deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5292
Published: 2012-10-04
Description: Multiple SQL injection vulnerabilities in Atar2b CMS 4.0.1 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) gallery_e.php, (2) pageE.php, or (3) pageH.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/108438/atar2bcms-sql.txt; http://www.securityfocus.com/bid/51317; https://exchange.xforce.ibmcloud.com/vulnerabilities/72234
CVE: CVE-2012-5293
Published: 2012-10-04
Description: Multiple PHP remote file inclusion vulnerabilities in SAPID CMS 1.2.3 Stable allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[root_path] parameter to usr/extensions/get_tree.inc.php or (2) root_path parameter to usr/extensions/get_infochannel.inc.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/18342; http://www.osvdb.org/82475; http://www.osvdb.org/82476
CVE: CVE-2011-5203
Published: 2012-10-04
Description: SQL injection vulnerability in WB/Default.asp in Akiva WebBoard before 8 SR 1 allows remote attackers to execute arbitrary SQL commands via the name parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-12/0475.html; http://osvdb.org/78069; http://secunia.com/advisories/47318
CVE: CVE-2011-5204
Published: 2012-10-04
Description: Akiva WebBoard 8.x stores passwords in plaintext, which allows local users to obtain sensitive information by reading from the database.
CVSS Score: 1.9 (LOW)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-12/0475.html; http://secunia.com/advisories/47318; http://www.exploit-db.com/exploits/18293
CVE: CVE-2011-5205
Published: 2012-10-04
Description: Cross-site scripting (XSS) vulnerability in audl.php in Rapidleech 2.3 rev42 SVN r358, rev43 SVN r397, and earlier allows remote attackers to inject arbitrary web script or HTML via the links parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/108239/rapidleech-xss.txt; http://secunia.com/advisories/47434; http://www.securityfocus.com/bid/51215
CVE: CVE-2011-5206
Published: 2012-10-04
Description: Cross-site scripting (XSS) vulnerability in notes.php in Rapidleech before 2.3 rev42 SVN r399 allows remote attackers to inject arbitrary web script or HTML via the notes parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://code.google.com/p/rapidleech/source/detail?r=399; http://code.google.com/p/rapidleech/source/diff?spec=svn399&r=399&format=side&path=/trunk/notes.php; http://secunia.com/advisories/47434
CVE: CVE-2011-5207
Published: 2012-10-04
Description: Cross-site scripting (XSS) vulnerability in admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31 allows remote attackers to inject arbitrary web script or HTML via the tcp_name_post_XXXXX parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/108272/wpcartpress-xss.txt; http://plugins.trac.wordpress.org/changeset/482746/thecartpress; http://secunia.com/advisories/47427
CVE: CVE-2012-5294
Published: 2012-10-04
Description: SQL injection vulnerability in art_detalle.php in MyStore Xpress Tienda Virtual allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://1337day.com/exploits/17325; http://www.exploit-db.com/exploits/18302; http://www.securityfocus.com/bid/51240
CVE: CVE-2012-5295
Published: 2012-10-04
Description: Cross-site scripting (XSS) vulnerability in login.cfm in FuseTalk Forums 3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the windowed parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40850; http://st2tea.blogspot.com/2012/01/fusetalk-forums-v32-cross-site.html; http://www.securityfocus.com/bid/51227
CVE: CVE-2012-5296
Published: 2012-10-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mavili Guestbook, as released in November 2007, allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) approve.asp, (2) delete.asp, (3) edit.asp, or (4) edit2.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0010.html; http://code.google.com/p/maviliguestbook/issues/detail?id=1; http://www.securityfocus.com/bid/51252
CVE: CVE-2012-5297
Published: 2012-10-04
Description: SQL injection vulnerability in edit.asp in Mavili Guestbook, as released in November 2007, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0010.html; http://code.google.com/p/maviliguestbook/issues/detail?id=1; http://www.securityfocus.com/bid/51252
CVE: CVE-2012-5298
Published: 2012-10-04
Description: Mavili Guestbook, as released in November 2007, stores guestbook.mdb under the web root with insufficient access control, which allows remote attackers to read the database via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0010.html; http://code.google.com/p/maviliguestbook/issues/detail?id=1; http://www.securityfocus.com/bid/51252
CVE: CVE-2012-5299
Published: 2012-10-04
