deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5223
Published: 2012-10-01
Description: The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" in the char_repl parameter, which is inserted into a regular expression that is processed by the preg_replace function with the eval switch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/78508; http://secunia.com/advisories/47699; http://www.exploit-db.com/exploits/18424
CVE: CVE-2012-5224
Published: 2012-10-01
Description: PHP remote file inclusion vulnerability in vb/includes/vba_cmps_include_bottom.php in vBadvanced CMPS 3.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pages[template] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/files/view/109098/vbadvancedcmps-rfilfi.txt; http://www.securityfocus.com/bid/51672; http://www.vbadvanced.com/forum/showthread.php?s=c4fdb72b5c0751a056e814bf32a26ddb&t=44720
CVE: CVE-2012-5225
Published: 2012-10-01
Description: Cross-site scripting (XSS) vulnerability in webscr.php in xClick Cart 1.0.1 and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the shopping_url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/109126/xclickcart-xss.txt; http://st2tea.blogspot.com/2012/01/xclick-cart-cross-site-scripting.html; http://www.securityfocus.com/bid/51699
CVE: CVE-2012-5226
Published: 2012-10-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in Peel SHOPPING 2.8 and 2.9 allow remote attackers to inject arbitrary web script or HTML via the (1) motclef parameter to achat/recherche.php or (2) PATH_INFO to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/18422; http://www.securityfocus.com/bid/51700; https://exchange.xforce.ibmcloud.com/vulnerabilities/72765
CVE: CVE-2012-5227
Published: 2012-10-01
Description: SQL injection vulnerability in administrer/tva.php in Peel SHOPPING 2.8 and 2.9 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18422; http://www.securityfocus.com/bid/51700; https://exchange.xforce.ibmcloud.com/vulnerabilities/72764
CVE: CVE-2012-5228
Published: 2012-10-01
Description: Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/78548; http://secunia.com/advisories/47727; http://www.exploit-db.com/exploits/18419
CVE: CVE-2012-5229
Published: 2012-10-01
Description: Cross-site scripting (XSS) vulnerability in css/gallery-css.php in the Slideshow Gallery2 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the border parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/109114/wpslideshowgallery-xss.txt; http://www.securityfocus.com/bid/51678; https://exchange.xforce.ibmcloud.com/vulnerabilities/72748
CVE: CVE-2012-5230
Published: 2012-10-01
Description: Unspecified vulnerability in the JE Story Submit (com_jesubmit) component before 1.9 for Joomla! has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://joomlaextensions.co.in/product/JE-Story-Submit; http://osvdb.org/78527; http://secunia.com/advisories/47728
CVE: CVE-2012-5231
Published: 2012-10-01
Description: miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted (1) pagename or (2) area variable containing an executable extension, which is not properly handled by (a) update.php when writing files to content/, or (b) updatenews.php when writing files to content/news/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/18410; http://www.securityfocus.com/bid/51612; https://exchange.xforce.ibmcloud.com/vulnerabilities/72645
CVE: CVE-2012-5232
Published: 2012-10-01
Description: Cross-site scripting (XSS) vulnerability in the Quickl Form component for Joomla! allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.joomla.org/Vulnerable_Extensions_List; http://www.securityfocus.com/bid/51704; https://exchange.xforce.ibmcloud.com/vulnerabilities/72760
CVE: CVE-2012-0989
Published: 2012-10-01
Description: Cross-site scripting (XSS) vulnerability in OneOrZero AIMS 2.8.0 Trial Edition build231211 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0117.html; http://www.securityfocus.com/bid/51549; https://exchange.xforce.ibmcloud.com/vulnerabilities/72456
CVE: CVE-2012-1636
Published: 2012-10-01
Description: Cross-site request forgery (CSRF) vulnerability in the stickynote module before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of users for requests that delete stickynotes via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1408556; http://drupal.org/node/1409422; http://drupalcode.org/project/stickynote.git/commit/9a7b535
