deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5180
Published: 2012-12-26
Description: The Opera Mobile application before 12.1 and Opera Mini application before 7.5 for Android do not properly implement the WebView class, which allows attackers to obtain sensitive information via a crafted application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN27691264/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000112; http://jvn.jp/en/jp/JVN27691264/index.html
CVE: CVE-2012-5182
Published: 2012-12-26
Description: The Loctouch application 3.4.6 and earlier for Android does not properly handle implicit intents, which allows attackers to obtain sensitive information about logged locations via a crafted application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN42625179/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000114; https://play.google.com/store/apps/details?id=com.livedoor.android.folkat
CVE: CVE-2012-5183
Published: 2012-12-26
Description: The Loctouch application 3.4.6 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN33159152/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000115; https://play.google.com/store/apps/details?id=com.livedoor.android.folkat
CVE: CVE-2012-5584
Published: 2012-12-26
Description: The Table of Contents module 6.x-3.x before 6.x-3.8 for Drupal does not properly check node permissions, which allows remote attackers to read a node's headers by accessing a table of contents block.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1841026; http://drupal.org/node/1841046; http://www.openwall.com/lists/oss-security/2012/11/29/2
CVE: CVE-2012-5585
Published: 2012-12-26
Description: Cross-site scripting (XSS) vulnerability in the Mixpanel module 6.x-1.x before 6.x-1.1 in Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via the Maxpanel token.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1762886; http://drupal.org/node/1852098; http://drupal.org/node/1853198
CVE: CVE-2012-5586
Published: 2012-12-26
Description: The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vectors related to the "user index method" and "the path to the user resource."
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://drupal.org/node/1842022; http://drupal.org/node/1842026; http://drupal.org/node/1853200
CVE: CVE-2012-5587
Published: 2012-12-26
Description: Cross-site scripting (XSS) vulnerability in the Email Field module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the mailto link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1852612; http://drupal.org/node/1853214; http://www.openwall.com/lists/oss-security/2012/11/29/2
CVE: CVE-2012-5588
Published: 2012-12-26
Description: The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the field contact field formatter is set to the full or teaser display mode, does not properly check permissions, which allows remote attackers to email the stored address via unspecified vectors.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://drupal.org/node/1852612; http://drupal.org/node/1853214; http://www.openwall.com/lists/oss-security/2012/11/29/2
CVE: CVE-2012-5589
Published: 2012-12-26
Description: The MultiLink module 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal does not properly check node permissions when generating an in-content link, which allows remote authenticated users with text-editing permissions to read arbitrary node titles via a generated link.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://drupal.org/node/1289292; http://drupal.org/node/1289294; http://drupal.org/node/1853244
CVE: CVE-2012-5590
Published: 2012-12-26
Description: SQL injection vulnerability in the Webmail Plus module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/1853268; http://www.openwall.com/lists/oss-security/2012/11/29/2; http://www.securityfocus.com/bid/56720
CVE: CVE-2012-5591
Published: 2012-12-26
Description: Cross-site scripting (XSS) vulnerability in the Zero Point module 6.x-1.x before 6.x-1.18 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the path aliases.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1853350; http://drupal.org/node/1853358; http://drupal.org/node/1853376
CVE: CVE-2012-4816
Published: 2012-12-26
Description: IBM Rational Automation Framework (RAF) 3.x through 3.0.0.5 allows remote attackers to bypass intended Env Gen Wizard (aka Environment Generation Wizard) access restrictions by visiting context roots in HTTP sessions on port 8080.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21620359; https://exchange.xforce.ibmcloud.com/vulnerabilities/78379; http://www-01.ibm.com/support/docview.wss?uid=swg21620359
CVE: CVE-2012-5951
Published: 2012-12-26
Description: Unspecified vulnerability in IBM Tivoli NetView 1.4, 5.1 through 5.4, and 6.1 on z/OS allows local users to gain privileges by leveraging access to the normal Unix System Services (USS) security level.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1OA41059; http://www-01.ibm.com/support/docview.wss?uid=swg1OA41060; http://www-01.ibm.com/support/docview.wss?uid=swg1OA41061