Description: Mavili Guestbook, as released in November 2007, allows remote attackers to edit, delete, and approve arbitrary messages via a direct request to (1) edit.asp, (2) delete.asp, or (3) approve.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0010.html; http://code.google.com/p/maviliguestbook/issues/detail?id=1; http://www.securityfocus.com/bid/51252
CVE: CVE-2012-5300
Published: 2012-10-04
Description: SQL injection vulnerability in art_catalogo.php in MyStore Xpress Tienda Virtual 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://1337day.com/exploits/17328; http://www.exploit-db.com/exploits/18306; http://www.securityfocus.com/bid/51243
CVE: CVE-2012-2999
Published: 2012-10-04
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in Cerberus FTP Server before 5.0.5.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user account or (2) reconfigure the state of the FTP service, as demonstrated by a request to usermanager/users/modify.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.cerberusftp.com/products/releasenotes.html; http://www.kb.cert.org/vuls/id/989684; http://www.securityfocus.com/bid/55788
CVE: CVE-2012-5237
Published: 2012-10-04
Description: The dissect_hsrp function in epan/dissectors/packet-hsrp.c in the HSRP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
CVSS Score: 3.3 (LOW)
CWE: CWE-399
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-hsrp.c?r1=44454&r2=44453&pathrev=44454; http://anonsvn.wireshark.org/viewvc?view=revision&revision=44454; http://osvdb.org/85884
CVE: CVE-2012-5238
Published: 2012-10-04
Description: epan/dissectors/packet-ppp.c in the PPP dissector in Wireshark 1.8.x before 1.8.3 uses incorrect OUI data structures during the decoding of (1) PPP and (2) LCP data, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a malformed packet.
CVSS Score: 3.3 (LOW)
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-ppp.c?r1=42989&r2=42988&pathrev=42989; http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-ppp.c?r1=44688&r2=44687&pathrev=44688; http://anonsvn.wireshark.org/viewvc?view=revision&revision=42989
CVE: CVE-2012-5240
Published: 2012-10-04
Description: Buffer overflow in the dissect_tlv function in epan/dissectors/packet-ldp.c in the LDP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malformed packet.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-ldp.c?r1=44801&r2=44800&pathrev=44801; http://anonsvn.wireshark.org/viewvc?view=revision&revision=44801; http://www.securityfocus.com/bid/55754
CVE: CVE-2012-5301
Published: 2012-10-04
Description: The default configuration of Cerberus FTP Server before 5.0.4.0 supports the DES cipher for SSH sessions, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and performing a brute-force attack on the encrypted data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.cerberusftp.com/products/releasenotes.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/79503; http://www.cerberusftp.com/products/releasenotes.html
CVE: CVE-2012-4018
Published: 2012-10-05
Description: Cross-site scripting (XSS) vulnerability in Final Beta Laboratory MyWebSearch before 1.23 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://finalbeta.jp/library/perl/mwsearch.html; http://jvn.jp/en/jp/JVN58160713/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000092
CVE: CVE-2012-4894
Published: 2012-10-05
Description: Google SketchUp before 8.0.14346 (aka 8 Maintenance 3) allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted SKP file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/85570; http://support.google.com/sketchup/bin/static.py?page=release_notes.cs; http://technet.microsoft.com/security/msvr/msvr12-015
CVE: CVE-2012-4895
Published: 2012-10-05
Description: Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2012-4896.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/sumatrapdf/source/browse/trunk/docs/releasenotes.txt; http://secunia.com/advisories/50656; http://technet.microsoft.com/security/msvr/msvr12-014
CVE: CVE-2012-4896
Published: 2012-10-05
Description: Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2012-4895.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/sumatrapdf/source/browse/trunk/docs/releasenotes.txt; http://secunia.com/advisories/50656; http://technet.microsoft.com/security/msvr/msvr12-014
CVE: CVE-2012-4443
Published: 2012-10-05
Description: Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688008; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688879; http://www.openwall.com/lists/oss-security/2012/09/21/10
CVE: CVE-2012-4897
Published: 2012-10-05
Description: Untrusted search path vulnerability in the installer in VMware Movie Decoder before 9.0 allows local users to gain privileges via a Trojan horse executable file in the installer directory.
