deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-6439
Published: 2013-01-24
Description: When an affected 
product receives a valid CIP message from an unauthorized or unintended 
source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 
44818/UDP that changes the product’s configuration and network 
parameters, a DoS condition can occur. This situation could cause loss 
of availability and a disruption of communication with other connected 
devices. 

Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
CVSS Score: 8.5 (HIGH)
CWE: CWE-284
References: http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102; http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154
CVE: CVE-2012-6440
Published: 2013-01-24
Description: The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration and diagnostics information.



Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
CVSS Score: 9.3 (HIGH)
CWE: CWE-287, CWE-287
References: http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154; https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155
CVE: CVE-2012-6441
Published: 2013-01-24
Description: An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP. Successful exploitation of this vulnerability could cause loss of confidentiality.





Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154; https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155
CVE: CVE-2012-6442
Published: 2013-01-24
Description: When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the product to reset, a DoS can occur. This situation could cause loss of availability and a disruption of communication with other connected devices.



Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-119
References: http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154; https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155
CVE: CVE-2013-0839
Published: 2013-01-24
Description: Use-after-free vulnerability in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of fonts in CANVAS elements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/01/stable-channel-update_22.html; https://code.google.com/p/chromium/issues/detail?id=151008; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16327
CVE: CVE-2013-0840
Published: 2013-01-24
Description: Google Chrome before 24.0.1312.56 does not validate URLs during the opening of new windows, which has unspecified impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2013/01/stable-channel-update_22.html; https://code.google.com/p/chromium/issues/detail?id=170532; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16335
CVE: CVE-2013-0841
Published: 2013-01-24
Description: Array index error in the content-blocking functionality in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2013/01/stable-channel-update_22.html; https://code.google.com/p/chromium/issues/detail?id=169770; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16000
CVE: CVE-2013-0842
Published: 2013-01-24
Description: Google Chrome before 24.0.1312.56 does not properly handle %00 characters in pathnames, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2013/01/stable-channel-update_22.html; https://code.google.com/p/chromium/issues/detail?id=166867; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16456
CVE: CVE-2013-0843
Published: 2013-01-24
Description: content/renderer/media/webrtc_audio_renderer.cc in Google Chrome before 24.0.1312.56 on Mac OS X does not use an appropriate buffer size for the 96 kHz sampling rate, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a web site that provides WebRTC audio.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2013/01/stable-channel-update_22.html; http://src.chromium.org/viewvc/chrome/trunk/src/content/renderer/media/webrtc_audio_renderer.cc?r1=175323&r2=175322&pathrev=175323; http://src.chromium.org/viewvc/chrome?view=rev&revision=175323
CVE: CVE-2013-1102
Published: 2013-01-24
Description: The Wireless Intrusion Prevention System (wIPS) component on Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.0, 7.1 and 7.2 before 7.2.110.0, and 7.3 before 7.3.101.0 allows remote attackers to cause a denial of service (device reload) via crafted IP packets, aka Bug ID CSCtx80743.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/51965; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc; http://www.securityfocus.com/bid/57524
CVE: CVE-2013-1103
Published: 2013-01-24
Description: Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allow remote attackers to cause a denial of service (Access Point reload) via crafted SIP packets, aka Bug ID CSCts87659.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/89530; http://secunia.com/advisories/51965; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc
CVE: CVE-2013-1104
Published: 2013-01-24
Description: The HTTP Profiling functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.3.101.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP User-Agent header, aka Bug ID CSCuc15636.
