deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-1951
Published: 2012-07-18
Description: Use-after-free vulnerability in the nsSMILTimeValueSpec::IsEventBased function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code by interacting with objects used for SMIL Timing.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1952
Published: 2012-07-18
Description: The nsTableFrame::InsertFrames function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly perform a cast of a frame variable during processing of mixed row-group and column-group frames, which might allow remote attackers to execute arbitrary code via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1953
Published: 2012-07-18
Description: The ElementAnimations::EnsureStyleRuleFor function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (buffer over-read, incorrect pointer dereference, and heap-based buffer overflow) or possibly execute arbitrary code via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1954
Published: 2012-07-18
Description: Use-after-free vulnerability in the nsDocument::AdoptNode function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via vectors involving multiple adoptions and empty documents.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1955
Published: 2012-07-18
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allow remote attackers to spoof the address bar via vectors involving history.forward and history.back calls.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1957
Published: 2012-07-18
Description: An unspecified parser-utility class in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly handle EMBED elements within description elements in RSS feeds, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a feed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1958
Published: 2012-07-18
Description: Use-after-free vulnerability in the nsGlobalWindow::PageHidden function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 might allow remote attackers to execute arbitrary code via vectors related to focused content.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1959
Published: 2012-07-18
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not consider the presence of same-compartment security wrappers (SCSW) during the cross-compartment wrapping of objects, which allows remote attackers to bypass intended XBL access restrictions via crafted content.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1960
Published: 2012-07-18
Description: The qcms_transform_data_rgb_out_lut_sse2 function in the QCMS implementation in Mozilla Firefox 4.x through 13.0, Thunderbird 5.0 through 13.0, and SeaMonkey before 2.11 might allow remote attackers to obtain sensitive information from process memory via a crafted color profile that triggers an out-of-bounds read operation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1961
Published: 2012-07-18
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly handle duplicate values in X-Frame-Options headers, which makes it easier for remote attackers to conduct clickjacking attacks via a FRAME element referencing a web site that produces these duplicate values.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1962
Published: 2012-07-18
Description: Use-after-free vulnerability in the JSDependentString::undepend function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via vectors involving strings with multiple dependencies.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1963
Published: 2012-07-18
Description: The Content Security Policy (CSP) functionality in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly restrict the strings placed into the blocked-uri parameter of a violation report, which allows remote web servers to capture OpenID credentials and OAuth 2.0 access tokens by triggering a violation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1964
Published: 2012-07-18
Description: The certificate-warning functionality in browser/components/certerror/content/aboutCertError.xhtml in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.10 does not properly handle attempted clickjacking of the about:certerror page, which allows man-in-the-middle attackers to trick users into adding an unintended exception via an IFRAME element.
CVSS Score: 4.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1965
Published: 2012-07-18
Description: Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting (XSS) protection mechanisms via a feed:javascript: URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1966
Published: 2012-07-18
Description: Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not have the same context-menu restrictions for data: URLs as for javascript: URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-1967
Published: 2012-07-18
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
CVE: CVE-2012-2139
Published: 2012-07-18
Description: Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html
CVE: CVE-2012-2140
Published: 2012-07-18
Description: The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html
CVE: CVE-2012-2303
Published: 2012-07-18
Description: The Spaces module 6.x-3.x before 6.x-3.4 for Drupal does not enforce permissions on non-object pages, which allows remote attackers to obtain sensitive information and possibly have other impacts via unspecified vectors to the (1) Spaces or (2) Spaces OG module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://drupal.org/node/1547730; http://drupal.org/node/1547736; http://drupalcode.org/project/spaces.git/commitdiff/cee919c
CVE: CVE-2012-4033
Published: 2012-07-18
Description: Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://forums.zingiri.com/announcements.php?aid=2; http://secunia.com/advisories/48909; http://wordpress.org/extend/plugins/zingiri-web-shop/changelog/
CVE: CVE-2009-5030
Published: 2012-07-18
Description: The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an "invalid free."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/openjpeg/issues/detail?id=5; http://code.google.com/p/openjpeg/source/detail?r=1703; http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html
CVE: CVE-2012-0866
Published: 2012-07-18
Description: CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER, which allows remote authenticated users to execute otherwise restricted triggers on arbitrary data by installing the trigger on an attacker-owned table.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html; http://rhn.redhat.com/errata/RHSA-2012-0677.html
CVE: CVE-2012-0867
Published: 2012-07-18
Description: PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-295
References: http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html; http://rhn.redhat.com/errata/RHSA-2012-0678.html; http://secunia.com/advisories/49273
CVE: CVE-2012-0868
Published: 2012-07-18
Description: CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html; http://rhn.redhat.com/errata/RHSA-2012-0677.html
CVE: CVE-2012-2655
Published: 2012-07-18
Description: PostgreSQL 8.3.x before 8.3.19, 8.4.x before 8.4.12, 9.0.x before 9.0.8, and 9.1.x before 9.1.4 allows remote authenticated users to cause a denial of service (server crash) by adding the (1) SECURITY DEFINER or (2) SET attributes to a procedural language's call handler.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082258.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082292.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082294.html
CVE: CVE-2012-3358
Published: 2012-07-18
Description: Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted (1) tile number or (2) tile length in a JPEG 2000 image file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/openjpeg/source/detail?r=1727; http://osvdb.org/83741; http://rhn.redhat.com/errata/RHSA-2012-1068.html
CVE: CVE-2012-0284
Published: 2012-07-19
Description: Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC200 Wireless-G PTZ Internet video camera allows remote attackers to execute arbitrary code via a long URL in the first argument (aka the sURL argument).
