deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-3476
Published: 2012-08-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) application/views/admin/layout.php and (2) themes/default/views/header.php in the Ushahidi Platform before 2.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to a site name.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2012/08/09/5; https://github.com/ushahidi/Ushahidi_Web/commit/00eae4f; http://openwall.com/lists/oss-security/2012/08/09/5
CVE: CVE-2012-2324
Published: 2012-08-13
Description: Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.7 allow remote administrators to execute arbitrary SQL commands via unspecified vectors in the (1) user search or (2) Mail Log in the Admin Control Panel (ACP).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.mybb.com/2012/04/01/mybb-1-6-7-update-1-8-development/; http://www.openwall.com/lists/oss-security/2012/05/07/13; http://www.openwall.com/lists/oss-security/2012/05/07/14
CVE: CVE-2012-2325
Published: 2012-08-13
Description: SQL injection vulnerability in the User Inline Moderation feature in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6.7 allows remote administrators to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.mybb.com/2012/04/01/mybb-1-6-7-update-1-8-development/; http://www.openwall.com/lists/oss-security/2012/05/07/13; http://www.openwall.com/lists/oss-security/2012/05/07/14
CVE: CVE-2012-2326
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6.7 allows remote administrators to inject arbitrary web script or HTML via a malformed file name in an orphaned attachment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.mybb.com/2012/04/01/mybb-1-6-7-update-1-8-development/; http://www.openwall.com/lists/oss-security/2012/05/07/13; http://www.openwall.com/lists/oss-security/2012/05/07/14
CVE: CVE-2012-2327
Published: 2012-08-13
Description: MyBB (aka MyBulletinBoard) before 1.6.7 allows remote attackers to obtain sensitive information via a malformed forumread cookie, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://blog.mybb.com/2012/04/01/mybb-1-6-7-update-1-8-development/; http://www.openwall.com/lists/oss-security/2012/05/07/13; http://www.openwall.com/lists/oss-security/2012/05/07/14
CVE: CVE-2012-4250
Published: 2012-08-13
Description: Stack-based buffer overflow in the RequestScreenOptimization function in the XProcessControl.ocx ActiveX control in msls31.dll in Samsung NET-i viewer 1.37 allows remote attackers to execute arbitrary code via a long string in the first argument.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/18808; http://www.securityfocus.com/bid/53317; https://exchange.xforce.ibmcloud.com/vulnerabilities/75310
CVE: CVE-2012-4251
Published: 2012-08-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to index.php, (2) phase parameter to install.php, (3) tablename or (4) dbid parameter to sql.php, or (5) filename parameter to restore.php in learn/cubemail/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.html; http://www.osvdb.org/81610; http://www.osvdb.org/81611
CVE: CVE-2012-4252
Published: 2012-08-13
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to hijack the authentication of administrators for requests that (1) remove file access restriction via a deletehtaccess action, (2) drop a database via a kill value in a db action, (3) uninstall the application via a 101 value in the phase parameter to learn/cubemail/install.php, (4) delete config.php via a 2 value in the phase parameter to learn/cubemail/install.php, (5) change a password via a schutz action, or (6) execute arbitrary SQL commands via the sql_statement parameter to learn/cubemail/sql.php.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.html; http://www.osvdb.org/81613; http://www.securityfocus.com/bid/53306
CVE: CVE-2012-4253
Published: 2012-08-13
Description: Multiple directory traversal vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) language parameter to learn/cubemail/install.php or (2) f parameter learn/cubemail/filemanagement.php, or execute arbitrary local files via a .. (dot dot) in the (3) config parameter to learn/cubemail/menu.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.html; http://www.osvdb.org/81609; http://www.osvdb.org/81615
CVE: CVE-2012-4254
Published: 2012-08-13
Description: MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information (Notices) via a direct request to (1) learn/cubemail/restore.php or (2) learn/cubemail/dump.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.html; http://www.osvdb.org/81616; http://www.securityfocus.com/bid/53306
CVE: CVE-2012-4255
Published: 2012-08-13
Description: MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information via a direct request to learn/cubemail/refresh_dblist.php, which reveals the installation path in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.html; http://www.osvdb.org/81616; http://www.securityfocus.com/bid/53306