CVSS Score: 9.0 (HIGH)
References: http://osvdb.org/89533; http://secunia.com/advisories/51965; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc
CVE: CVE-2013-1105
Published: 2013-01-24
Description: Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.3, 7.1 and 7.2 before 7.2.111.3, and 7.3 before 7.3.101.0 allow remote authenticated users to bypass wireless-management settings and read or modify the device configuration via an SNMP request, aka Bug ID CSCua60653.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/89532; http://secunia.com/advisories/51965; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc
CVE: CVE-2012-5689
Published: 2013-01-25
Description: ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2013-0550.html; http://www.isc.org/software/bind/advisories/cve-2012-5689; http://www.ubuntu.com/usn/USN-2693-1
CVE: CVE-2012-6272
Published: 2013-01-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dell OpenManage Server Administrator 6.5.0.1, 7.0.0.1, and 7.1.0.1 allow remote attackers to inject arbitrary web script or HTML via the topic parameter to html/index_main.htm in (1) help/sm/en/Output/wwhelp/wwhimpl/js/, (2) help/sm/es/Output/wwhelp/wwhimpl/js/, (3) help/sm/ja/Output/wwhelp/wwhimpl/js/, (4) help/sm/de/Output/wwhelp/wwhimpl/js/, (5) help/sm/fr/Output/wwhelp/wwhimpl/js/, (6) help/sm/zh/Output/wwhelp/wwhimpl/js/, (7) help/hip/en/msgguide/wwhelp/wwhimpl/js/, or (8) help/hip/en/msgguide/wwhelp/wwhimpl/common/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/950172; http://www.kb.cert.org/vuls/id/950172
CVE: CVE-2012-3278
Published: 2013-01-25
Description: Stack-based buffer overflow in magentservice.exe in HP Diagnostics Server 8.x through 8.07 and 9.x through 9.21 allows remote attackers to execute arbitrary code via a malformed message packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-12-162/; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03645497; http://www.zerodayinitiative.com/advisories/ZDI-12-162/
CVE: CVE-2013-0743
Published: 2013-01-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA at the suggestion of the CVE project team.  The candidate had been associated with a correct report of a security problem, but not a problem that is categorized as a vulnerability within CVE.  Compromised or unauthorized SSL certificates are not within CVE's scope.  Notes: none
CVE: CVE-2012-0435
Published: 2013-01-26
Description: SUSE WebYaST before 1.2 0.2.63-0.6.1 allows remote attackers to modify the hosts list, and subsequently conduct man-in-the-middle attacks, via a crafted /host request on TCP port 4984.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00008.html; http://support.novell.com/security/cve/CVE-2012-0435.html; http://www.kb.cert.org/vuls/id/806908
CVE: CVE-2012-6276
Published: 2013-01-26
Description: Directory traversal vulnerability in the web-based management interface on the TP-LINK TL-WR841N router with firmware 3.13.9 build 120201 Rel.54965n and earlier allows remote attackers to read arbitrary files via the URL parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/185100; http://www.kb.cert.org/vuls/id/185100
CVE: CVE-2013-0107
Published: 2013-01-26
Description: Stack-based buffer overflow in Foxit Advanced PDF Editor 3 before 3.04 might allow remote attackers to execute arbitrary code via a crafted document containing instructions that reconstruct a certain security cookie.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/275219; http://www.kb.cert.org/vuls/id/275219
CVE: CVE-2012-4914
Published: 2013-01-26
Description: Stack-based buffer overflow in the reader in CoolPDF 3.0.2.256 allows remote attackers to execute arbitrary code via a PDF document with a crafted stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/51602; http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=70&Itemid=70; http://secunia.com/advisories/51602
CVE: CVE-2012-4917
Published: 2013-01-26
Description: The TripAdvisor app 6.6 for iOS sends cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/51410; http://www.securityfocus.com/bid/57535; http://secunia.com/advisories/51410
CVE: CVE-2012-5484
Published: 2013-01-27
Description: The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority (CA) certificate from the server, which allows man-in-the-middle attackers to spoof a join procedure via a crafted certificate.
CVSS Score: 7.9 (HIGH)
CWE: CWE-310
References: http://git.fedorahosted.org/cgit/freeipa.git/commit/?id=18eea90ebb24a9c22248f0b7e18646cc6e3e3e0f; http://git.fedorahosted.org/cgit/freeipa.git/commit/?id=31e41eea6c[PII_REDACTED]e6065ceba82551c565aa; http://git.fedorahosted.org/cgit/freeipa.git/commit/?id=91f4af7e6af53e1c6bf17ed36cb2161863eddae4
CVE: CVE-2013-0458
Published: 2013-01-27
Description: Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2, when login security is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM71139; http://www.ibm.com/support/docview.wss?uid=swg21622444; https://exchange.xforce.ibmcloud.com/vulnerabilities/81012
CVE: CVE-2013-0459
Published: 2013-01-27
Description: Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM72536; http://www.ibm.com/support/docview.wss?uid=swg21622444; https://exchange.xforce.ibmcloud.com/vulnerabilities/81013
CVE: CVE-2013-0460
Published: 2013-01-27
Description: Cross-site request forgery (CSRF) vulnerability in the portlet subsystem in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 and 7.0 before 7.0.0.27 allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM72275; http://www.ibm.com/support/docview.wss?uid=swg21622444; https://exchange.xforce.ibmcloud.com/vulnerabilities/81014
CVE: CVE-2013-0461
Published: 2013-01-27
