deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-2103
Published: 2011-06-16
Description: Adobe Reader and Acrobat 8.x before 8.3 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/73065; http://www.adobe.com/support/security/bulletins/apsb11-16.html; http://www.securityfocus.com/bid/48247
CVE: CVE-2011-2104
Published: 2011-06-16
Description: Adobe Reader and Acrobat 8.x before 8.3, 9.x before 9.4.5, and 10.x before 10.1 on Windows and Mac OS X allow attackers to cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/73066; http://www.adobe.com/support/security/bulletins/apsb11-16.html; http://www.securityfocus.com/bid/48251
CVE: CVE-2011-2105
Published: 2011-06-16
Description: Adobe Reader and Acrobat 8.x before 8.3, 9.x before 9.4.5, and 10.x before 10.1 on Windows and Mac OS X allow attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted font data.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/73067; http://www.adobe.com/support/security/bulletins/apsb11-16.html; http://www.kb.cert.org/vuls/id/264729
CVE: CVE-2011-2106
Published: 2011-06-16
Description: Adobe Reader and Acrobat 8.x before 8.3, 9.x before 9.4.5, and 10.x before 10.1 on Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/73068; http://www.adobe.com/support/security/bulletins/apsb11-16.html; http://www.securityfocus.com/bid/48249
CVE: CVE-2011-2108
Published: 2011-06-16
Description: Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors, related to a "design flaw."
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/73012; http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.securityfocus.com/bid/48311
CVE: CVE-2011-2109
Published: 2011-06-16
Description: Multiple integer overflows in Dirapi.dll in Adobe Shockwave Player before 11.6.0.626 allow attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://osvdb.org/73033; http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.us-cert.gov/cas/techalerts/TA11-166A.html
CVE: CVE-2011-2110
Published: 2011-06-16
Description: Adobe Flash Player before 10.3.181.26 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.23 and earlier on Android, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in June 2011.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/44924; http://secunia.com/advisories/44941; http://secunia.com/advisories/44950
CVE: CVE-2011-2111
Published: 2011-06-16
Description: IML32.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2115 and CVE-2011-2116.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.us-cert.gov/cas/techalerts/TA11-166A.html; http://www.adobe.com/support/security/bulletins/apsb11-17.html
CVE: CVE-2011-2112
Published: 2011-06-16
Description: Multiple buffer overflows in IML32.dll in Adobe Shockwave Player before 11.6.0.626 allow attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.us-cert.gov/cas/techalerts/TA11-166A.html; http://www.adobe.com/support/security/bulletins/apsb11-17.html
CVE: CVE-2011-2113
Published: 2011-06-16
Description: Multiple buffer overflows in the Shockwave3DAsset component in Adobe Shockwave Player before 11.6.0.626 allow attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.us-cert.gov/cas/techalerts/TA11-166A.html; http://www.adobe.com/support/security/bulletins/apsb11-17.html
CVE: CVE-2011-2114
Published: 2011-06-16
Description: Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2117, CVE-2011-2124, CVE-2011-2127, and CVE-2011-2128.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.us-cert.gov/cas/techalerts/TA11-166A.html; http://www.adobe.com/support/security/bulletins/apsb11-17.html
CVE: CVE-2011-2115
Published: 2011-06-16
Description: IML32.dll in Adobe Shockwave Player before 11.6.0.626 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted tSAC chunk, which triggers a heap-based buffer overflow, a different vulnerability than CVE-2011-2111 and CVE-2011-2116.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=919; http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.us-cert.gov/cas/techalerts/TA11-166A.html
CVE: CVE-2011-2116
Published: 2011-06-16
Description: IML32.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2111 and CVE-2011-2115.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.us-cert.gov/cas/techalerts/TA11-166A.html; http://www.adobe.com/support/security/bulletins/apsb11-17.html
CVE: CVE-2011-2117
Published: 2011-06-16
Description: Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2114, CVE-2011-2124, CVE-2011-2127, and CVE-2011-2128.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.us-cert.gov/cas/techalerts/TA11-166A.html; http://www.adobe.com/support/security/bulletins/apsb11-17.html
CVE: CVE-2011-2118
Published: 2011-06-16
Description: The FLV ASSET Xtra component in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors, related to an "input validation vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.us-cert.gov/cas/techalerts/TA11-166A.html; http://www.adobe.com/support/security/bulletins/apsb11-17.html
CVE: CVE-2011-2119
Published: 2011-06-16
Description: Dirapi.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0317, CVE-2011-0318, CVE-2011-0319, CVE-2011-0320, CVE-2011-0335, and CVE-2011-2122.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.us-cert.gov/cas/techalerts/TA11-166A.html; http://www.adobe.com/support/security/bulletins/apsb11-17.html
CVE: CVE-2011-2120
Published: 2011-06-16
Description: Integer overflow in the CursorAsset x32 component in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.us-cert.gov/cas/techalerts/TA11-166A.html; http://www.adobe.com/support/security/bulletins/apsb11-17.html
CVE: CVE-2011-2121
Published: 2011-06-16
Description: Integer overflow in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://osvdb.org/73034; http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.us-cert.gov/cas/techalerts/TA11-166A.html
CVE: CVE-2011-2122
Published: 2011-06-16