CVSS Score: 6.9 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2012-10/0069.html; http://osvdb.org/85957; http://www.securityfocus.com/bid/55802
CVE: CVE-2012-5050
Published: 2012-10-05
Description: Cross-site scripting (XSS) vulnerability in the server in VMware vCenter Operations (aka vCOps) before 5.0.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-10/0069.html; http://osvdb.org/85959; http://secunia.com/advisories/50795
CVE: CVE-2012-5051
Published: 2012-10-05
Description: Directory traversal vulnerability in VMware CapacityIQ 1.5.x allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-10/0069.html; http://www.securityfocus.com/bid/55808; http://www.vmware.com/security/advisories/VMSA-2012-0014.html
CVE: CVE-2012-0845
Published: 2012-10-05
Description: SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of data than specified by the Content-Length header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.python.org/issue14001; http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
CVE: CVE-2012-1150
Published: 2012-10-05
Description: Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://bugs.python.org/issue13703; http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
CVE: CVE-2012-4442
Published: 2012-10-05
Description: Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effective UID, which might allow local users to bypass intended file-read restrictions by leveraging a race condition in a file-permission check.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688007; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688879; http://www.openwall.com/lists/oss-security/2012/09/21/3
CVE: CVE-2012-5303
Published: 2012-10-05
Description: Monkey HTTP Daemon 0.9.3 might allow local users to overwrite arbitrary files via a symlink attack on a PID file, as demonstrated by a pathname different from the default /var/run/monkey.pid pathname.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=672425; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688879; http://www.securityfocus.com/bid/55905
CVE: CVE-2011-4932
Published: 2012-10-06
Description: Eval injection vulnerability in ip_cms/modules/standard/content_management/actions.php in ImpressPages CMS 1.0.12 and possibly other versons before 1.0.13 allows remote attackers to execute arbitrary code via the cm_group parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0029.html; http://seclists.org/bugtraq/2011/Sep/156; http://secunia.com/advisories/46193
CVE: CVE-2012-0065
Published: 2012-10-06
Description: Heap-based buffer overflow in the receive_packet function in libusbmuxd/libusbmuxd.c in usbmuxd 1.0.5 through 1.0.7 allows physically proximate attackers to execute arbitrary code via a long SerialNumber field in a property list.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://git.marcansoft.com/?p=usbmuxd.git%3Ba=commitdiff%3Bh=f794991993af56a74795891b4ff9da506bc893e6; http://openwall.com/lists/oss-security/2012/01/19/25; http://openwall.com/lists/oss-security/2012/01/19/26
CVE: CVE-2012-0986
Published: 2012-10-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) notifications.php, (2) modules/system/admin/images/browser.php, and (3) modules/content/admin/content.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0022.html; http://community.impresscms.org/modules/smartsection/item.php?itemid=579; http://secunia.com/advisories/47448
CVE: CVE-2012-0987
Published: 2012-10-06
Description: Directory traversal vulnerability in edituser.php in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the icmsConfigPlugins[sanitizer_plugins][] parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0022.html; http://community.impresscms.org/modules/smartsection/item.php?itemid=579; http://secunia.com/advisories/47448
CVE: CVE-2012-1153
Published: 2012-10-06
Description: Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads directory.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0128.html; http://www.exploit-db.com/exploits/18392; http://www.exploit-db.com/exploits/18922
CVE: CVE-2012-1564
Published: 2012-10-06
Description: Cross-site scripting (XSS) vulnerability in administration/create_album.php in YVS Image Gallery allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/02/27/27; http://www.openwall.com/lists/oss-security/2012/02/27/7; http://www.openwall.com/lists/oss-security/2012/03/19/12
CVE: CVE-2012-1565
Published: 2012-10-06
Description: Unspecified vulnerability in ez Publish 4.1.4, 4.2, 4.3, 4.4, 4.5, and 4.6 has unknown impact and attack vectors related to an insecure direct object reference.