CVE: CVE-2012-4616
Published: 2012-12-26
Description: Directory traversal vulnerability in the Web UI in EMC Data Protection Advisor (DPA) 5.6 through SP1, 5.7 through SP1, and 5.8 through SP4 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-12/0125.html; http://archives.neohapsis.com/archives/bugtraq/2012-12/0125.html
CVE: CVE-2012-5664
Published: 2012-12-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6496, CVE-2012-6497. Reason: this candidate was intended for one issue, but the candidate was publicly used to label concerns about multiple products. Notes: All CVE users should consult CVE-2012-6496 and CVE-2012-6497 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2012-6298
Published: 2012-12-26
Description: Unspecified vulnerability in CA IdentityMinder r12.0 through CR16, r12.5 before SP15, and r12.6 GA allows remote attackers to execute arbitrary commands or modify data via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7BFBA53B61-3A68-4506-9876-F845F6DD8A93%7D; https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7BFBA53B61-3A68-4506-9876-F845F6DD8A93%7D
CVE: CVE-2012-6299
Published: 2012-12-26
Description: Unspecified vulnerability in CA IdentityMinder r12.0 through CR16, r12.5 before SP15, and r12.6 GA allows remote attackers to bypass intended access restrictions via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7BFBA53B61-3A68-4506-9876-F845F6DD8A93%7D; https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7BFBA53B61-3A68-4506-9876-F845F6DD8A93%7D
CVE: CVE-2012-0958
Published: 2012-12-26
Description: content/unity-api.js in the unity-firefox-extension extension 2.4.1 for Firefox exposes the toDataURL function in an API call, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted webpage.
CVSS Score: 4.3 (MEDIUM)
References: http://bazaar.launchpad.net/~webapps/unity-firefox-extension/trunk/revision/331; http://osvdb.org/88438; http://www.securityfocus.com/bid/56930
CVE: CVE-2012-0961
Published: 2012-12-26
Description: Apt 0.8.16~exp5ubuntu13.x before 0.8.16~exp5ubuntu13.6, 0.8.16~exp12ubuntu10.x before 0.8.16~exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0.9.7.5ubuntu5.2, as used in Ubuntu, uses world-readable permissions for /var/log/apt/term.log, which allows local users to obtain sensitive shell information by reading the log file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://osvdb.org/88380; http://secunia.com/advisories/51568; http://www.securityfocus.com/bid/56917
CVE: CVE-2012-0962
Published: 2012-12-26
Description: Aptdaemon 0.43 in Ubuntu 11.10 and 12.04 LTS uses short IDs when importing PPA GPG keys from a keyserver, which allows remote attackers to install arbitrary package repository GPG keys via a man-in-the-middle (MITM) attack.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/51627; http://www.securityfocus.com/bid/56959; http://www.securitytracker.com/id?1027891
CVE: CVE-2012-5161
Published: 2012-12-26
Description: The XML Service interface in Citrix XenApp 6.5 and 6.5 Feature Pack 1 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/88368; http://secunia.com/advisories/51538; http://support.citrix.com/article/CTX135066
CVE: CVE-2012-5483
Published: 2012-12-26
Description: tools/sample_data.sh in OpenStack Keystone 2012.1.3, when access to Amazon Elastic Compute Cloud (Amazon EC2) is configured, uses world-readable permissions for /etc/keystone/ec2rc, which allows local users to obtain access to EC2 services by reading administrative access and secret values from this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html; http://rhn.redhat.com/errata/RHSA-2012-1556.html; http://www.securityfocus.com/bid/56888
CVE: CVE-2012-5625
Published: 2012-12-26
Description: OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/88419; http://rhn.redhat.com/errata/RHSA-2013-0208.html; http://www.openwall.com/lists/oss-security/2012/12/11/5
CVE: CVE-2012-6314
Published: 2012-12-26
Description: Citrix XenDesktop Virtual Desktop Agent (VDA) 5.6.x before 5.6.200, when making changes to the server-side policy that control USB redirection, does not propagate changes to the VDA, which allows authenticated users to retain access to the USB device.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/88369; http://secunia.com/advisories/51524; http://support.citrix.com/article/CTX135813
CVE: CVE-2012-2669
Published: 2012-12-27
Description: The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin of Netlink messages, which allows local users to spoof Netlink communication via a crafted connector message.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bcc2c9c3fff859e0eb019fe6fec26f9b8eba795c; http://lists.opensuse.org/opensuse-updates/2012-11/msg00042.html; http://openwall.com/lists/oss-security/2012/06/06/12
CVE: CVE-2012-5532
Published: 2012-12-27
Description: The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.8-rc1, allows local users to cause a denial of service (daemon exit) via a crafted application that sends a Netlink message.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2669.