CVE: CVE-2012-4256
Published: 2012-08-13
Description: The jNews (com_jnews) component 7.5.1 for Joomla! allows remote attackers to obtain sensitive information via the emailsearch parameter, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://hauntit.blogspot.com/2012/04/en-jnews-jnewscore751-information.html; http://packetstormsecurity.org/files/112233/jNews-7.5.1-Information-Disclosure.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/75198
CVE: CVE-2012-4257
Published: 2012-08-13
Description: Yaqas (Yet Another Question & Answer System) 1.0 Alpha 1 allows remote attackers to obtain sensitive information via an invalid character in the PHPSESSID, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://hauntit.blogspot.com/2012/03/en-yaqas-cms-alpha1-information.html; http://packetstormsecurity.org/files/112248/Yaqas-CMS-Alpha1-Information-Disclosure.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/75205
CVE: CVE-2012-4258
Published: 2012-08-13
Description: Multiple SQL injection vulnerabilities in MYRE Real Estate Software (2012 Q2) allow remote attackers to execute arbitrary SQL commands via the (1) link_idd parameter to 1_mobile/listings.php or (2) userid parameter to 1_mobile/agentprofile.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/112480/MYRE-Real-Estate-Mobile-2012-2-Cross-Site-Scripting-SQL-Injection.html; http://www.exploit-db.com/exploits/18843; http://www.securityfocus.com/bid/53394
CVE: CVE-2012-4259
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in the contacts in (1) XPhone UC Web and the (2) web frontend for XPhone Virtual Directory in C4B XPhone Unified Communications (UC) 2011 Web 4.1.890S R1 allows remote attackers to inject arbitrary web script or HTML via the company name. NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0216.html; http://osvdb.org/81559; http://secunia.com/advisories/48979
CVE: CVE-2012-4260
Published: 2012-08-13
Description: Multiple SQL injection vulnerabilities in myCare2x allow remote attackers to execute arbitrary SQL commands via the (1) aktion or (2) callurl parameter to modules/patient/mycare2x_pat_info.php; (3) dept_nr or (4) pid parameter to modules/importer/mycare2x_importer.php; (5) myOpsEintrag or (6) keyword parameter in a Suchen action to modules/drg/mycare2x_proc_search.php; or (7) name_last or (8) pid parameter to modules/patient/mycare_pid.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/112462/myCare2x-CMS-Cross-Site-Scripting-SQL-Injection.html; http://secunia.com/advisories/49029; http://www.exploit-db.com/exploits/18844
CVE: CVE-2012-4261
Published: 2012-08-13
Description: SQL injection vulnerability in modules/patient/mycare2x_pat_info.php in myCare2x allows remote attackers to execute arbitrary SQL commands via the lang parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/49029; http://www.osvdb.org/81684; https://exchange.xforce.ibmcloud.com/vulnerabilities/75390
CVE: CVE-2012-4262
Published: 2012-08-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or HTML via the (1) name_last, (2) name_first, (3) name_middle, or (4) name_maiden parameter to modules/patient/mycare_pid.php; (5) favorites or (6) lang parameter to modules/nursing/mycare_ward_print.php; (7) aktion or (8) callurl parameter to modules/patient/mycare2x_pat_info.php; or (9) ln parameter to modules/drg/mycare2x_proc_search.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112462/myCare2x-CMS-Cross-Site-Scripting-SQL-Injection.html; http://secunia.com/advisories/49029; http://www.exploit-db.com/exploits/18844
CVE: CVE-2009-5066
Published: 2012-08-13
Description: twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://objectopia.com/2009/10/01/securing-jmx-invoker-layer-in-jboss/; http://rhn.redhat.com/errata/RHSA-2013-0191.html; http://rhn.redhat.com/errata/RHSA-2013-0192.html
CVE: CVE-2011-0523
Published: 2012-08-13
Description: gypsy 0.8 does not properly restrict the files that can be read while running with root privileges, which allows local users to read otherwise restricted files via unspecified vectors.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://cgit.freedesktop.org/gypsy/commit/?id=40101707cddb319481133b2a137294b6b669bd16; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106919.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106927.html
CVE: CVE-2011-0524
Published: 2012-08-13
Description: Multiple buffer overflows in the NMEA parser (nmea-gen.c) in gypsy 0.8 allow local users to cause a denial of service (crash) via unspecified vectors related to the sprintf function.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106919.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106927.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107020.html
