deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-3441
Published: 2011-11-11
Description: libinfo in Apple iOS before 5.0.1 does not properly formulate domain-name queries, which allows remote attackers to obtain sensitive information via a crafted DNS hostname.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/Security-announce/2011/Nov/msg00001.html; http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html; http://support.apple.com/kb/HT5052
CVE: CVE-2011-3442
Published: 2011-11-11
Description: The kernel in Apple iOS before 5.0.1 does not ensure the validity of flag combinations for an mmap system call, which allows local users to execute arbitrary unsigned code via a crafted app.
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/Security-announce/2011/Nov/msg00001.html; http://support.apple.com/kb/HT5052; http://www.securitytracker.com/id?1026287
CVE: CVE-2011-1375
Published: 2011-11-11
Description: IBM AIX 6.1 and 7.1 does not restrict the wpar_limits_config and wpar_limits_modify system calls, which allows local users to cause a denial of service (system crash) via a crafted call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=isg1IV10227; http://www-01.ibm.com/support/docview.wss?uid=isg1IV10229; https://exchange.xforce.ibmcloud.com/vulnerabilities/71211
CVE: CVE-2011-3376
Published: 2011-11-11
Description: org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/DefaultInstanceManager.java?r1=1176588&r2=1176587&pathrev=1176588; http://svn.apache.org/viewvc?view=revision&revision=1176588; http://tomcat.apache.org/security-7.html
CVE: CVE-2011-4434
Published: 2011-11-11
Description: Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 do not properly enforce AppLocker rules, which allows local users to bypass intended access restrictions via a (1) macro or (2) scripting feature in an application, as demonstrated by Microsoft Office applications and the SANDBOX_INERT and LOAD_IGNORE_CODE_AUTHZ_LEVEL flags.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://support.microsoft.com/kb/2532445; http://support.microsoft.com/kb/2532445
CVE: CVE-2011-4435
Published: 2011-11-11
Description: The web-server component in the Consolidation and Analysis Engine (CAE) Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not prevent directory browsing, which allows remote attackers to obtain sensitive information via HTTP requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/46487; http://www.ibm.com/support/docview.wss?uid=swg1PM41190; http://www.securitytracker.com/id?1026278
CVE: CVE-2011-4046
Published: 2011-11-12
Description: The Dell KACE K2000 System Deployment Appliance stores the recovery account password in cleartext within a PHP script, which allows context-dependent attackers to obtain sensitive information by examining script source code.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.kace.com/support/kb/index.php?action=artikel&id=1120&artlang=en; http://www.kb.cert.org/vuls/id/135606; http://www.kace.com/support/kb/index.php?action=artikel&id=1120&artlang=en
CVE: CVE-2011-4047
Published: 2011-11-12
Description: The Dell KACE K2000 System Deployment Appliance allows remote attackers to execute arbitrary commands by leveraging database write access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.kace.com/support/kb/index.php?action=artikel&id=1120&artlang=en; http://www.kb.cert.org/vuls/id/589089; http://www.kace.com/support/kb/index.php?action=artikel&id=1120&artlang=en
CVE: CVE-2011-4048
Published: 2011-11-12
Description: The Dell KACE K2000 System Deployment Appliance has a default username and password for the read-only reporting account, which makes it easier for remote attackers to obtain sensitive information from the database by leveraging the default credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/702169; https://support.software.dell.com/k2000-systems-deployment-appliance/kb/115560; http://www.kb.cert.org/vuls/id/702169
CVE: CVE-2011-4436
Published: 2011-11-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface on the Dell KACE K2000 System Deployment Appliance allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.kace.com/support/kb/index.php?action=artikel&id=1120&artlang=en; http://www.kb.cert.org/vuls/id/193529; http://www.kace.com/support/kb/index.php?action=artikel&id=1120&artlang=en
CVE: CVE-2011-2771