CVE: CVE-2012-5233
Published: 2012-10-01
Description: Cross-site scripting (XSS) vulnerability in the stickynote module before 7.x-1.1 for Drupal allows remote authenticated users with edit stickynotes privileges to inject arbitrary web script or HTML via unspecified vecotrs.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1408556; http://drupal.org/node/1409422; http://drupalcode.org/project/stickynote.git/commit/7413dd1
CVE: CVE-2011-4945
Published: 2012-10-01
Description: PolicyKit 0.103 sets the AdminIdentities to "wheel" by default, which allows local users in the wheel group to gain root privileges without authentication.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://cgit.freedesktop.org/PolicyKit/commit/?id=763faf434b445c20ae9529100d3ef5290976d0c9; http://patch-tracker.debian.org/patch/series/view/policykit-1/0.104-2/05_revert-admin-identities-unix-group-wheel.patch; http://secunia.com/advisories/48817
CVE: CVE-2012-1470
Published: 2012-10-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in code_editor.php in ocPortal before 7.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2) line parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ocportal.com/site/news/view/new-releases/ocportal-7-1-6-released.htm; http://ocportal.com/site/news/view/ocportal-security-update.htm; https://www.htbridge.com/advisory/HTB23078
CVE: CVE-2012-1471
Published: 2012-10-01
Description: Directory traversal vulnerability in catalogue_file.php in ocPortal before 7.1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://ocportal.com/site/news/view/new-releases/ocportal-7-1-6-released.htm; http://ocportal.com/site/news/view/ocportal-security-update.htm; https://www.htbridge.com/advisory/HTB23078
CVE: CVE-2012-1602
Published: 2012-10-01
Description: user.php in NextBBS 0.6 allows remote attackers to bypass authentication and gain administrator access by setting the userkey cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0135.html; http://packetstormsecurity.org/files/111250/NextBBS-0.6.0-Authentication-Bypass-SQL-Injection-XSS.html; http://www.openwall.com/lists/oss-security/2012/03/29/8
CVE: CVE-2012-1603
Published: 2012-10-01
Description: Multiple SQL injection vulnerabilities in ajaxserver.php in NextBBS 0.6 allow remote attackers to execute arbitrary SQL commands via the (1) curstr parameter in the findUsers function, (2) id parameter in the isIdAvailable function, or (3) username parameter in the getGreetings function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0135.html; http://packetstormsecurity.org/files/111250/NextBBS-0.6.0-Authentication-Bypass-SQL-Injection-XSS.html; http://www.openwall.com/lists/oss-security/2012/03/29/8
CVE: CVE-2012-1604
Published: 2012-10-01
Description: Cross-site scripting (XSS) vulnerability in NextBBS 0.6 allows remote attackers to inject arbitrary web script or HTML via the do parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0135.html; http://packetstormsecurity.org/files/111250/NextBBS-0.6.0-Authentication-Bypass-SQL-Injection-XSS.html; http://www.openwall.com/lists/oss-security/2012/03/29/8
CVE: CVE-2012-4063
Published: 2012-10-01
Description: The Apache Santuario configuration in Eucalyptus before 3.1.1 does not properly restrict applying XML Signature transforms to documents, which allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.eucalyptus.com/eucalyptus-cloud/security/esa-05; https://exchange.xforce.ibmcloud.com/vulnerabilities/78617; http://www.eucalyptus.com/eucalyptus-cloud/security/esa-05
CVE: CVE-2012-4064
Published: 2012-10-01
Description: Eucalyptus before 3.1.1 does not properly restrict the binding of external SOAP web-services messages, which allows remote authenticated users to gain privileges by sending a message to (1) Cloud Controller or (2) Walrus with the internal message format and a modified user id.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.eucalyptus.com/eucalyptus-cloud/security/esa-06; http://www.eucalyptus.com/eucalyptus-cloud/security/esa-06
CVE: CVE-2012-4065
Published: 2012-10-01
