deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5819
Published: 2012-11-04
Description: FilesAnywhere does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79932; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5820
Published: 2012-11-04
Description: The developer-account sample code in Google AdMob does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79931; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5821
Published: 2012-11-04
Description: Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.mandriva.com/security/advisories?name=MDVSA-2013:101; http://www.ubuntu.com/usn/USN-1642-1
CVE: CVE-2012-5822
Published: 2012-11-04
Description: The contribution feature in Zamboni does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python urllib2 library.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79929; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5823
Published: 2012-11-04
Description: Open Source Classifieds does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP fsockopen function.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5824
Published: 2012-11-04
Description: Trillian 5.1.0.19 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, a different vulnerability than CVE-2009-4831.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-295
References: http://secunia.com/advisories/51190; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.securityfocus.com/bid/56454
CVE: CVE-2012-5825
Published: 2012-11-04
Description: Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python httplib library.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79831; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2011-5236
Published: 2012-11-06
Description: Moneris eSelectPlus 2.03 PHP API does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.unrest.ca/peerjacking; http://www.unrest.ca/peerjacking
CVE: CVE-2011-5237
Published: 2012-11-06
Description: PayPal WPS ToolKit does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.unrest.ca/peerjacking; http://www.unrest.ca/peerjacking
CVE: CVE-2011-5238
Published: 2012-11-06
Description: google-checkout-php-sample-code before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.unrest.ca/peerjacking; https://code.google.com/p/google-checkout-php-sample-code/downloads/detail?name=checkout-php-1.3.2.zip; http://www.unrest.ca/peerjacking
CVE: CVE-2011-5239
Published: 2012-11-06
Description: CiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.unrest.ca/peerjacking; http://www.unrest.ca/peerjacking
CVE: CVE-2011-5240
Published: 2012-11-06
Description: Magento 1.5 and 1.6.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.unrest.ca/peerjacking; http://www.unrest.ca/peerjacking
CVE: CVE-2011-5241
Published: 2012-11-06
Description: Services_Twitter 0.6.3 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.unrest.ca/peerjacking; http://www.unrest.ca/peerjacking
CVE: CVE-2011-5242
Published: 2012-11-06
Description: tmhOAuth before 0.61 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.unrest.ca/peerjacking; https://github.com/themattharris/tmhOAuth/blob/master/README.md; http://www.unrest.ca/peerjacking
CVE: CVE-2011-5243
Published: 2012-11-06
Description: TwitterOAuth does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.unrest.ca/peerjacking; http://www.unrest.ca/peerjacking
CVE: CVE-2012-5274
Published: 2012-11-07
Description: Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x before 11.2.202.251 on Linux, before 11.1.111.24 on Android 2.x and 3.x, and before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-5275, CVE-2012-5276, CVE-2012-5277, and CVE-2012-5280.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00012.html
CVE: CVE-2012-5275
Published: 2012-11-07
Description: Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x before 11.2.202.251 on Linux, before 11.1.111.24 on Android 2.x and 3.x, and before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-5274, CVE-2012-5276, CVE-2012-5277, and CVE-2012-5280.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00012.html
CVE: CVE-2012-5276
Published: 2012-11-07
Description: Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x before 11.2.202.251 on Linux, before 11.1.111.24 on Android 2.x and 3.x, and before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-5274, CVE-2012-5275, CVE-2012-5277, and CVE-2012-5280.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00012.html
CVE: CVE-2012-5277
Published: 2012-11-07
Description: Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x before 11.2.202.251 on Linux, before 11.1.111.24 on Android 2.x and 3.x, and before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-5274, CVE-2012-5275, CVE-2012-5276, and CVE-2012-5280.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00012.html
CVE: CVE-2012-5278
Published: 2012-11-07
Description: Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x before 11.2.202.251 on Linux, before 11.1.111.24 on Android 2.x and 3.x, and before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600 allow attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00012.html
CVE: CVE-2012-5279
Published: 2012-11-07
Description: Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x before 11.2.202.251 on Linux, before 11.1.111.24 on Android 2.x and 3.x, and before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00012.html
CVE: CVE-2012-5280
Published: 2012-11-07
Description: Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x before 11.2.202.251 on Linux, before 11.1.111.24 on Android 2.x and 3.x, and before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-5274, CVE-2012-5275, CVE-2012-5276, and CVE-2012-5277.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00012.html
CVE: CVE-2012-5115
Published: 2012-11-07
Description: Google Chrome before 23.0.1271.64 on Mac OS X does not properly mitigate improper write behavior in graphics drivers, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger "wild writes."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87084; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-5116
Published: 2012-11-07
Description: Use-after-free vulnerability in Google Chrome before 23.0.1271.64 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of SVG filters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87075; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-5117
Published: 2012-11-07
Description: Google Chrome before 23.0.1271.64 does not properly restrict the loading of an SVG subresource in the context of an IMG element, which has unspecified impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87076; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-5118
Published: 2012-11-07