Published: 2011-11-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mahara before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) URI attributes and (2) the External Feed component, as demonstrated by the guid element in an RSS feed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/46719; http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz; http://www.debian.org/security/2011/dsa-2334
CVE: CVE-2011-2772
Published: 2011-11-15
Description: The get_dataroot_image_path function in lib/file.php in Mahara before 1.4.1 does not properly validate uploaded image files, which allows remote attackers to cause a denial of service (memory consumption) via a (1) large or (2) invalid image.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/46719; http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz; http://www.debian.org/security/2011/dsa-2334
CVE: CVE-2011-2773
Published: 2011-11-15
Description: Cross-site request forgery (CSRF) vulnerability in Mahara before 1.4.1 allows remote attackers to hijack the authentication of administrators for requests that add a user to an institution.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/46719; http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz; http://www.debian.org/security/2011/dsa-2334
CVE: CVE-2011-2774
Published: 2011-11-15
Description: The "Reply to message" feature in Mahara 1.3.x and 1.4.x before 1.4.1 allows remote authenticated users to read the messages of a different user via a modified replyto parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/46719; https://launchpad.net/bugs/798128; https://launchpad.net/mahara/+milestone/1.4.1
CVE: CVE-2011-4118
Published: 2011-11-15
Description: Mahara before 1.4.1, when MNet (aka the Moodle network feature) is used, allows remote authenticated users to gain privileges via a jump to an XMLRPC target.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://mahara.org/interaction/forum/topic.php?id=4138; http://openwall.com/lists/oss-security/2011/11/04/10; http://openwall.com/lists/oss-security/2011/11/04/7
CVE: CVE-2008-7303
Published: 2011-11-15
Description: The nonet and nointernet sandbox profiles in Apple Mac OS X 10.5.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as demonstrated by use of launchctl to trigger the launchd daemon's execution of a script file, a related issue to CVE-2011-1516.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://www.coresecurity.com/content/apple-osx-sandbox-bypass; https://www.blackhat.com/presentations/bh-jp-08/bh-jp-08-Miller/BlackHat-Japan-08-Miller-Hacking-OSX.pdf; http://www.coresecurity.com/content/apple-osx-sandbox-bypass
CVE: CVE-2011-1516
Published: 2011-11-15
Description: The kSBXProfileNoNetwork and kSBXProfileNoInternet sandbox profiles in Apple Mac OS X 10.5.x through 10.7.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as demonstrated by use of osascript to send Apple events to the launchd daemon, a related issue to CVE-2008-7303.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://www.coresecurity.com/content/apple-osx-sandbox-bypass; http://www.securityfocus.com/archive/1/520479/100/100/threaded; http://www.coresecurity.com/content/apple-osx-sandbox-bypass
CVE: CVE-2011-4157
Published: 2011-11-16
Description: Stack-based buffer overflow in hydra.exe in HP SAN/iQ before 9.5 on the HP StorageWorks P4000 Virtual SAN Appliance allows remote attackers to execute arbitrary code via a crafted login request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03082086; http://www.securityfocus.com/bid/47005; http://www.securityfocus.com/bid/51042
CVE: CVE-2011-4158
Published: 2011-11-16
Description: Unspecified vulnerability in HP Directories Support for ProLiant Management Processors 3.10 and 3.20 for Integrated Lights-Out iLO2 and iLO3 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://securityreason.com/securityalert/8531; http://www.securityfocus.com/archive/1/520484/100/0/threaded; http://securityreason.com/securityalert/8531
CVE: CVE-2011-4456
Published: 2011-11-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-4313.  Reason: This candidate is a reservation duplicate of CVE-2011-4313.  Notes: All CVE users should reference CVE-2011-4313 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-4155
Published: 2011-11-16
Description: Cross-site scripting (XSS) vulnerability in HP Network Node Manager i (NNMi) 9.0x and 9.1x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-4156.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/8532; http://www.securityfocus.com/archive/1/520459; http://securityreason.com/securityalert/8532
CVE: CVE-2011-4156
Published: 2011-11-16