Description: Eucalyptus before 3.1.1 does not properly restrict the binding of external SOAP web-services messages, which allows remote authenticated users to bypass unspecified authorization checks and obtain direct access to a (1) Cloud Controller or (2) Walrus service via a crafted message, as demonstrated by changes to a volume, snapshot, or cloud configuration setting.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www.eucalyptus.com/eucalyptus-cloud/security/esa-07; http://www.eucalyptus.com/eucalyptus-cloud/security/esa-07
CVE: CVE-2012-4242
Published: 2012-10-01
Description: Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.reactionpenetrationtesting.co.uk/mf-gig-calendar-xss.html; http://www.securityfocus.com/bid/55622; http://www.reactionpenetrationtesting.co.uk/mf-gig-calendar-xss.html
CVE: CVE-2012-5234
Published: 2012-10-01
Description: Open redirect vulnerability in index.php in ocPortal before 7.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://ocportal.com/site/news/view/new-releases/ocportal-7-1-6-released.htm; http://ocportal.com/site/news/view/ocportal-security-update.htm; http://ocportal.com/site/news/view/new-releases/ocportal-7-1-6-released.htm
CVE: CVE-2012-0691
Published: 2012-10-02
Description: CA License (aka CA Licensing) before 1.90.03 does not properly restrict system commands, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-10/0011.html; http://www.securitytracker.com/id?1027588; https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B79CE87E4-7A35-48A3-99BA-5A0DBEDECA94%7D
CVE: CVE-2012-0692
Published: 2012-10-02
Description: CA License (aka CA Licensing) before 1.90.03 allows local users to modify or create arbitrary files, and consequently gain privileges, via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-10/0011.html; http://www.securitytracker.com/id?1027588; https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B79CE87E4-7A35-48A3-99BA-5A0DBEDECA94%7D
CVE: CVE-2012-3266
Published: 2012-10-02
Description: Unspecified vulnerability in IBRIX 6.1.196 through 6.1.251 on HP IBRIX X9000 Storage allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03510876; https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03510876
CVE: CVE-2012-3314
Published: 2012-10-02
Description: IBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1, 6.2.0, 6.2.1, and 6.2.2 allow remote attackers to establish sessions via a crafted message that leverages (1) a signature-validation bypass for SAML messages containing unsigned elements, (2) incorrect validation of XML messages, or (3) a certificate-chain validation bypass for an XML signature element that contains the signing certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV23435; http://www-01.ibm.com/support/docview.wss?uid=swg1IV23442; http://www-01.ibm.com/support/docview.wss?uid=swg1IV23445
CVE: CVE-2011-1833
Published: 2012-10-03
Description: Race condition in the ecryptfs_mount function in fs/ecryptfs/main.c in the eCryptfs subsystem in the Linux kernel before 3.1 allows local users to bypass intended file permissions via a mount.ecryptfs_private mount with a mismatched uid.
CVSS Score: 3.3 (LOW)
CWE: CWE-264, CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=764355487ea220fdc2faf128d577d7f679b91f97; http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00009.html; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1
CVE: CVE-2011-3209
Published: 2012-10-03
Description: The div_long_long_rem implementation in include/asm-x86/div64.h in the Linux kernel before 2.6.26 on the x86 platform allows local users to cause a denial of service (Divide Error Fault and panic) via a clock_gettime system call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.26; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f8bd2258e2d520dff28c855658bd24bdafb5102d; http://www.openwall.com/lists/oss-security/2011/10/24/3
CVE: CVE-2012-3375
Published: 2012-10-03
Description: The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083.
CVSS Score: 4.9 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=13d518074a952d33d47c428419693f63389547e9; http://secunia.com/advisories/51164; http://ubuntu.com/usn/usn-1529-1
CVE: CVE-2012-3400
Published: 2012-10-03
Description: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.
