deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-6064
Published: 2012-12-03
Description: Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter.  NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html; http://forum.cmsmadesimple.org/viewtopic.php?f=1&t=63545; http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html
CVE: CVE-2012-6065
Published: 2012-12-03
Description: The OM Maximenu module 6.x-1.43 and earlier for Drupal, when the "Title has PHP" option is enabled, allows remote authenticated users with the "Administer OM Maximenu" permission to execute arbitrary PHP code via a "Link Title," a different vulnerability than CVE-2012-5553.
CVSS Score: 4.6 (MEDIUM)
References: http://drupal.org/node/1834046; http://drupal.org/node/1834048; http://www.madirish.net/551
CVE: CVE-2012-5129
Published: 2012-12-04
Description: Heap-based buffer overflow in the WebGL subsystem in Google Chrome OS before 23.0.1271.94 allows remote attackers to cause a denial of service (GPU process crash) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/11/stable-update-for-chrome-os_30.html; http://www.ubuntu.com/usn/USN-1818-1; https://code.google.com/p/chromium/issues/detail?id=145525
CVE: CVE-2012-5137
Published: 2012-12-04
Description: Use-after-free vulnerability in Google Chrome before 23.0.1271.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the Media Source API.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-update_29.html; http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00004.html; http://secunia.com/advisories/51447
CVE: CVE-2012-5138
Published: 2012-12-04
Description: Google Chrome before 23.0.1271.95 does not properly handle file paths, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-update_29.html; http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00004.html; http://secunia.com/advisories/51447
CVE: CVE-2012-5975
Published: 2012-12-04
Description: The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6.2.5, and 6.3.0 through 6.3.2 on UNIX and Linux, when old-style password authentication is enabled, allows remote attackers to bypass authentication via a crafted session involving entry of blank passwords, as demonstrated by a root login session from a modified OpenSSH client with an added input_userauth_passwd_changereq call in sshconnect2.c.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0013.html; http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0065.html; http://www.exploit-db.com/exploits/23082/
CVE: CVE-2012-6066
Published: 2012-12-04
Description: freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0012.html; http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0012.html
CVE: CVE-2012-6067
Published: 2012-12-04
Description: freeFTPd.exe in freeFTPd through 1.0.11 allows remote attackers to bypass authentication via a crafted SFTP session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0011.html; http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0011.html
CVE: CVE-2012-3317
Published: 2012-12-05
Description: IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime Environment (JRE) files, which might allow local users to gain privileges by leveraging access to uid 501 or gid 300.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC85477; http://www.ibm.com/support/docview.wss?uid=swg21611401; https://exchange.xforce.ibmcloud.com/vulnerabilities/77818
CVE: CVE-2012-4347
Published: 2012-12-05
Description: Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) logFile parameter in a logs action to brightmail/export or (2) localBackupFileSelection parameter in an APPLIANCE restoreSource action to brightmail/admin/restore/download.do.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/56789; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00; http://www.securityfocus.com/bid/56789
CVE: CVE-2012-4608
Published: 2012-12-05
Description: Cross-site request forgery (CSRF) vulnerability in the web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2012-12/0002.html; http://archives.neohapsis.com/archives/bugtraq/2012-12/0002.html
CVE: CVE-2012-4609
Published: 2012-12-05
Description: The web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2012-12/0002.html; http://archives.neohapsis.com/archives/bugtraq/2012-12/0002.html
CVE: CVE-2012-4862
Published: 2012-12-05
Description: The Host Connect emulator in IBM Rational Developer for System z 7.1 through 8.5.1 does not properly store the SSL certificate password, which allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://secunia.com/advisories/51401; http://www.ibm.com/support/docview.wss?uid=swg21617886; http://www.securityfocus.com/bid/56725
CVE: CVE-2012-4982
Published: 2012-12-05
Description: Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the a parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.reactionpenetrationtesting.co.uk/forescout-cross-site-redirection.html; http://www.securityfocus.com/bid/56687; http://www.reactionpenetrationtesting.co.uk/forescout-cross-site-redirection.html
CVE: CVE-2012-4983
Published: 2012-12-05
Description: Multiple cross-site scripting (XSS) vulnerabilities on the Forescout CounterACT NAC device before 7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the a parameter to assets/login or (2) the query parameter to assets/rangesearch.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.reactionpenetrationtesting.co.uk/forescout-nac-xss.html; http://www.securityfocus.com/bid/56688; http://www.reactionpenetrationtesting.co.uk/forescout-nac-xss.html
CVE: CVE-2012-4985
Published: 2012-12-05
Description: The Forescout CounterACT NAC device 6.3.4.1 does not block ARP and ICMP traffic from unrecognized clients, which allows remote attackers to conduct ARP poisoning attacks via crafted packets.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/87895; http://www.reactionpenetrationtesting.co.uk/forescout-nac-icmp-arp.html; http://www.securityfocus.com/bid/56689