Description: Cross-site scripting (XSS) vulnerability in HP Network Node Manager i (NNMi) 9.0x and 9.1x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-4155.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/8532; http://www.securityfocus.com/archive/1/520459; http://securityreason.com/securityalert/8532
CVE: CVE-2011-2770
Published: 2011-11-17
Description: Cross-site scripting (XSS) vulnerability in man2html.cgi.c in man2html 1.6, and possibly other version, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to error messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osdir.com/ml/general/2011-11/msg09394.html; http://osvdb.org/76912; http://secunia.com/advisories/46760
CVE: CVE-2011-3380
Published: 2011-11-17
Description: Openswan 2.6.29 through 2.6.35 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto IKE daemon crash) via an ISAKMP message with an invalid KEY_LENGTH attribute, which is not properly handled by the error handling function.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/46306; http://www.openswan.org/download/CVE-2011-3380/CVE-2011-3380.txt; http://www.redhat.com/support/errata/RHSA-2011-1356.html
CVE: CVE-2011-3627
Published: 2011-11-17
Description: The bytecode engine in ClamAV before 0.97.3 allows remote attackers to cause a denial of service (crash) via vectors related to "recursion level" and (1) libclamav/bytecode.c and (2) libclamav/bytecode_api.c.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=commitdiff%3Bh=3d664817f6ef833a17414a4ecea42004c35cc42f; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/068940.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/068941.html
CVE: CVE-2011-3646
Published: 2011-11-17
Description: phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame parameter to phpmyadmin.css.php, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html
CVE: CVE-2011-4073
Published: 2011-11-17
Description: Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through 2.6.36 allows remote authenticated users to cause a denial of service (pluto IKE daemon crash) via vectors related to the (1) quick_outI1_continue and (2) quick_outI1 functions.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/46678; http://secunia.com/advisories/46681; http://secunia.com/advisories/47342
CVE: CVE-2011-4096
Published: 2011-11-17
Description: The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.squid-cache.org/show_bug.cgi?id=3237#c12; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
CVE: CVE-2011-4107
Published: 2011-11-17
Description: The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html
CVE: CVE-2011-4122
Published: 2011-11-17
Description: Directory traversal vulnerability in openpam_configure.c in OpenPAM before r478 on FreeBSD 8.1 allows local users to load arbitrary DSOs and gain privileges via a .. (dot dot) in the service_name argument to the pam_start function, as demonstrated by a .. in the -c option to kcheckpass.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-22
References: http://c-skills.blogspot.com/2011/11/openpam-trickery.html; http://openwall.com/lists/oss-security/2011/12/07/3; http://openwall.com/lists/oss-security/2011/12/08/9
CVE: CVE-2011-3900
Published: 2011-11-17
Description: Google V8, as used in Google Chrome before 15.0.874.121, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://code.google.com/p/chromium/issues/detail?id=103259; http://googlechromereleases.blogspot.com/2011/11/stable-channel-update_16.html; http://secunia.com/advisories/46933
CVE: CVE-2011-4457
Published: 2011-11-17
Description: OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://code.google.com/p/owasp-java-html-sanitizer/wiki/CVE20114457; http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/CHANGE_LOG.html; http://code.google.com/p/owasp-java-html-sanitizer/wiki/CVE20114457
CVE: CVE-2011-3849
Published: 2011-11-19
Description: Unspecified vulnerability in dxserver before 6279 in CA Directory 8.1 and CA Directory r12 before SP7 CR1 allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP packet.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/520547/100/0/threaded; https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7b286545DB-00B9-4B4C-8DE7-F00827F3CC75%7d; http://www.securityfocus.com/archive/1/520547/100/0/threaded
CVE: CVE-2011-4159
Published: 2011-11-19
Description: Unspecified vulnerability in System Administration Manager (SAM) in EMS before A.04.20.11.04_01 on HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03089106; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14353; http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03089106