CVE: CVE-2012-2368
Published: 2012-08-13
Description: Bytemark Symbiosis before Revision 1322 does not properly validate passwords, which allows remote attackers to gain access to email accounts via an arbitrary password.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/48993; http://www.openwall.com/lists/oss-security/2012/05/14/1; http://www.openwall.com/lists/oss-security/2012/05/14/3
CVE: CVE-2012-2370
Published: 2012-08-13
Description: Multiple integer overflows in the read_bitmap_file_data function in io-xbm.c in gdk-pixbuf before 2.26.1 allow remote attackers to cause a denial of service (application crash) via a negative (1) height or (2) width in an XBM file, which triggers a heap-based buffer overflow.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://git.gnome.org/browse/gdk-pixbuf/; http://git.gnome.org/browse/gdk-pixbuf/commit/?id=4f0f465f991cd454d03189497f923eb40c170c22; http://git.gnome.org/browse/gdk-pixbuf/commit/?id=b1bb3053856aede37d473c92f0e5a10e29f10516
CVE: CVE-2012-2371
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pagination_wp_facethumb parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112658/WordPress-WP-FaceThumb-Gallery-0.1-Cross-Site-Scripting.html; http://secunia.com/advisories/49143; http://wordpress.org/support/topic/plugin-wp-facethumb-reflected-xss-vulnerability-cwe-79
CVE: CVE-2012-2662
Published: 2012-08-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to the (1) System Agent or (2) End Entity pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/84099; http://rhn.redhat.com/errata/RHSA-2012-1103.html; http://rhn.redhat.com/errata/RHSA-2015-1347.html
CVE: CVE-2012-2806
Published: 2012-08-13
Description: Heap-based buffer overflow in the get_sos function in jdmarker.c in libjpeg-turbo 1.2.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large component count in the header of a JPEG image.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://libjpeg-turbo.svn.sourceforge.net/viewvc/libjpeg-turbo?view=revision&revision=830; http://osvdb.org/84040; http://secunia.com/advisories/49883
CVE: CVE-2012-3367
Published: 2012-08-13
Description: Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made through the web interface, which allows remote attackers with permissions to revoke end entity certificates to revoke the Certificate Authority (CA) certificate.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-310
References: http://osvdb.org/84098; http://rhn.redhat.com/errata/RHSA-2012-1103.html; http://secunia.com/advisories/50013
CVE: CVE-2012-3401
Published: 2012-08-13
Description: The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://libjpeg-turbo.svn.sourceforge.net/viewvc/libjpeg-turbo?view=revision&revision=830; http://lists.opensuse.org/opensuse-updates/2012-08/msg00011.html; http://osvdb.org/84090
CVE: CVE-2012-3417
Published: 2012-08-13
Description: The good_client function in rquotad (rquota_svc.c) in Linux DiskQuota (aka quota) before 3.17 invokes the hosts_ctl function the first time without a host name, which might allow remote attackers to bypass TCP Wrappers rules in hosts.deny.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://linuxquota.git.sourceforge.net/git/gitweb.cgi?p=linuxquota/linuxquota%3Ba=commitdiff%3Bh=0abbfe92536fa5854eb65572de0cf131f80e2387; http://rhn.redhat.com/errata/RHSA-2013-0120.html
CVE: CVE-2012-3425
Published: 2012-08-13
Description: The png_push_read_zTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x before 1.4.10, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large avail_in field value in a PNG image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668082; http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=blob%3Bf=CHANGES%3Bh=284de253b1561b976291ba7405acd71ae71ff597%3Bhb=refs/heads/libpng10; http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=blob%3Bf=CHANGES%3Bh=2da5a7a8b690e257f94353b5b49d493cdc385322%3Bhb=refs/heads/libpng14
CVE: CVE-2012-3869
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in include/classes/class.rex_list.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web script or HTML via the subpage parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-07/0142.html; http://secunia.com/advisories/49904; http://www.redaxo.org/de/download/sicherheitshinweise/
CVE: CVE-2012-4263
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP_USER_AGENT header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bit51.com/software/better-wp-security/changelog/; http://packetstormsecurity.org/files/112617/WordPress-Better-WP-Security-Cross-Site-Scripting.html; http://plugins.trac.wordpress.org/changeset?old_path=%2Fbetter-wp-security&old=542852&new_path=%2Fbetter-wp-security&new=542852
CVE: CVE-2012-4264
