.3, 8.3-1H1, and 8.4 on the Itanium platform, when the SYS$ACM system service is enabled, allows local users to gain privileges via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/82015; http://www.securityfocus.com/bid/53613; http://www.securitytracker.com/id?1027074
CVE: CVE-2012-2093
Published: 2012-05-18
Description: src/common/latex.py in Gajim 0.15 allows local users to overwrite arbitrary files via a symlink attack on a temporary latex file, related to the get_tmpfile_name function.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://hg.gajim.org/gajim/rev/f046e4aaf7d4; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079169.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079237.html
CVE: CVE-2012-2118
Published: 2012-05-18
Description: Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://patchwork.freedesktop.org/patch/10001/; http://www.openwall.com/lists/oss-security/2012/04/18/8; http://www.openwall.com/lists/oss-security/2012/04/19/2
CVE: CVE-2012-2120
Published: 2012-05-18
Description: latex2man in texlive-extra-utils 2[PII_REDACTED]2, and possibly other versions or packages, when used with the H or T option, allows local users to overwrite arbitrary files via a symlink attack on a temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668779; http://www.openwall.com/lists/oss-security/2012/04/19/12; http://www.openwall.com/lists/oss-security/2012/04/19/15
CVE: CVE-2012-2320
Published: 2012-05-18
Description: ConnMan before 0.85 does not ensure that netlink messages originate from the kernel, which allows remote attackers to bypass intended access restrictions and cause a denial of service via a crafted netlink message.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://git.kernel.org/?p=network/connman/connman.git%3Ba=commit%3Bh=b0ec6eb4466acc57a9ea8be52c17b674b6ea0618; http://git.kernel.org/?p=network/connman/connman.git%3Ba=commit%3Bh=c1b968984212b46bea1330f5ae029507b9bfded9; http://secunia.com/advisories/49033
CVE: CVE-2012-2321
Published: 2012-05-18
Description: The loopback plug-in in ConnMan before 0.85 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) host name or (2) domain name in a DHCP reply.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/?p=network/connman/connman.git%3Ba=commit%3Bh=26ace5c59f790bce0f1988b88874c6f2c480fd5a; http://git.kernel.org/?p=network/connman/connman.git%3Ba=commit%3Bh=a5f540db7354b76bcabd0a05d8eb8ba2bff4e911; http://secunia.com/advisories/49033
CVE: CVE-2012-2322
Published: 2012-05-18
Description: Integer overflow in the dhcpv6_get_option function in gdhcp/client.c in ConnMan before 0.85 allows remote attackers to cause a denial of service (infinite loop and crash) via an invalid length value in a DHCP packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://git.kernel.org/?p=network/connman/connman.git%3Ba=commitdiff%3Bh=1d1a22fe586a[PII_REDACTED]08fbe8eaeada79df7f; http://secunia.com/advisories/49033; http://secunia.com/advisories/49186
CVE: CVE-2012-2341
Published: 2012-05-18
Description: Cross-site request forgery (CSRF) vulnerability in the Take Control module 6.x-2.x before 6.x-2.2 for Drupal allows remote attackers to hijack the authentication of unspecified users for Ajax requests that manipulate files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1243604; http://drupal.org/node/1569512; http://secunia.com/advisories/49060
CVE: CVE-2012-2376
Published: 2012-05-21
Description: Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments that trigger incorrect handling of COM object VARIANT types, as exploited in the wild in May 2012.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://isc.sans.edu/diary.html?storyid=13255; http://openwall.com/lists/oss-security/2012/05/20/2; http://www.exploit-db.com/exploits/18861/
CVE: CVE-2012-2901
Published: 2012-05-21
Description: Cross-site scripting (XSS) vulnerability in the Profile List in the Joomla Content Editor (JCE) component before 2.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the search parameter to administrator/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49206; http://secunia.com/secunia_research/2012-14/; http://www.joomlacontenteditor.net/news/item/jce-21-released?category_id=32
CVE: CVE-2012-2902
Published: 2012-05-21
Description: Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the Joomla Content Editor (JCE) component before 2.1 for Joomla!, when chunking is set to greater than zero, allows remote authors to execute arbitrary PHP code by uploading a PHP file with a double extension as demonstrated by .jpg.pht.
