deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5509
Published: 2013-03-12
Description: aeolus-configserver-setup in the Aeolas Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for a temporary file in /tmp, which allows local users to read credentials by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0545.html; https://bugzilla.redhat.com/show_bug.cgi?id=875294; http://rhn.redhat.com/errata/RHSA-2013-0545.html
CVE: CVE-2012-6076
Published: 2013-03-12
Description: Inkscape before 0.48.4 reads .eps files from /tmp instead of the current directory, which might cause Inkspace to process unintended files, allow local users to obtain sensitive information, and possibly have other unspecified impacts.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=654341; http://lists.opensuse.org/opensuse-updates/2013-02/msg00041.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00043.html
CVE: CVE-2012-6117
Published: 2013-03-12
Description: Aeolus Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for /var/log/aeolus-configserver/configserver.log, which allows local users to read plaintext passwords by reading the log file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0545.html; https://bugzilla.redhat.com/show_bug.cgi?id=875294; http://rhn.redhat.com/errata/RHSA-2013-0545.html
CVE: CVE-2012-6118
Published: 2013-03-12
Description: The Administer tab in Aeolus Conductor allows remote authenticated users to bypass intended quota restrictions by updating the Maximum Running Instances quota user setting.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0545.html; https://bugzilla.redhat.com/show_bug.cgi?id=906192; http://rhn.redhat.com/errata/RHSA-2013-0545.html
CVE: CVE-2013-0252
Published: 2013-03-12
Description: boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mechanisms via crafted trailing bytes.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699649; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699650; http://lists.fedoraproject.org/pipermail/package-announce/2013-February/099103.html
CVE: CVE-2011-1164
Published: 2013-03-12
Description: Vino before 2.99.4 can connect external networks contrary to the statement in the vino-preferences dialog box, which might make it easier for remote attackers to perform attacks.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-16
References: http://rhn.redhat.com/errata/RHSA-2013-0169.html; https://bugzilla.gnome.org/show_bug.cgi?id=596190; https://bugzilla.redhat.com/show_bug.cgi?id=553477
CVE: CVE-2011-1165
Published: 2013-03-12
Description: Vino, possibly before 3.2, does not properly document that it opens ports in UPnP routers when the "Configure network to automatically accept connections" setting is enabled, which might make it easier for remote attackers to perform further attacks.
CVSS Score: 5.1 (MEDIUM)
References: http://git.gnome.org/browse/vino/commit/?id=410bbf8e284409bdef02322af4d4a3a388419566; http://rhn.redhat.com/errata/RHSA-2013-0169.html; http://www.dslreports.com/forum/r25446313-Ubuntu-computer-hijacked-by-hacker~start=40
CVE: CVE-2011-4966
Published: 2013-03-12
Description: modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-255
References: http://lists.opensuse.org/opensuse-updates/2013-01/msg00029.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00079.html; http://rhn.redhat.com/errata/RHBA-2012-0881.html
CVE: CVE-2012-5629
Published: 2013-03-12
Description: The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=885569; http://rhn.redhat.com/errata/RHSA-2013-0229.html; http://rhn.redhat.com/errata/RHSA-2013-0230.html
CVE: CVE-2012-5633
Published: 2013-03-12
Description: The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://cxf.apache.org/cve-2012-5633.html; http://osvdb.org/90079; http://packetstormsecurity.com/files/120213/Apache-CXF-WS-Security-URIMappingInterceptor-Bypass.html
CVE: CVE-2012-5659
Published: 2013-03-12
Description: Untrusted search path vulnerability in plugins/abrt-action-install-debuginfo-to-abrt-cache.c in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to load and execute arbitrary Python modules by modifying the PYTHONPATH environment variable to reference a malicious Python module.
CVSS Score: 3.7 (LOW)
References: http://git.fedorahosted.org/cgit/abrt.git/commit/?id=b173d81b577953b96a282167c7eecd66bf111a4f; http://rhn.redhat.com/errata/RHSA-2013-0215.html; https://bugzilla.redhat.com/show_bug.cgi?id=854011
CVE: CVE-2012-5660
Published: 2013-03-12
Description: abrt-action-install-debuginfo in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to set world-writable permissions for arbitrary files and possibly gain privileges via a symlink attack on "the directories used to store information about crashes."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264, CWE-362
References: http://git.fedorahosted.org/cgit/libreport.git/commit/?id=3bbf961b1884dd32654dd39b360dd78ef294b10a; http://rhn.redhat.com/errata/RHSA-2013-0215.html; https://bugzilla.redhat.com/show_bug.cgi?id=887866
CVE: CVE-2012-6115
Published: 2013-03-12
Description: The domain management tool (rhevm-manage-domains) in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier, when the validate action is enabled, logs the administrative password to a world-readable log file, which allows local users to obtain sensitive information by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://gerrit.ovirt.org/gitweb?p=ovirt-engine.git%3Ba=commit%3Bh=e8c72daec4efa8be0fcd8ea55c41e855ddd8eedf; http://rhn.redhat.com/errata/RHSA-2013-0211.html; http://www.securityfocus.com/bid/57749
CVE: CVE-2013-0168
Published: 2013-03-12
Description: The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to cause a denial of service (free space consumption of other storage domains) via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0211.html; http://www.securityfocus.com/bid/57750; http://www.securitytracker.com/id/1028076
CVE: CVE-2013-0239
Published: 2013-03-12
Description: Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://cxf.apache.org/cve-2013-0239.html; http://osvdb.org/90078; http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html
CVE: CVE-2013-0074
Published: 2013-03-13
Description: Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-022; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16516
CVE: CVE-2013-0079
Published: 2013-03-13
Description: Microsoft Visio Viewer 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Visio file that triggers incorrect memory allocation, aka "Visio Viewer Tree Object Type Confusion Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.kb.cert.org/vuls/id/851777; http://www.us-cert.gov/ncas/alerts/TA13-071A; http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=1024
CVE: CVE-2013-0080
Published: 2013-03-13
