deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-2987
Published: 2011-08-18
Description: Heap-based buffer overflow in Almost Native Graphics Layer Engine (ANGLE), as used in the WebGL implementation in Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products might allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html; http://secunia.com/advisories/49055; http://www.mozilla.org/security/announce/2011/mfsa2011-29.html
CVE: CVE-2011-2988
Published: 2011-08-18
Description: Buffer overflow in an unspecified string class in the WebGL shader implementation in Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long source-code block for a shader.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html; http://secunia.com/advisories/49055; http://www.mozilla.org/security/announce/2011/mfsa2011-29.html
CVE: CVE-2011-2989
Published: 2011-08-18
Description: The browser engine in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, Thunderbird before 6, and possibly other products does not properly implement WebGL, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html; http://secunia.com/advisories/49055; http://www.mozilla.org/security/announce/2011/mfsa2011-29.html
CVE: CVE-2011-2990
Published: 2011-08-18
Description: The implementation of Content Security Policy (CSP) violation reports in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, and possibly other products does not remove proxy-authorization credentials from the listed request headers, which allows attackers to obtain sensitive information by reading a report, related to incorrect host resolution that occurs with certain redirects.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html; http://www.mozilla.org/security/announce/2011/mfsa2011-29.html; http://www.mozilla.org/security/announce/2011/mfsa2011-33.html
CVE: CVE-2011-2991
Published: 2011-08-18
Description: The browser engine in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, Thunderbird before 6, and possibly other products does not properly implement JavaScript, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html; http://secunia.com/advisories/49055; http://www.mozilla.org/security/announce/2011/mfsa2011-29.html
CVE: CVE-2011-2992
Published: 2011-08-18
Description: The Ogg reader in the browser engine in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, Thunderbird before 6, and possibly other products allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html; http://secunia.com/advisories/49055; http://www.mozilla.org/security/announce/2011/mfsa2011-29.html
CVE: CVE-2011-2993
Published: 2011-08-18
Description: The implementation of digital signatures for JAR files in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, and possibly other products does not prevent calls from unsigned JavaScript code to signed code, which allows remote attackers to bypass the Same Origin Policy and gain privileges via a crafted web site, a different vulnerability than CVE-2008-2801.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html; http://www.mozilla.org/security/announce/2011/mfsa2011-29.html; http://www.mozilla.org/security/announce/2011/mfsa2011-33.html
CVE: CVE-2011-2733
Published: 2011-08-18
Description: EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not prevent reuse of authentication information during a session, which allows remote authenticated users to bypass intended access restrictions via vectors related to knowledge of the originally used authentication information and unspecified other session information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/8344; http://www.securityfocus.com/archive/1/519346/100/0/threaded; http://www.securityfocus.com/bid/49574
CVE: CVE-2011-2945
Published: 2011-08-18
Description: Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a crafted SIPR stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://service.real.com/realplayer/security/08162011_player/en/; http://www.securitytracker.com/id?1025943; http://service.real.com/realplayer/security/08162011_player/en/
CVE: CVE-2011-2946
Published: 2011-08-18
Description: Unspecified vulnerability in an ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://service.real.com/realplayer/security/08162011_player/en/; http://www.securitytracker.com/id?1025943; http://service.real.com/realplayer/security/08162011_player/en/
CVE: CVE-2011-2947
Published: 2011-08-18
Description: Cross-zone scripting vulnerability in the RealPlayer ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to inject arbitrary web script or HTML in the Local Zone via a local HTML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://service.real.com/realplayer/security/08162011_player/en/; http://www.securitytracker.com/id?1025943; http://zerodayinitiative.com/advisories/ZDI-11-269/
CVE: CVE-2011-2948
Published: 2011-08-18