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/81980; http://secunia.com/advisories/49206; http://secunia.com/secunia_research/2012-15/
CVE: CVE-2012-2903
Published: 2012-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 7.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to group.php, or the (2) target_language or (3) target_flag parameter to translate.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49212; http://sourceforge.net/tracker/?func=detail&aid=3527242&group_id=157964&atid=805929; http://www.darksecurity.de/index.php?/215-SSCHADV2012-013-PHP-Address-Book-7.0.0-Multiple-security-vulnerabilities.html
CVE: CVE-2012-2904
Published: 2012-05-21
Description: player.swf in LongTail JW Player 5.9 allows remote attackers to conduct cross-site scripting (XSS) attacks to inject arbitrary web script or HTML via multiple "javascript:" sequences in the debug parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.longtailvideo.com/trac/ticket/1585; http://seclists.org/fulldisclosure/2012/May/132; http://secunia.com/advisories/49130
CVE: CVE-2012-2905
Published: 2012-05-21
Description: Artiphp CMS 5.5.0 Neo (r422) stores database backups with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/81991; http://secunia.com/advisories/49195; http://www.exploit-db.com/exploits/18889
CVE: CVE-2012-2906
Published: 2012-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in artpublic/recommandation/index.php in Artiphp CMS 5.5.0 Neo (r422) allow remote attackers to inject arbitrary web script or HTML via the (1) add_img_name_post, (2) asciiart_post, (3) expediteur, (4) titre_sav, or (5) z39d27af885b32758ac0e7d4014a61561 parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112804/Artiphp-CMS-5.5.0-Cross-Site-Scripting.html; http://secunia.com/advisories/49195; http://www.osvdb.org/81990
CVE: CVE-2012-2907
Published: 2012-05-21
Description: Cross-site scripting (XSS) vulnerability in the aberdeen_breadcrumb function in template.php in the Aberdeen theme 6.x-1.x before 6.x-1.11 for Drupal, when set to append the content title to the breadcrumb, allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1585878; http://drupal.org/node/1585890; http://drupalcode.org/project/aberdeen.git/commitdiff/1994e8e
CVE: CVE-2012-2908
Published: 2012-05-21
Description: Multiple SQL injection vulnerabilities in admin/bbcodes.php in Viscacha 0.8.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) bbcodeexample, (2) buttonimage, or (3) bbcodetag parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18873; http://www.securityfocus.com/bid/53496; http://www.vulnerability-lab.com/get_content.php?id=525
CVE: CVE-2012-2909
Published: 2012-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in Viscacha 0.8.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) text field in the Private Messages System, (2) Bad Word field in Zensur, or (3) Portal or (4) Topic field in Kommentar.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/18873; http://www.securityfocus.com/bid/53496; http://www.vulnerability-lab.com/get_content.php?id=525
CVE: CVE-2012-2910
Published: 2012-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in SiliSoftware phpThumb() 1.7.11 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter to demo/phpThumb.demo.random.php or (2) title parameter to demo/phpThumb.demo.showpic.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112797/SiliSoftware-phpThumb-1.7.11-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/53572; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5088.php
CVE: CVE-2012-2911
Published: 2012-05-21
Description: Cross-site scripting (XSS) vulnerability in backupDB.php in SiliSoftware backupDB() 1.2.7a allows remote attackers to inject arbitrary web script or HTML via the onlyDB parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112801/SiliSoftware-backupDB-1.2.7a-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/53575; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5089.php
CVE: CVE-2012-2912
Published: 2012-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter in the show-league page or (2) season parameter in the team page to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112698/WordPress-LeagueManager-3.7-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/53525; https://exchange.xforce.ibmcloud.com/vulnerabilities/75629
CVE: CVE-2012-2913
Published: 2012-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) leaflet_layer.php or (2) leaflet_marker.php, as reachable through wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112699/WordPress-Leaflet-0.0.1-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/53526; https://exchange.xforce.ibmcloud.com/vulnerabilities/75628
CVE: CVE-2012-2914
Published: 2012-05-21
Description: Cross-site scripting (XSS) vulnerability in captchademo.php in Unijimpe Captcha allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112785/Unijimpe-Captcha-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/53585; https://exchange.xforce.ibmcloud.com/vulnerabilities/75708
CVE: CVE-2012-2915
Published: 2012-05-21
Description: Stack-based buffer overflow in Lattice Semiconductor PAC-Designer 6.2.1344 allows remote attackers to execute arbitrary code via a long string in a Value tag in a SymbolicSchematicData definition tag in PAC Design (.pac) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/82001; http://secunia.com/advisories/48741; http://www.securityfocus.com/bid/53566
CVE: CVE-2012-2916
Published: 2012-05-21
Description: Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the active_option parameter to wp-admin/tools.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112692/WordPress-SABRE-1.2.0-Cross-Site-Scripting.html; http://plugins.trac.wordpress.org/changeset?old_path=%2Fsabre&old=534490&new_path=%2Fsabre&new=534490; http://wordpress.org/extend/plugins/sabre/changelog/
CVE: CVE-2012-2917
Published: 2012-05-21
Description: Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key (cnd-key) in a share-and-follow-menu page to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112691/WordPress-Share-And-Follow-1.80.3-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/53533; https://exchange.xforce.ibmcloud.com/vulnerabilities/75616
CVE: CVE-2012-2349
Published: 2012-05-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-5104.  Reason: This candidate is a reservation duplicate of CVE-2010-5104.  Notes: All CVE users should reference CVE-2010-5104 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-5097
Published: 2012-05-21
Description: Cross-site scripting (XSS) vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/35770; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022/; http://www.openwall.com/lists/oss-security/2011/01/13/2
CVE: CVE-2010-5098
Published: 2012-05-21
Description: Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/35770; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022/; http://www.openwall.com/lists/oss-security/2011/01/13/2
CVE: CVE-2010-5100
Published: 2012-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Install Tool in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/35770; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022/; http://www.openwall.com/lists/oss-security/2011/01/13/2
CVE: CVE-2010-5101
Published: 2012-05-21
Description: Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to read arbitrary files via unspecified vectors related to the "file inclusion functionality."