Description: Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "Callback Function Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-024; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16596
CVE: CVE-2013-0083
Published: 2013-03-13
Description: Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via crafted content, leading to administrative command execution, aka "SharePoint XSS Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-024; http://www.us-cert.gov/ncas/alerts/TA13-071A
CVE: CVE-2013-0084
Published: 2013-03-13
Description: Directory traversal vulnerability in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allows remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "SharePoint Directory Traversal Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-024; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16445
CVE: CVE-2013-0085
Published: 2013-03-13
Description: Buffer overflow in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allows remote attackers to cause a denial of service (W3WP process crash and site outage) via a crafted URL, aka "Buffer Overflow Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-024; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16414
CVE: CVE-2013-0086
Published: 2013-03-13
Description: Microsoft OneNote 2010 SP1 does not properly determine buffer sizes during memory allocation, which allows remote attackers to obtain sensitive information via a crafted OneNote file, aka "Buffer Size Validation Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-025; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16539
CVE: CVE-2013-0087
Published: 2013-03-13
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer OnResize Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-021; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16583
CVE: CVE-2013-0088
Published: 2013-03-13
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer saveHistory Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-021; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16386
CVE: CVE-2013-0089
Published: 2013-03-13
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CMarkupBehaviorContext Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-021; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16587
CVE: CVE-2013-0090
Published: 2013-03-13
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CCaret Use After Free Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-399
References: http://blog.skylined.nl/[PII_REDACTED]1.html; http://packetstormsecurity.com/files/140186/Microsoft-Internet-Explorer-9-IEFRAME-CView-EnsureSize-Use-After-Free.html; http://www.us-cert.gov/ncas/alerts/TA13-071A
CVE: CVE-2013-0091
Published: 2013-03-13
Description: Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CElement Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-021; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16526
CVE: CVE-2013-0092
Published: 2013-03-13
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer GetMarkupPtr Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-021; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16324
CVE: CVE-2013-0093
Published: 2013-03-13
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer onBeforeCopy Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-021; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16239
CVE: CVE-2013-0094
Published: 2013-03-13
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer removeChild Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-021; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16634
CVE: CVE-2013-0095
Published: 2013-03-13
Description: Outlook in Microsoft Office for Mac 2008 before 12.3.6 and Office for Mac 2011 before 14.3.2 allows remote attackers to trigger access to a remote URL and consequently confirm the rendering of an HTML e-mail message by including unspecified HTML5 elements and leveraging the installation of a WebKit browser on the victim's machine, aka "Unintended Content Loading Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-026; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16082
CVE: CVE-2013-1285
Published: 2013-03-13
Description: The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Windows USB Descriptor Vulnerability," a different vulnerability than CVE-2013-1286 and CVE-2013-1287.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-027; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16441
CVE: CVE-2013-1286
Published: 2013-03-13
Description: The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Windows USB Descriptor Vulnerability," a different vulnerability than CVE-2013-1285 and CVE-2013-1287.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-027; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16591
CVE: CVE-2013-1287
Published: 2013-03-13
Description: The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Windows USB Descriptor Vulnerability," a different vulnerability than CVE-2013-1285 and CVE-2013-1286.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-027; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16498
CVE: CVE-2013-1288
Published: 2013-03-13
Description: Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CTreeNode Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/ncas/alerts/TA13-071A; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-021; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16095
CVE: CVE-2013-2558
Published: 2013-03-13
Description: Unspecified vulnerability in Microsoft Windows 8 allows remote attackers to cause a denial of service (reboot) or possibly have unknown other impact via a crafted TrueType Font (TTF) file, as demonstrated by the[PII_REDACTED]1-01.dmp error report.
CVSS Score: 10.0 (HIGH)
References: http://immunityproducts.blogspot.com/2013/03/infiltrate-preview-truetype-font.html; http://immunityproducts.blogspot.com/2013/03/infiltrate-preview-truetype-font.html
CVE: CVE-2013-0646
Published: 2013-03-13
Description: Integer overflow in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00021.html
CVE: CVE-2013-0650
Published: 2013-03-13
Description: Use-after-free vulnerability in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00021.html
CVE: CVE-2013-1371
Published: 2013-03-13
Description: Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00021.html
CVE: CVE-2013-1375
Published: 2013-03-13
Description: Heap-based buffer overflow in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00021.html
CVE: CVE-2013-0312
Published: 2013-03-13
Description: 389 Directory Server before 1.3.0.4 allows remote attackers to cause a denial of service (crash) via a zero length LDAP control sequence.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://directory.fedoraproject.org/wiki/Releases/1.3.0.4; http://rhn.redhat.com/errata/RHSA-2013-0628.html; http://secunia.com/advisories/52279