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-07/0113.html; http://secunia.com/secunia_research/2012-25/; http://www.securityfocus.com/bid/54588
CVE: CVE-2012-2974
Published: 2012-07-19
Description: The web interface on the SMC SMC8024L2 switch allows remote attackers to bypass authentication and obtain administrative access via a direct request to a .html file under (1) status/, (2) system/, (3) ports/, (4) trunks/, (5) vlans/, (6) qos/, (7) rstp/, (8) dot1x/, (9) security/, (10) igmps/, or (11) snmp/.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/377915; http://www.securitytracker.com/id?1027285; http://www.kb.cert.org/vuls/id/377915
CVE: CVE-2012-4024
Published: 2012-07-19
Description: Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option).  NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel; http://www.mandriva.com/security/advisories?name=MDVSA-2013:128; http://www.openwall.com/lists/oss-security/2012/07/19/6
CVE: CVE-2012-4025
Published: 2012-07-19
Description: Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-190
References: http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel; http://www.mandriva.com/security/advisories?name=MDVSA-2013:128; http://www.openwall.com/lists/oss-security/2012/07/19/6
CVE: CVE-2011-4581
Published: 2012-07-20
Description: mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 allows remote authenticated users to discover the username of a wiki creator by visiting the history and deletion user interface.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=140af2a0f0a4598bf568b9ae182cb81eb583edeb; http://moodle.org/mod/forum/discuss.php?d=191747; https://bugzilla.redhat.com/show_bug.cgi?id=761248
CVE: CVE-2011-4582
Published: 2012-07-20
Description: Open redirect vulnerability in the Calendar set page in Moodle 2.1.x before 2.1.3 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a redirection URL.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-28720&sr=1; http://moodle.org/mod/forum/discuss.php?d=191748; https://bugzilla.redhat.com/show_bug.cgi?id=761248
CVE: CVE-2011-4583
Published: 2012-07-20
Description: Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays web service tokens associated with (1) disabled services and (2) users who no longer have authorization, which allows remote authenticated users to have an unspecified impact by reading these tokens.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-28670&sr=1; http://moodle.org/mod/forum/discuss.php?d=191750; https://bugzilla.redhat.com/show_bug.cgi?id=761248
CVE: CVE-2011-4584
Published: 2012-07-20
Description: The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as demonstrated by a Mahara site.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=10df8657c1c138c0d0ab1d4796c552fcec0c299b; http://moodle.org/mod/forum/discuss.php?d=191751; http://www.debian.org/security/2012/dsa-2421
CVE: CVE-2011-4585
Published: 2012-07-20
Description: login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=01dd64a8c8aa95f793accea371b2392e662663c5; http://moodle.org/mod/forum/discuss.php?d=191752; http://www.debian.org/security/2012/dsa-2421
CVE: CVE-2011-4586
Published: 2012-07-20
Description: CRLF injection vulnerability in calendar/set.php in the Calendar subsystem in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=581e8dba387f090d89382115fd850d8b44351526; http://moodle.org/mod/forum/discuss.php?d=191754; http://www.debian.org/security/2012/dsa-2421
CVE: CVE-2011-4587
Published: 2012-07-20
Description: lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable blank passwords.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-255
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e079e82c087becf06d902089d14f3f76686bde19; http://moodle.org/mod/forum/discuss.php?d=191755; http://www.debian.org/security/2012/dsa-2421
CVE: CVE-2011-4588
Published: 2012-07-20
Description: The ip_in_range function in mnet/lib.php in MNET in Moodle 1.9.x before 1.9.15 uses an incorrect data type, which allows remote attackers to bypass intended IP address restrictions via an XMLRPC request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=3ab2851d2a[PII_REDACTED]5d0706c58092e07e861e; http://moodle.org/mod/forum/discuss.php?d=191756; http://www.debian.org/security/2012/dsa-2421
CVE: CVE-2011-4589
Published: 2012-07-20
Description: backup/moodle2/restore_stepslib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not check for the moodle/course:changeidnumber privilege during handling of course ID numbers, which allows remote authenticated users to overwrite ID numbers via a restore action.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29591; http://moodle.org/mod/forum/discuss.php?d=191758; https://bugzilla.redhat.com/show_bug.cgi?id=761248
CVE: CVE-2011-4590
Published: 2012-07-20
Description: The web services implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly consider the maintenance-mode state and account attributes during login attempts, which allows remote authenticated users to bypass intended access restrictions by connecting to a webservice server.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-28629; http://moodle.org/mod/forum/discuss.php?d=191759; https://bugzilla.redhat.com/show_bug.cgi?id=761248