CVSS Score: 7.5 (HIGH)
References: http://issues.ez.no/19238; http://osvdb.org/80098; http://secunia.com/advisories/48338
CVE: CVE-2012-1623
Published: 2012-10-06
Description: The Registration Codes module before 6.x-2.4 for Drupal does not restrict access to the registration code list, which might allow remote attackers to bypass intended registration restrictions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1394172; http://secunia.com/advisories/47443; http://www.openwall.com/lists/oss-security/2012/04/07/1
CVE: CVE-2012-1624
Published: 2012-10-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Lingotek module 6.x-1.x before 6.x-1.40 for Drupal allow remote authenticated users to inject arbitrary web script or HTML when (1) creating or (2) editing page content.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1394220; http://drupal.org/node/1394412; http://secunia.com/advisories/47453
CVE: CVE-2012-1634
Published: 2012-10-06
Description: Cross-site scripting (XSS) vulnerability in video_filter.codecs.inc in the Video Filter module 6.x-2.x and 7.x-2.x for Drupal allows remote attackers to inject arbitrary web script or HTML via the EMBEDLOOKUP parameter for Blip.tv links.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1401838; http://drupalcode.org/project/video_filter.git/commit/49680a6; http://drupalcode.org/project/video_filter.git/commit/c90c86e
CVE: CVE-2012-1618
Published: 2012-10-06
Description: Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks.  NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0126.html; http://lists.opensuse.org/opensuse-security/2012-03/msg00024.html; http://www.openwall.com/lists/oss-security/2012/03/30/8
CVE: CVE-2012-5304
Published: 2012-10-06
Description: Static code injection vulnerability in administration/install.php in YVS Image Gallery allows remote attackers to inject arbitrary PHP code into functions/db_connect.php via unspecified vectors.  NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2012/02/27/27; http://www.openwall.com/lists/oss-security/2012/03/19/12; http://www.openwall.com/lists/oss-security/2012/02/27/27
CVE: CVE-2012-5305
Published: 2012-10-06
Description: Cross-site scripting (XSS) vulnerability in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allows remote attackers to inject arbitrary web script or HTML via the domain parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0034.html; http://www.securityfocus.com/bid/52848; http://www.vulnerability-lab.com/get_content.php?id=486
CVE: CVE-2012-5306
Published: 2012-10-06
Description: Stack-based buffer overflow in the SelectDirectory method in DcsCliCtrl.dll in Camera Stream Client ActiveX Control, as used in D-Link DCS-5605 PTZ IP Network Camera, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string argument.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0154.html; http://osvdb.org/80663; http://secunia.com/advisories/48602
CVE: CVE-2011-3918
Published: 2012-10-07
Description: The Zygote process in Android 4.0.3 and earlier accepts fork requests from processes with arbitrary UIDs, which allows remote attackers to cause a denial of service (reboot loop) via a crafted application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.ai-lab.it/merlo/publications/DoSAndroid.pdf; https://code.google.com/p/android-source-browsing/source/detail?repo=platform--system--core&r=e7fd911fd42b; http://www.ai-lab.it/merlo/publications/DoSAndroid.pdf
CVE: CVE-2010-5275
Published: 2012-10-07
Description: Cross-site scripting (XSS) vulnerability in memcache_admin in the Memcache module 5.x before 5.x-1.10 and 6.x before 6.x-1.6 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/926478; http://drupal.org/node/927016; http://secunia.com/advisories/41663
CVE: CVE-2010-5276
Published: 2012-10-07
Description: The Memcache module 5.x before 5.x-1.10 and 6.x before 6.x-1.6 for Drupal does not properly handle the $user object in memcache_admin, which might "lead to a role change not being recognized until the user logs in again."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/926478; http://drupal.org/node/927016; http://secunia.com/advisories/41663
CVE: CVE-2010-5277
Published: 2012-10-07
Description: Unspecified vulnerability in the Views Bulk Operations module 6 before 6.x-1.10 for Drupal allows remote authenticated users with user management permissions to bypass intended access restrictions and delete anonymous users (user 0) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://drupal.org/node/933596; http://drupal.org/node/933960; http://secunia.com/advisories/41696
CVE: CVE-2010-5278
Published: 2012-10-07
Description: Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://modxcms.com/forums/index.php/topic%2C55104.0.html; http://modxcms.com/forums/index.php/topic%2C55105.msg317273.html; http://packetstormsecurity.org/1009-exploits/modx202pl-lfi.txt