CVE: CVE-2012-5592
Published: 2012-12-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6052. Reason: This candidate is a reservation duplicate of CVE-2012-6052. Notes: All CVE users should reference CVE-2012-6052 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2012-5593
Published: 2012-12-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6053. Reason: This candidate is a reservation duplicate of CVE-2012-6053. Notes: All CVE users should reference CVE-2012-6053 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2012-5594
Published: 2012-12-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6054. Reason: This candidate is a reservation duplicate of CVE-2012-6054. Notes: All CVE users should reference CVE-2012-6054 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2012-5595
Published: 2012-12-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6056. Reason: This candidate is a reservation duplicate of CVE-2012-6056. Notes: All CVE users should reference CVE-2012-6056 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2012-5596
Published: 2012-12-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6057. Reason: This candidate is a reservation duplicate of CVE-2012-6057. Notes: All CVE users should reference CVE-2012-6057 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2012-5597
Published: 2012-12-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6059. Reason: This candidate is a reservation duplicate of CVE-2012-6059. Notes: All CVE users should reference CVE-2012-6059 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2012-5598
Published: 2012-12-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6060. Reason: This candidate is a reservation duplicate of CVE-2012-6060. Notes: All CVE users should reference CVE-2012-6060 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2012-5599
Published: 2012-12-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6061. Reason: This candidate is a reservation duplicate of CVE-2012-6061. Notes: All CVE users should reference CVE-2012-6061 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2012-5600
Published: 2012-12-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6062. Reason: This candidate is a reservation duplicate of CVE-2012-6062. Notes: All CVE users should reference CVE-2012-6062 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2012-5601
Published: 2012-12-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6055. Reason: This candidate is a reservation duplicate of CVE-2012-6055. Notes: All CVE users should reference CVE-2012-6055 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2012-5602
Published: 2012-12-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-6058.  Reason: This candidate is a reservation duplicate of CVE-2012-6058.  Notes: All CVE users should reference CVE-2012-6058 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-6052
Published: 2012-12-05
Description: Wireshark 1.8.x before 1.8.4 allows remote attackers to obtain sensitive hostname information by reading pcap-ng files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2012-12/msg00022.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00042.html; http://www.wireshark.org/security/wnpa-sec-2012-30.html
CVE: CVE-2012-6053
Published: 2012-12-05
Description: epan/dissectors/packet-usb.c in the USB dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 relies on a length field to calculate an offset value, which allows remote attackers to cause a denial of service (infinite loop) via a zero value for this field.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-usb.c?r1=45310&r2=45309&pathrev=45310; http://anonsvn.wireshark.org/viewvc?view=revision&revision=45310; http://lists.opensuse.org/opensuse-updates/2012-12/msg00022.html
CVE: CVE-2012-6054
Published: 2012-12-05
Description: The dissect_sflow_245_address_type function in epan/dissectors/packet-sflow.c in the sFlow dissector in Wireshark 1.8.x before 1.8.4 does not properly handle length calculations for an invalid IP address type, which allows remote attackers to cause a denial of service (infinite loop) via a packet that is neither IPv4 nor IPv6.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-sflow.c?r1=45324&r2=45323&pathrev=45324; http://anonsvn.wireshark.org/viewvc?view=revision&revision=45324; http://lists.opensuse.org/opensuse-updates/2012-12/msg00022.html
CVE: CVE-2012-6055
Published: 2012-12-05
Description: epan/dissectors/packet-3g-a11.c in the 3GPP2 A11 dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a zero value in a sub-type length field.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-3g-a11.c?r1=45337&r2=45336&pathrev=45337; http://anonsvn.wireshark.org/viewvc?view=revision&revision=45337; http://lists.opensuse.org/opensuse-updates/2012-12/msg00022.html
CVE: CVE-2012-6056
Published: 2012-12-05
Description: Integer overflow in the dissect_sack_chunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Duplicate TSN count.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-sctp.c?r1=45355&r2=45354&pathrev=45355; http://anonsvn.wireshark.org/viewvc?view=revision&revision=45355; http://lists.opensuse.org/opensuse-updates/2012-12/msg00022.html
CVE: CVE-2012-6057
Published: 2012-12-05
Description: The dissect_eigrp_metric_comm function in epan/dissectors/packet-eigrp.c in the EIGRP dissector in Wireshark 1.8.x before 1.8.4 uses the wrong data type for a certain offset value, which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a malformed packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-eigrp.c?r1=45408&r2=45407&pathrev=45408; http://anonsvn.wireshark.org/viewvc?view=revision&revision=45408; http://lists.opensuse.org/opensuse-updates/2012-12/msg00022.html