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/35770; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022/; http://www.openwall.com/lists/oss-security/2011/01/13/2
CVE: CVE-2010-5102
Published: 2012-05-21
Description: Directory traversal vulnerability in mod/tools/em/class.em_unzip.php in the unzip library in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote attackers to write arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://bugs.typo3.org/view.php?id=16362; http://secunia.com/advisories/35770; http://securesystems.ca/advisory.php?id=2010-001
CVE: CVE-2010-5103
Published: 2012-05-21
Description: SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35770; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022/; http://www.openwall.com/lists/oss-security/2011/01/13/2
CVE: CVE-2010-5104
Published: 2012-05-21
Description: The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/35770; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022/; http://www.openwall.com/lists/oss-security/2011/01/13/2
CVE: CVE-2012-0296
Published: 2012-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/53396; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00; http://www.securityfocus.com/bid/53396
CVE: CVE-2012-0297
Published: 2012-05-21
Description: The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/53444; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00; https://exchange.xforce.ibmcloud.com/vulnerabilities/75731
CVE: CVE-2012-0298
Published: 2012-05-21
Description: The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to (1) read or (2) delete arbitrary files via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/53442; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00; https://exchange.xforce.ibmcloud.com/vulnerabilities/75732
CVE: CVE-2012-0299
Published: 2012-05-21
Description: The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code to a designated pathname, and possibly execute this code, via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/53443; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00; https://exchange.xforce.ibmcloud.com/vulnerabilities/75730
CVE: CVE-2012-1249
Published: 2012-05-21
Description: The iLunascape application 1.0.4.0 and earlier for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive stored information via a crafted application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN86044443/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000044; http://osvdb.org/82035
CVE: CVE-2012-2271
Published: 2012-05-21
Description: Buffer overflow in the InitLicenKeys function in a certain ActiveX control in SkinCrafter3_vs2005.dll in SkinCrafter 3.0 allows remote attackers to execute arbitrary code via a long string in the first argument (aka the reg_name argument).
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/82086; http://www.exploit-db.com/exploits/18892/; http://www.securityfocus.com/bid/53611
CVE: CVE-2012-2338
Published: 2012-05-21
Description: SQL injection vulnerability in includes/picture.class.php in Galette 0.63, 0.63.1, 0.63.2, 0.63.3, and 0.64rc1 allows remote attackers to execute arbitrary SQL commands via the id_adh parameter to picture.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://redmine.ulysses.fr/issues/250; http://redmine.ulysses.fr/projects/galette/repository/revisions/8c13ec159ba; http://www.openwall.com/lists/oss-security/2012/05/10/5
CVE: CVE-2012-2339
Published: 2012-05-21
Description: Cross-site scripting (XSS) vulnerability in the Glossary module 6.x-1.x before 6.x-1.8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "taxonomy information."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1568156; http://drupal.org/node/1569482; http://drupalcode.org/project/glossary.git/commitdiff/c6cc3ac
CVE: CVE-2012-2340
Published: 2012-05-21
Description: The Contact Forms module 7.x-1.x before 7.x-1.2 for Drupal does not specify sufficiently restrictive permissions, which allows remote authenticated users with the "access the site-wide contact form" permission to modify the module settings via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://drupal.org/node/1569352; http://drupal.org/node/1569508; http://drupalcode.org/project/contact_forms.git/commitdiff/d11ce2b