Description: RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, RealPlayer Enterprise 2.0 through 2.1.5, and Mac RealPlayer 12.0.0.1569 do not properly handle DEFINEFONT fields in SWF files, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://service.real.com/realplayer/security/08162011_player/en/; http://www.securitytracker.com/id?1025943; http://zerodayinitiative.com/advisories/ZDI-11-268/
CVE: CVE-2011-2949
Published: 2011-08-18
Description: Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5 allows remote attackers to execute arbitrary code via crafted ID3v2 tags in an MP3 file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://service.real.com/realplayer/security/08162011_player/en/; http://www.securitytracker.com/id?1025943; http://zerodayinitiative.com/advisories/ZDI-11-267/
CVE: CVE-2011-2950
Published: 2011-08-18
Description: Heap-based buffer overflow in qcpfformat.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a crafted QCP file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/8388; http://service.real.com/realplayer/security/08162011_player/en/; http://www.securityfocus.com/bid/49172
CVE: CVE-2011-2951
Published: 2011-08-18
Description: Buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and Mac RealPlayer 12.0.0.1569 allows remote attackers to execute arbitrary code via a crafted raw_data_frame field in an AAC file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://service.real.com/realplayer/security/08162011_player/en/; http://www.securitytracker.com/id?1025943; http://zerodayinitiative.com/advisories/ZDI-11-266/
CVE: CVE-2011-2952
Published: 2011-08-18
Description: Use-after-free vulnerability in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5 allows remote attackers to execute arbitrary code via vectors related to a dialog box.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://service.real.com/realplayer/security/08162011_player/en/; http://www.securitytracker.com/id?1025943; http://service.real.com/realplayer/security/08162011_player/en/
CVE: CVE-2011-2953
Published: 2011-08-18
Description: An unspecified ActiveX control in the browser plugin in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5 allows remote attackers to execute arbitrary code via unknown vectors, related to an out-of-bounds condition.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://service.real.com/realplayer/security/08162011_player/en/; http://www.securitytracker.com/id?1025943; http://service.real.com/realplayer/security/08162011_player/en/
CVE: CVE-2011-2954
Published: 2011-08-18
Description: Use-after-free vulnerability in the AutoUpdate feature in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5, when an Embedded RealPlayer is used, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://service.real.com/realplayer/security/08162011_player/en/; http://www.securitytracker.com/id?1025943; http://service.real.com/realplayer/security/08162011_player/en/
CVE: CVE-2011-2955
Published: 2011-08-18
Description: Use-after-free vulnerability in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5, when an Embedded RealPlayer is used, allows remote attackers to execute arbitrary code via vectors related to a modal dialog.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://service.real.com/realplayer/security/08162011_player/en/; http://www.securitytracker.com/id?1025943; http://service.real.com/realplayer/security/08162011_player/en/
CVE: CVE-2011-2410
Published: 2011-08-19
Description: Cross-site scripting (XSS) vulnerability in HP OpenView Performance Insight 5.3, 5.31, 5.4, 5.41, 5.41.001, and 5.41.002 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02942411; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02942411
CVE: CVE-2011-2895
Published: 2011-08-19
Description: The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d11ee5886e9d9ec610051a206b135a4cdc1e09a0; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2011-007.txt.asc; http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
CVE: CVE-2011-2896
Published: 2011-08-19
Description: The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-787
References: http://cups.org/str.php?L3867; http://git.gnome.org/browse/gimp/commit/?id=376ad788c1a1c31d40f18494889c383f6909ebfc; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/064600.html
CVE: CVE-2011-3170
Published: 2011-08-19
Description: The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://cups.org/str.php?L3914; http://secunia.com/advisories/45796; http://secunia.com/advisories/46024
CVE: CVE-2011-2810
Published: 2011-08-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-0253.  Reason: This candidate is a reservation duplicate of CVE-2011-0253.  Notes: All CVE users should reference CVE-2011-0253 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-3262
Published: 2011-08-19
Description: tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allows local users to cause a denial of service (management software infinite loop and management domain resource consumption) via unspecified vectors related to "Lack of error checking in the decompression loop."