CVE: CVE-2012-6058
Published: 2012-12-05
Description: Integer overflow in the dissect_icmpv6 function in epan/dissectors/packet-icmpv6.c in the ICMPv6 dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Number of Sources value.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-icmpv6.c?r1=45459&r2=45458&pathrev=45459; http://anonsvn.wireshark.org/viewvc?view=revision&revision=45459; http://lists.opensuse.org/opensuse-updates/2012-12/msg00022.html
CVE: CVE-2012-6059
Published: 2012-12-05
Description: The dissect_isakmp function in epan/dissectors/packet-isakmp.c in the ISAKMP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data structure to determine IKEv2 decryption parameters, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-isakmp.c?r1=45510&r2=45509&pathrev=45510; http://anonsvn.wireshark.org/viewvc?view=revision&revision=45510; http://lists.opensuse.org/opensuse-updates/2012-12/msg00022.html
CVE: CVE-2012-6060
Published: 2012-12-05
Description: Integer overflow in the dissect_iscsi_pdu function in epan/dissectors/packet-iscsi.c in the iSCSI dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-iscsi.c?r1=45524&r2=45523&pathrev=45524; http://anonsvn.wireshark.org/viewvc?view=revision&revision=45524; http://lists.opensuse.org/opensuse-updates/2012-12/msg00022.html
CVE: CVE-2012-6061
Published: 2012-12-05
Description: The dissect_wtp_common function in epan/dissectors/packet-wtp.c in the WTP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data type for a certain length field, which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a crafted value in a packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-wtp.c?r1=45614&r2=45613&pathrev=45614; http://anonsvn.wireshark.org/viewvc?view=revision&revision=45614; http://lists.opensuse.org/opensuse-updates/2012-12/msg00022.html
CVE: CVE-2012-6062
Published: 2012-12-05
Description: The dissect_rtcp_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-rtcp.c?r1=45717&r2=45716&pathrev=45717; http://anonsvn.wireshark.org/viewvc?view=revision&revision=45717; http://lists.opensuse.org/opensuse-updates/2012-12/msg00022.html
CVE: CVE-2009-2899
Published: 2012-12-05
Description: The monitor perl script in the Sybase database plug-in in SpringSource Hyperic HQ before 4.3 allows local users to obtain the database password by listing the process and its arguments.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://communities.vmware.com/thread/348773; http://support.springsource.com/security/CVE-2009-2899; https://jira.hyperic.com/browse/HHQ-1031
CVE: CVE-2011-2730
Published: 2012-12-05
Description: VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814; http://rhn.redhat.com/errata/RHSA-2013-0191.html; http://rhn.redhat.com/errata/RHSA-2013-0192.html
CVE: CVE-2011-2731
Published: 2012-12-05
Description: Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-362
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814; http://secunia.com/advisories/55155; http://support.springsource.com/security/cve-2011-2731
CVE: CVE-2011-2732
Published: 2012-12-05
Description: CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814; http://support.springsource.com/security/cve-2011-2732; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814
CVE: CVE-2012-5055
Published: 2012-12-05
Description: DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://support.springsource.com/security/CVE-2012-5055; http://support.springsource.com/security/CVE-2012-5055
CVE: CVE-2012-3272
Published: 2012-12-06
Description: Cross-site scripting (XSS) vulnerability on the HP Color LaserJet CM3530 with firmware before 53.190.9, Color LaserJet CM60xx with firmware before 52.210.9, Color LaserJet CP3525 with firmware before 06.140.3 18, Color LaserJet CP4xxx with firmware before 07.120.6, Color LaserJet CP6015 with firmware before 04.160.3, LaserJet P3015 with firmware before 07.140.3, and LaserJet P4xxx with firmware before 04.170.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id?1027841; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03556108; http://www.securitytracker.com/id?1027841
CVE: CVE-2012-3273
Published: 2012-12-06
Description: Multiple unspecified vulnerabilities on the HP LaserJet Pro 400 MFP M425 with firmware 20120625 and LaserJet 400 M401 with firmware 20120621 allow remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securitytracker.com/id?1027840; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03464042; http://www.securitytracker.com/id?1027840
CVE: CVE-2012-3274
Published: 2012-12-06
Description: Stack-based buffer overflow in uam.exe in the User Access Manager (UAM) component in HP Intelligent Management Center (IMC) before 5.1 E0101P01 allows remote attackers to execute arbitrary code via vectors related to log data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://zerodayinitiative.com/advisories/ZDI-12-171/; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03589863; http://zerodayinitiative.com/advisories/ZDI-12-171/
CVE: CVE-2012-3275
Published: 2012-12-06
Description: Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.1x and 9.20 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id?1027843; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03507416; http://www.securitytracker.com/id?1027843
CVE: CVE-2012-5175
Published: 2012-12-06
Description: Cross-site scripting (XSS) vulnerability in KENT-WEB ACCESS REPORT 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to access-log data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN68830017/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000106; http://www.kent-web.com/data/report.html