CVSS Score: 4.9 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=95a69adab9acfc3981c504737a2b6578e4d846ef; http://rhn.redhat.com/errata/RHSA-2013-0807.html; http://www.kernel.org/pub/linux/kernel/v3.x/testing/
CVE: CVE-2012-5868
Published: 2012-12-27
Description: WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://whiteoaksecurity.com/blog/2012/12/17/cve-2012-5868-wordpress-342-sessions-not-terminated-upon-explicit-user-logout; http://whiteoaksecurity.com/blog/2012/12/17/cve-2012-5868-wordpress-342-sessions-not-terminated-upon-explicit-user-logout
CVE: CVE-2012-6431
Published: 2012-12-27
Description: Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released; http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released
CVE: CVE-2012-6432
Published: 2012-12-27
Description: Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released; http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released
CVE: CVE-2012-0738
Published: 2012-12-28
Description: IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certificates during scanning, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21620759; http://www-01.ibm.com/support/docview.wss?uid=swg21620760; https://exchange.xforce.ibmcloud.com/vulnerabilities/74578
CVE: CVE-2012-0741
Published: 2012-12-28
Description: IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certificates during use of the Manual Explore Proxy feature, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21620759; http://www-01.ibm.com/support/docview.wss?uid=swg21620760; https://exchange.xforce.ibmcloud.com/vulnerabilities/74142
CVE: CVE-2012-3870
Published: 2012-12-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in objects/createobject.php in Open Constructor 3.12.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) name or (2) description parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.org/files/115276/Openconstructor-CMS-3.12.0-Cross-Site-Scripting.html; http://packetstormsecurity.org/files/115276/Openconstructor-CMS-3.12.0-Cross-Site-Scripting.html
CVE: CVE-2012-3871
Published: 2012-12-28
Description: Cross-site scripting (XSS) vulnerability in data/hybrid/i_hybrid.php in Open Constructor 3.12.0 allows remote authenticated users to inject arbitrary web script or HTML via the header parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.org/files/115285/Openconstructor-CMS-3.12.0-i_hybrid.php-XSS.html; http://packetstormsecurity.org/files/115285/Openconstructor-CMS-3.12.0-i_hybrid.php-XSS.html
CVE: CVE-2012-3872
Published: 2012-12-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to data/file/edit.php, (2) the q parameter to confirm.php, or (3) the keyword parameter to users/users.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/115284/Openconstructor-CMS-3.12.0-Reflected-XSS.html; http://packetstormsecurity.org/files/115284/Openconstructor-CMS-3.12.0-Reflected-XSS.html
CVE: CVE-2012-3873
Published: 2012-12-28
Description: Multiple SQL injection vulnerabilities in Open Constructor 3.12.0 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) data/gallery/edit.php, (2) data/guestbook/edit.php, (3) data/file/edit.php, (4) data/htmltext/edit.php, (5) data/publication/edit.php, or (6) data/event/edit.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/files/115286/Openconstructor-CMS-3.12.0-SQL-Injection.html; http://packetstormsecurity.org/files/115286/Openconstructor-CMS-3.12.0-SQL-Injection.html
CVE: CVE-2012-4528
Published: 2012-12-28
Description: The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093011.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html
CVE: CVE-2012-4932
Published: 2012-12-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in SimpleInvoices before stable-2012-1-CIS3000 allow remote attackers to inject arbitrary web script or HTML via (1) the having parameter in a manage action to index.php; (2) the Email field in an Add User action; (3) the Customer Name field in an Add Customer action; the (4) Street address, (5) Street address 2, (6) City, (7) Zip code, (8) State, (9) Country, (10) Mobile Phone, (11) Phone, (12) Fax, (13) Email, (14) PayPal business name, (15) PayPal notify url, (16) PayPal return url, (17) Eway customer ID, (18) Custom field 1, (19) Custom field 2, (20) Custom field 3, or (21) Custom field 4 field in an Add Biller action; (22) the Customer field in an Add Invoice action; the (23) Invoice or (24) Notes field in a Process Payment action; (25) the Payment type description field in a Payment Types action; (26) the Description field in an Invoice Preferences action; (27) the Description field in a Manage Products action; or (28) the Description field in a Tax Rates action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-12/0074.html; http://archives.neohapsis.com/archives/bugtraq/2012-12/0074.html