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://lists.xensource.com/archives/html/xen-devel/2011-05/msg00483.html; http://lists.xensource.com/archives/html/xen-devel/2011-05/msg00491.html; http://secunia.com/advisories/55082
CVE: CVE-2011-0547
Published: 2011-08-19
Description: Multiple integer overflows in vxsvc.exe in the Veritas Enterprise Administrator service in Symantec Veritas Storage Foundation 5.1 and earlier, Veritas Storage Foundation Cluster File System (SFCFS) 5.1 and earlier, Veritas Storage Foundation Cluster File System Enterprise for Oracle RAC (SFCFSORAC) 5.1 and earlier, Veritas Dynamic Multi-Pathing (DMP) 5.1, and NetBackup PureDisk 6.5.x through 6.6.1.x allow remote attackers to execute arbitrary code via (1) a crafted Unicode string, related to the vxveautil.value_binary_unpack function; (2) a crafted ASCII string, related to the vxveautil.value_binary_unpack function; or (3) a crafted value, related to the vxveautil.kv_binary_unpack function, leading to a buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3667&w=2; http://www.securityfocus.com/bid/49014; http://www.symantec.com/business/support/index?page=content&id=TECH165536
CVE: CVE-2011-1341
Published: 2011-08-19
Description: Cross-site request forgery (CSRF) vulnerability in Aimluck Aipo before 4.0.4.0, and Aipo for ASP before 4.0.4.0, allows remote attackers to hijack the authentication of administrators for requests that modify data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN72854072/91216/index.html; http://jvn.jp/en/jp/JVN72854072/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000062
CVE: CVE-2011-1342
Published: 2011-08-19
Description: SQL injection vulnerability in Aimluck Aipo before 5.1.1, and Aipo for ASP before 5.1.1, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN31506102/91216/index.html; http://jvn.jp/en/jp/JVN31506102/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000063
CVE: CVE-2011-2904
Published: 2011-08-19
Description: Cross-site scripting (XSS) vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063884.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063904.html; http://secunia.com/advisories/45502
CVE: CVE-2011-3263
Published: 2011-08-19
Description: zabbix_agentd in Zabbix before 1.8.6 and 1.9.x before 1.9.4 allows context-dependent attackers to cause a denial of service (CPU consumption) by executing the vfs.file.cksum command for a special device, as demonstrated by the /dev/urandom device.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.zabbix.com/rn1.8.6.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/69378; https://support.zabbix.com/browse/ZBX-3794
CVE: CVE-2011-3264
Published: 2011-08-19
Description: Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.zabbix.com/rn1.8.6.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/69377; https://support.zabbix.com/browse/ZBX-3840
CVE: CVE-2011-3265
Published: 2011-08-19
Description: popup.php in Zabbix before 1.8.7 allows remote attackers to read the contents of arbitrary database tables via a modified srctbl parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066092.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066110.html; http://www.securityfocus.com/bid/49277
CVE: CVE-2011-2225
Published: 2011-08-23
Description: Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows attackers to have an unknown impact via a crafted directory pathname that is inserted into config.sh.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html; http://support.novell.com/security/cve/CVE-2011-2225.html; http://www.securityfocus.com/bid/49236
CVE: CVE-2011-2226
Published: 2011-08-23
Description: Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a pattern listing.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html; http://support.novell.com/security/cve/CVE-2011-2226.html; http://www.securityfocus.com/bid/49236
CVE: CVE-2011-2644
Published: 2011-08-23
Description: Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to an RPM info display.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html; http://support.novell.com/security/cve/CVE-2011-2644.html; http://www.securityfocus.com/bid/49236
CVE: CVE-2011-2645
Published: 2011-08-23
Description: Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted filename for a custom RPM.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html; http://support.novell.com/security/cve/CVE-2011-2645.html; http://www.securityfocus.com/bid/49236
CVE: CVE-2011-2646
Published: 2011-08-23
Description: Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted filename in the list of testdrive modified files.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html; http://support.novell.com/security/cve/CVE-2011-2646.html; http://www.securityfocus.com/bid/49236
CVE: CVE-2011-2647
Published: 2011-08-23
Description: Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted archive name in the list of testdrive modified files.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html; http://support.novell.com/security/cve/CVE-2011-2647.html; http://www.securityfocus.com/bid/49236
CVE: CVE-2011-2648
Published: 2011-08-23
Description: Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a filter in a modified file.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html; http://support.novell.com/security/cve/CVE-2011-2648.html; http://www.securityfocus.com/bid/49236
CVE: CVE-2011-2649
Published: 2011-08-23
Description: Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows attackers to execute arbitrary commands via shell metacharacters in an unspecified FileUtils function call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html; http://support.novell.com/security/cve/CVE-2011-2649.html; http://www.securityfocus.com/bid/49236
CVE: CVE-2011-2650
Published: 2011-08-23
Description: Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via a crafted pattern name that is included in an RPM info display.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html; http://support.novell.com/security/cve/CVE-2011-2650.html; http://www.securityfocus.com/bid/49236
CVE: CVE-2011-2651
Published: 2011-08-23
Description: Unspecified vulnerability in the file browser in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted filename.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html; http://support.novell.com/security/cve/CVE-2011-2651.html; http://www.securityfocus.com/bid/49236
CVE: CVE-2011-2652
Published: 2011-08-23
Description: Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via a crafted archive file list that is used in an overlay file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html; http://support.novell.com/security/cve/CVE-2011-2652.html; http://www.securityfocus.com/bid/49236
CVE: CVE-2011-2698
Published: 2011-08-23
Description: Off-by-one error in the elem_cell_id_aux function in epan/dissectors/packet-ansi_a.c in the ANSI MAP dissector in Wireshark 1.4.x before 1.4.8 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (infinite loop) via an invalid packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=37930; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063586.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063591.html