Description: Cross-site scripting (XSS) vulnerability in the virtual member manager (VMM) administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM71389; http://www.ibm.com/support/docview.wss?uid=swg21622444; https://exchange.xforce.ibmcloud.com/vulnerabilities/81015
CVE: CVE-2013-0462
Published: 2013-01-27
Description: Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.ibm.com/connections/blogs/PSIRT/entry/security_vulnerabilities_fixed_in_ibm_websphere_application_server_7_0_0_2785; http://www.ibm.com/connections/blogs/PSIRT/entry/security_vulnerabilities_fixed_in_ibm_websphere_application_server_7_0_0_2785
CVE: CVE-2013-0651
Published: 2013-01-27
Description: The Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to read configuration files, and discover data-source credentials, via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-01.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-01.pdf
CVE: CVE-2013-0652
Published: 2013-01-27
Description: GE Intelligent Platforms Proficy Real-Time Information Portal does not restrict access to methods of an unspecified Java class, which allows remote attackers to obtain a username listing via an RMI call.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-01.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-01.pdf
CVE: CVE-2013-0653
Published: 2013-01-27
Description: Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to read arbitrary files via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-02.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-02.pdf
CVE: CVE-2013-0654
Published: 2013-01-27
Description: CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary commands or cause a denial of service (daemon crash) via a crafted packet.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-02.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-02.pdf
CVE: CVE-2012-6098
Published: 2013-01-27
Description: grade/edit/outcome/edit_form.php in Moodle 1.9.x through 1.9.19, 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/grade:manage capability requirement, which allows remote authenticated users to convert custom outcomes into standard site-wide outcomes by leveraging the teacher role and using the re-editing feature.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-27619; http://openwall.com/lists/oss-security/2013/01/21/1; https://moodle.org/mod/forum/discuss.php?d=220158
CVE: CVE-2012-6099
Published: 2013-01-27
Description: The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36977; http://openwall.com/lists/oss-security/2013/01/21/1; https://moodle.org/mod/forum/discuss.php?d=220160
CVE: CVE-2012-6100
Published: 2013-01-27
Description: report/outline/index.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/user:viewhiddendetails capability requirement, which allows remote authenticated users to discover a hidden lastaccess value by reading an activity report.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33340; http://openwall.com/lists/oss-security/2013/01/21/1; https://moodle.org/mod/forum/discuss.php?d=220161
CVE: CVE-2012-6101
Published: 2013-01-27
Description: Multiple open redirect vulnerabilities in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to (1) backup/backupfilesedit.php, (2) comment/comment_post.php, (3) course/switchrole.php, (4) mod/wiki/filesedit.php, (5) tag/coursetags_add.php, or (6) user/files.php.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-35991; http://openwall.com/lists/oss-security/2013/01/21/1; https://moodle.org/mod/forum/discuss.php?d=220162
CVE: CVE-2012-6102
Published: 2013-01-27
Description: lib.php in the Submission comments plugin in the Assignment module in Moodle 2.3.x before 2.3.4 and 2.4.x before 2.4.1 allows remote attackers to read or modify the submission comments (aka feedback comments) of arbitrary users via a crafted URI.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37244; http://openwall.com/lists/oss-security/2013/01/21/1; https://moodle.org/mod/forum/discuss.php?d=220163
CVE: CVE-2012-6103
Published: 2013-01-27
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in user/messageselect.php in the messaging system in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to hijack the authentication of arbitrary users for requests that send course messages.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36600; http://openwall.com/lists/oss-security/2013/01/21/1; https://moodle.org/mod/forum/discuss.php?d=220164
CVE: CVE-2012-6104
Published: 2013-01-27
Description: blog/rsslib.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allows remote attackers to obtain sensitive information from site-level blogs by leveraging the guest role and reading an RSS feed.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36620; http://openwall.com/lists/oss-security/2013/01/21/1; https://moodle.org/mod/forum/discuss.php?d=220165
CVE: CVE-2012-6105
Published: 2013-01-27
Description: blog/rsslib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 continues to provide a blog RSS feed after blogging is disabled, which allows remote attackers to obtain sensitive information by reading this feed.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37467; http://openwall.com/lists/oss-security/2013/01/21/1; https://moodle.org/mod/forum/discuss.php?d=220166
CVE: CVE-2012-6106
Published: 2013-01-27
Description: calendar/managesubscriptions.php in the Manage Subscriptions implementation in Moodle 2.4.x before 2.4.1 omits a capability check, which allows remote authenticated users to remove course-level calendar subscriptions by leveraging the student role and sending an iCalendar object.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37106; http://openwall.com/lists/oss-security/2013/01/21/1; https://moodle.org/mod/forum/discuss.php?d=220167