CVE: CVE-2012-5445
Published: 2012-12-28
Description: The kernel in Cisco Native Unix (CNU) on Cisco Unified IP Phone 7900 series devices (aka TNP phones) with software before 9.3.1-ES10 does not properly validate unspecified system calls, which allows attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a crafted binary.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://events.ccc.de/congress/2012/Fahrplan/events/5400.en.html; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130109-uipphone; http://events.ccc.de/congress/2012/Fahrplan/events/5400.en.html
CVE: CVE-2012-6369
Published: 2012-12-28
Description: Cross-site scripting (XSS) vulnerability in the Troubleshooting Reporting System feature in AgileBits 1Password 3.9.9 might allow remote attackers to inject arbitrary web script or HTML via a crafted User-Agent HTTP header that is not properly handled in a View Troubleshooting Report action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/118467/Agilebits-1Password-3.9.9-Cross-Site-Scripting.html; http://www.youtube.com/watch?v=A1kPL9ggRi4; http://packetstormsecurity.org/files/118467/Agilebits-1Password-3.9.9-Cross-Site-Scripting.html
CVE: CVE-2012-4792
Published: 2012-12-30
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-attack-details.html; http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-internet-explorer-8-users.aspx; http://blogs.technet.com/b/srd/archive/2012/12/31/microsoft-quot-fix-it-quot-available-for-internet-explorer-6-7-and-8.aspx
CVE: CVE-2012-4688
Published: 2012-12-31
Description: The Central application in i-GEN opLYNX before 2.01.9 allows remote attackers to bypass authentication via vectors involving the disabling of browser JavaScript support.
CVSS Score: 7.5 (HIGH)
CWE: CWE-592, CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-12-362-01; http://www.us-cert.gov/control_systems/pdf/ICSA-12-362-01.pdf
CVE: CVE-2012-5642
Published: 2012-12-31
Description: server/action.py in Fail2ban before 0.8.8 does not properly handle the content of the matches tag, which might allow remote attackers to trigger unsafe behavior in a custom action file via unspecified symbols in this content.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2013-04/msg00001.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00002.html; http://sourceforge.net/mailarchive/message.php?msg_id=30193056
CVE: CVE-2012-6334
Published: 2012-12-31
Description: The Track My Mobile feature in the SamsungDive subsystem for Android on Samsung Galaxy devices does not properly implement Location APIs, which allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer."
CVSS Score: 2.9 (LOW)
CWE: CWE-264
References: http://thehackernews.com/2012/12/manufacture-based-gps-tracking-services.html; http://thehackernews.com/2012/12/manufacture-based-gps-tracking-services.html
CVE: CVE-2012-6335
Published: 2012-12-31
Description: The Anti-theft service in AVG AntiVirus for Android allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer."
CVSS Score: 3.3 (LOW)
References: http://thehackernews.com/2012/12/manufacture-based-gps-tracking-services.html; http://thehackernews.com/2012/12/manufacture-based-gps-tracking-services.html
CVE: CVE-2012-6336
Published: 2012-12-31
Description: The Missing Device feature in Lookout allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer."
CVSS Score: 3.3 (LOW)
References: http://thehackernews.com/2012/12/manufacture-based-gps-tracking-services.html; http://thehackernews.com/2012/12/manufacture-based-gps-tracking-services.html
CVE: CVE-2012-6337
Published: 2012-12-31
Description: The Track My Mobile feature in the SamsungDive subsystem for Android on Samsung Galaxy devices shows the activation of remote tracking, which might allow physically proximate attackers to defeat a product-recovery effort by tampering with this feature or its location data.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://thehackernews.com/2012/12/manufacture-based-gps-tracking-services.html; http://thehackernews.com/2012/12/manufacture-based-gps-tracking-services.html