Description: Google Chrome before 23.0.1271.64 on Mac OS X does not properly validate an integer value during the handling of GPU command buffers, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87074; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-5119
Published: 2012-11-07
Description: Race condition in Pepper, as used in Google Chrome before 23.0.1271.64, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to buffers.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87072; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-5120
Published: 2012-11-07
Description: Google V8 before 3.13.7.5, as used in Google Chrome before 23.0.1271.64, on 64-bit Linux platforms allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds access to an array.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87085; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-5121
Published: 2012-11-07
Description: Use-after-free vulnerability in Google Chrome before 23.0.1271.64 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to video layout.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87073; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-5122
Published: 2012-11-07
Description: Google Chrome before 23.0.1271.64 does not properly perform a cast of an unspecified variable during handling of input, which allows remote attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87071; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-5123
Published: 2012-11-07
Description: Skia, as used in Google Chrome before 23.0.1271.64, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87077; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-5124
Published: 2012-11-07
Description: Google Chrome before 23.0.1271.64 does not properly handle textures, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87078; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-5125
Published: 2012-11-07
Description: Use-after-free vulnerability in Google Chrome before 23.0.1271.64 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of extension tabs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87083; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-5126
Published: 2012-11-07
Description: Use-after-free vulnerability in Google Chrome before 23.0.1271.64 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of plug-in placeholders.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87082; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-5127
Published: 2012-11-07
Description: Integer overflow in Google Chrome before 23.0.1271.64 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted WebP image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87079; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-5128
Published: 2012-11-07
Description: Google V8 before 3.13.7.5, as used in Google Chrome before 23.0.1271.64, does not properly perform write operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html; http://osvdb.org/87081; http://www.securityfocus.com/bid/56413
CVE: CVE-2012-3269
Published: 2012-11-07
Description: Unspecified vulnerability in HP Performance Insight 5.31, 5.40, and 5.41, when Sybase is used, allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors, a different vulnerability than CVE-2012-3270.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03555488; http://secunia.com/advisories/51136; http://www.securityfocus.com/bid/56373
CVE: CVE-2012-3270
Published: 2012-11-07
Description: Unspecified vulnerability in HP Performance Insight 5.31, 5.40, and 5.41, when Sybase is used, allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors, a different vulnerability than CVE-2012-3269.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03555488; http://secunia.com/advisories/51136; http://www.securityfocus.com/bid/56373
CVE: CVE-2012-5424
Published: 2012-11-07
Description: Cisco Secure Access Control System (ACS) 5.x before 5.2 Patch 11 and 5.3 before 5.3 Patch 7, when a certain configuration involving TACACS+ and LDAP is used, does not properly validate passwords, which allows remote attackers to bypass authentication by sending a valid username and a crafted password string, aka Bug ID CSCuc65634.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/87251; http://secunia.com/advisories/51194; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121107-acs
CVE: CVE-2012-3315
Published: 2012-11-08
Description: The Java servlets in the management console in IBM Tivoli Federated Identity Manager (TFIM) through 6.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE security constraints, and obtain sensitive information related to (1) federation metadata or (2) a web plugin configuration template, via a crafted request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/51163; http://www-01.ibm.com/support/docview.wss?uid=swg1IV26825; http://www-01.ibm.com/support/docview.wss?uid=swg1IV26826
CVE: CVE-2012-4020
Published: 2012-11-08
Description: MosP kintai kanri before 4.1.0 does not enforce privilege requirements, which allows remote authenticated users to read other users' information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN23465354/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000096; http://secunia.com/advisories/51110
CVE: CVE-2012-4021
Published: 2012-11-08
Description: MosP kintai kanri before 4.1.0 does not properly perform authentication, which allows remote authenticated users to impersonate arbitrary user accounts, and consequently obtain sensitive information or modify settings, via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN52264310/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000097; http://secunia.com/advisories/51110
CVE: CVE-2012-4022
Published: 2012-11-08
Description: Pebble before 2.6.4 allows remote attackers to trigger loss of blog-entry viewability via a crafted comment.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN75492883/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000098; http://secunia.com/advisories/51102
CVE: CVE-2012-4023
Published: 2012-11-08
Description: CRLF injection vulnerability in Pebble before 2.6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN39563771/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000099; http://secunia.com/advisories/51102
CVE: CVE-2012-5171
Published: 2012-11-08
Description: Directory traversal vulnerability in Be Graph BeZIP before 3.10 allows remote attackers to create or overwrite arbitrary files via a crafted archive file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN18223913/995378/index.html; http://jvn.jp/en/jp/JVN18223913/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000101
CVE: CVE-2011-1374
Published: 2012-11-09
Description: Buffer overflow in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted REGION record in a PICT file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Nov/msg00002.html; http://secunia.com/advisories/51226; http://support.apple.com/kb/HT5581