Published: 2012-08-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "server variables," a different vulnerability than CVE-2012-4263.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bit51.com/software/better-wp-security/changelog/; http://plugins.trac.wordpress.org/changeset?old_path=%2Fbetter-wp-security&old=542852&new_path=%2Fbetter-wp-security&new=542852; http://bit51.com/software/better-wp-security/changelog/
CVE: CVE-2012-4265
Published: 2012-08-13
Description: SQL injection vulnerability in category_edit.php in Proman Xpress 5.0.1 allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18872; http://www.vulnerability-lab.com/get_content.php?id=512; http://www.exploit-db.com/exploits/18872
CVE: CVE-2012-4266
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in client_details.php in Proman Xpress 5.0.1 allows remote attackers to inject arbitrary web script or HTML via the cl_comments parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49127; http://www.exploit-db.com/exploits/18872; http://www.vulnerability-lab.com/get_content.php?id=512
CVE: CVE-2012-4267
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in user/register in Sockso 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49148; http://smwyg.com/blog/#sockso-persistant-xss-attack; http://www.exploit-db.com/exploits/18868
CVE: CVE-2012-4268
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in bulletproof-security/admin/options.php in the BulletProof Security plugin before .47.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP_ACCEPT_ENCODING header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112618/WordPress-BulletProof-Security-Cross-Site-Scripting.html; http://plugins.trac.wordpress.org/changeset?old_path=%2Fbulletproof-security&old=543044&new_path=%2Fbulletproof-security&new=543044; http://wordpress.org/extend/plugins/bulletproof-security/changelog/
CVE: CVE-2012-4269
Published: 2012-08-13
Description: Unrestricted file upload vulnerability in eFront 3.6.11 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension via an attachment in a message.
CVSS Score: 6.0 (MEDIUM)
References: http://packetstormsecurity.org/files/112496/Efront-3.6.11-Cross-Site-Scripting-Shell-Upload.html; http://www.securityfocus.com/bid/53412; https://exchange.xforce.ibmcloud.com/vulnerabilities/75443
CVE: CVE-2012-4270
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in eFront 3.6.11 allows remote authenticated users to inject arbitrary web script or HTML via the subject box of a message.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112496/Efront-3.6.11-Cross-Site-Scripting-Shell-Upload.html; http://www.securityfocus.com/bid/53412; https://exchange.xforce.ibmcloud.com/vulnerabilities/75442
CVE: CVE-2012-4271
Published: 2012-08-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in bad-behavior-wordpress-admin.php in the Bad Behavior plugin before 2.0.47 and 2.2.x before 2.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, (2) httpbl_key, (3) httpbl_maxage, (4) httpbl_threat, (5) reverse_proxy_addresses, or (6) reverse_proxy_header parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112619/WordPress-Bad-Behavior-Cross-Site-Scripting.html; http://plugins.trac.wordpress.org/changeset?old_path=%2Fbad-behavior&old=543807&new_path=%2Fbad-behavior&new=543807; http://www.securityfocus.com/bid/53477
CVE: CVE-2012-4272
Published: 2012-08-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "processing of the buttons of Xing and Pinterest".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://plugins.trac.wordpress.org/changeset?old_path=%2F2-click-socialmedia-buttons&old=532798&new_path=%2F2-click-socialmedia-buttons&new=532798; http://wordpress.org/extend/plugins/2-click-socialmedia-buttons/changelog/; http://plugins.trac.wordpress.org/changeset?old_path=%2F2-click-socialmedia-buttons&old=532798&new_path=%2F2-click-socialmedia-buttons&new=532798
CVE: CVE-2012-4273
Published: 2012-08-13
Description: Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112615/WordPress-2-Click-Socialmedia-Buttons-Cross-Site-Scripting.html; http://plugins.trac.wordpress.org/changeset?old_path=%2F2-click-socialmedia-buttons&old=532798&new_path=%2F2-click-socialmedia-buttons&new=532798; http://wordpress.org/extend/plugins/2-click-socialmedia-buttons/changelog/
CVE: CVE-2012-4274
Published: 2012-08-13
Description: Unspecified vulnerability in Hitachi Cobol GUI Option 06-00, 06-01 through 06-01-/A, 07-00, 07-01 before 07-01-/B, and 08-00 before 08-00-/B and Cobol GUI Option Server 07-00, 07-01 before 07-01-/B, and 08-00 before 08-00-/B allows remote attackers to execute arbitrary code via unknown attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/49158; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-013/index.html; http://secunia.com/advisories/49158