CVSS Score: 7.6 (HIGH)
CWE: CWE-787
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1df2ae31c724e57be9d7ac00d78db8a5dabdd050; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=adee11b2085bee90bd8f4f52123ffb07882d6256; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691
CVE: CVE-2012-3412
Published: 2012-10-03
Description: The sfc (aka Solarflare Solarstorm) driver in the Linux kernel before 3.2.30 allows remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00005.html; http://rhn.redhat.com/errata/RHSA-2012-1323.html; http://rhn.redhat.com/errata/RHSA-2012-1324.html
CVE: CVE-2012-3430
Published: 2012-10-03
Description: The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=06b6a1cf6e[PII_REDACTED]98d055bb3991957d90a7; http://rhn.redhat.com/errata/RHSA-2012-1323.html; http://secunia.com/advisories/50633
CVE: CVE-2012-3510
Published: 2012-10-03
Description: Use-after-free vulnerability in the xacct_add_tsk function in kernel/tsacct.c in the Linux kernel before 2.6.19 allows local users to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) via a taskstats TASKSTATS_CMD_ATTR_PID command.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-399
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f0ec1aaf54caddd21c259aea8b2ecfbde4ee4fb9; http://rhn.redhat.com/errata/RHSA-2012-1323.html
CVE: CVE-2012-3520
Published: 2012-10-03
Description: The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.
CVSS Score: 1.9 (LOW)
CWE: CWE-287
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e0e3cea46d31d23dc40df0a49a7a2c04fe8edfea; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00005.html; http://lists.opensuse.org/opensuse-updates/2013-02/msg00018.html
CVE: CVE-2012-3552
Published: 2012-10-03
Description: Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: http://ftp.osuosl.org/pub/linux/kernel/v3.0/ChangeLog-3.0; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f6d8bd051c391c1c0458a30b2a7abcd939329259; http://rhn.redhat.com/errata/RHSA-2012-1540.html
CVE: CVE-2012-3488
Published: 2012-10-03
Description: The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html; http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html
CVE: CVE-2012-3489
Published: 2012-10-03
Description: The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html; http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html; http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html
CVE: CVE-2012-5239
Published: 2012-10-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-3548.  Reason: This candidate is a reservation duplicate of CVE-2012-3548.  Notes: All CVE users should reference CVE-2012-3548 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-3511
Published: 2012-10-04
Description: Multiple race conditions in the madvise_remove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service (use-after-free and system crash) via vectors involving a (1) munmap or (2) close system call.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9ab4233dd08036fe34a89c7dc6f47a8bf2eb29eb; http://secunia.com/advisories/50633; http://secunia.com/advisories/50732
CVE: CVE-2012-3267
Published: 2012-10-04
Description: Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.20 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03507708; http://osvdb.org/85891; http://secunia.com/advisories/50861
CVE: CVE-2012-3819
Published: 2012-10-04
Description: Stack consumption vulnerability in dartwebserver.dll 1.9 and earlier, as used in Dart PowerTCP WebServer for ActiveX and other products, allows remote attackers to cause a denial of service (daemon crash) via a long request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://sadgeeksinsnow.blogspot.dk/2012/09/my-first-experiences-bug-hunting-part-1.html; http://www.securityfocus.com/archive/1/524273; http://sadgeeksinsnow.blogspot.dk/2012/09/my-first-experiences-bug-hunting-part-1.html
CVE: CVE-2012-5288
Published: 2012-10-04
Description: SQL injection vulnerability in page.php in phpMyDirectory 1.3.3 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/47471; http://www.exploit-db.com/exploits/18338; https://exchange.xforce.ibmcloud.com/vulnerabilities/72232
CVE: CVE-2012-5289
Published: 2012-10-04
Description: Multiple SQL injection vulnerabilities in Plogger 1.0 RC1 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) index.php or (2) gallery.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/108295/ploggerphotogallery-sql.txt; http://www.securityfocus.com/bid/51228; http://www.securitytracker.com/id?1027608
CVE: CVE-2012-5290
Published: 2012-10-04
Description: Multiple SQL injection vulnerabilities in EasyWebRealEstate allow remote attackers to execute arbitrary SQL commands via the (1) lstid parameter to listings.php or (2) infoid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/108342/EasyWebRealEstate-Blind-SQL-Injection.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72148; http://packetstormsecurity.org/files/108342/EasyWebRealEstate-Blind-SQL-Injection.html
CVE: CVE-2012-5291
Published: 2012-10-04
Description: SQL injection vulnerability in team.php in Posse Softball Director CMS allows remote attackers to execute arbitrary SQL commands via the idteam parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18320; http://www.osvdb.org/82483; http://www.securityfocus.com/bid/51299