CVE: CVE-2011-4311
Published: 2011-11-19
Description: ResourceSpace before 4.2.2833 does not properly validate access keys, which allows remote attackers to bypass intended resource restrictions via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://openwall.com/lists/oss-security/2011/11/13/2; http://openwall.com/lists/oss-security/2011/11/14/3; http://www.resourcespace.org/download.php
CVE: CVE-2011-4404
Published: 2011-11-19
Description: The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://jetty.codehaus.org/jetty/jetty-6/xref/org/mortbay/jetty/handler/ResourceHandler.html; http://jetty.codehaus.org/jetty/jetty-6/xref/org/mortbay/jetty/servlet/DefaultServlet.html; http://www.securitytracker.com/id?1026341
CVE: CVE-2011-4465
Published: 2011-11-19
Description: Cross-site scripting (XSS) vulnerability in IBM Lotus Mobile Connect (LMC) 6.1.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to a hidden redirect URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg1IV07148; http://www.ibm.com/support/docview.wss?uid=swg27020327; https://exchange.xforce.ibmcloud.com/vulnerabilities/72337
CVE: CVE-2011-4040
Published: 2011-11-21
Description: Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a crafted packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/819630; http://www.kb.cert.org/vuls/id/819630
CVE: CVE-2011-4496
Published: 2011-11-21
Description: Buffer overflow in Aviosoft DTV Player 1.0.1.2 allows remote attackers to execute arbitrary code via a crafted .plf (aka playlist) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/998403; http://www.kb.cert.org/vuls/id/998403
CVE: CVE-2011-4497
Published: 2011-11-21
Description: QIS_wizard.htm on the ASUS RT-N56U router with firmware before 1.0.1.4o allows remote attackers to obtain the administrator password via a flag=detect request.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/200814; http://www.kb.cert.org/vuls/id/200814
CVE: CVE-2011-4498
Published: 2011-11-21
Description: Cross-site request forgery (CSRF) vulnerability in the web console in Zenprise Device Manager 6.x through 6.1.8 allows remote attackers to hijack the authentication of administrators for requests that wipe mobile devices.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/584363; http://www.zenpriseportal.com/patches/ZP_SecPatch_618_9995.zip; http://www.kb.cert.org/vuls/id/584363
CVE: CVE-2011-4499
Published: 2011-11-22
Description: The UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS v1 through v3 with firmware before 4.71.1, and WRT54GS v4 with firmware before 1.06.1 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://www.kb.cert.org/vuls/id/357851; http://www.upnp-hacks.org/devices.html; http://www.kb.cert.org/vuls/id/357851
CVE: CVE-2011-4500
Published: 2011-11-22
Description: The UPnP IGD implementation on the Cisco Linksys WRT54GX with firmware 2.00.05, when UPnP is enabled, configures the SOAP server to listen on the WAN port, which allows remote attackers to administer the firewall via SOAP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://www.kb.cert.org/vuls/id/357851; http://www.upnp-hacks.org/devices.html; http://www.kb.cert.org/vuls/id/357851
CVE: CVE-2011-4501
Published: 2011-11-22
Description: The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
CVSS Score: 10.0 (HIGH)
CWE: CWE-16
References: http://www.kb.cert.org/vuls/id/357851; http://www.upnp-hacks.org/devices.html; http://www.upnp-hacks.org/suspect.html
CVE: CVE-2011-4502
Published: 2011-11-22
Description: The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www.kb.cert.org/vuls/id/357851; http://www.upnp-hacks.org/devices.html; http://www.upnp-hacks.org/suspect.html
CVE: CVE-2011-4503
Published: 2011-11-22
Description: The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://www.kb.cert.org/vuls/id/357851; http://www.upnp-hacks.org/suspect.html; http://www.kb.cert.org/vuls/id/357851
CVE: CVE-2011-4504
Published: 2011-11-22
Description: The UPnP IGD implementation in the Pseudo ICS UPnP software on the ZyXEL P-330W allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://www.kb.cert.org/vuls/id/357851; http://www.upnp-hacks.org/suspect.html; http://www.kb.cert.org/vuls/id/357851
CVE: CVE-2011-4505
Published: 2011-11-22
Description: The UPnP IGD implementation on SpeedTouch 5x6 devices with firmware before 6.2.29 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://toor.do/DEFCON-19-Garcia-UPnP-Mapping-WP.pdf; http://www.kb.cert.org/vuls/id/357851; http://toor.do/DEFCON-19-Garcia-UPnP-Mapping-WP.pdf