Description: Dirapi.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors related to rcsL substructures, a different vulnerability than CVE-2011-0317, CVE-2011-0318, CVE-2011-0319, CVE-2011-0320, CVE-2011-0335, and CVE-2011-2119.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/73029; http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.securityfocus.com/archive/1/518439/100/0/threaded
CVE: CVE-2011-2123
Published: 2011-06-16
Description: Integer overflow in the Shockwave 3D Asset x32 component in Adobe Shockwave Player before 11.6.0.626 allows remote attackers to execute arbitrary code via a crafted subrecord in a DEMX chunk, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=922; http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.us-cert.gov/cas/techalerts/TA11-166A.html
CVE: CVE-2011-2124
Published: 2011-06-16
Description: Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2114, CVE-2011-2117, CVE-2011-2127, and CVE-2011-2128.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/73019; http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.securityfocus.com/bid/48294
CVE: CVE-2011-2125
Published: 2011-06-16
Description: Buffer overflow in Dirapix.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/73015; http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.securityfocus.com/bid/48308
CVE: CVE-2011-2126
Published: 2011-06-16
Description: Buffer overflow in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/73011; http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.securityfocus.com/bid/48309
CVE: CVE-2011-2127
Published: 2011-06-16
Description: Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2114, CVE-2011-2117, CVE-2011-2124, and CVE-2011-2128.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/73032; http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.securityfocus.com/bid/48289
CVE: CVE-2011-2128
Published: 2011-06-16
Description: Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2114, CVE-2011-2117, CVE-2011-2124, and CVE-2011-2127.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/73027; http://www.adobe.com/support/security/bulletins/apsb11-17.html; http://www.securityfocus.com/bid/48290
CVE: CVE-2011-2202
Published: 2011-06-16
Description: The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://bugs.php.net/bug.php?id=54939; http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2507&w=2
CVE: CVE-2011-1127
Published: 2011-06-21
Description: SSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly restrict guest access, which allows remote attackers to have an unspecified impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip; http://www.openwall.com/lists/oss-security/2011/02/22/17; http://www.openwall.com/lists/oss-security/2011/03/02/4
CVE: CVE-2011-1128
Published: 2011-06-21
Description: The loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly handle invalid login attempts, which might make it easier for remote attackers to obtain access or cause a denial of service via a brute-force attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip; http://www.openwall.com/lists/oss-security/2011/02/22/17; http://www.openwall.com/lists/oss-security/2011/03/02/4
CVE: CVE-2011-1129
Published: 2011-06-21
Description: Cross-site scripting (XSS) vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a save_items action.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip; http://www.openwall.com/lists/oss-security/2011/02/22/17; http://www.openwall.com/lists/oss-security/2011/03/02/4
CVE: CVE-2011-1130
Published: 2011-06-21
Description: Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly validate the start parameter, which might allow remote attackers to conduct SQL injection attacks, obtain sensitive information, or cause a denial of service via a crafted value, related to the cleanRequest function in QueryString.php and the constructPageIndex function in Subs.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip; http://www.openwall.com/lists/oss-security/2011/02/22/17; http://www.openwall.com/lists/oss-security/2011/03/02/4
CVE: CVE-2011-1131
Published: 2011-06-21
Description: The PlushSearch2 function in Search.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, uses certain cached data in a situation where a temporary table has been created, even though this cached data is intended only for situations where a temporary table has not been created, which might allow remote attackers to obtain sensitive information via a search.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip; http://www.openwall.com/lists/oss-security/2011/02/22/17; http://www.openwall.com/lists/oss-security/2011/03/02/4
CVE: CVE-2011-1480
Published: 2011-06-21
Description: SQL injection vulnerability in admin.php in the administration backend in Francisco Burzi PHP-Nuke 8.0 and earlier allows remote attackers to execute arbitrary SQL commands via the chng_uid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2011/03/23/7; http://www.openwall.com/lists/oss-security/2011/03/30/6; http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_sql_injection
CVE: CVE-2011-1481
Published: 2011-06-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) sender_name or (2) sender_email parameter in a Feedback action to modules.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2011/03/23/8; http://www.openwall.com/lists/oss-security/2011/03/30/7; http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_scripting
CVE: CVE-2011-1482
Published: 2011-06-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in mainfile.php in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts or (2) grant the administrative privilege to a user account, related to a Referer check that uses a substring comparison.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2011/03/23/9; http://www.openwall.com/lists/oss-security/2011/03/30/8; http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_request_forgery
CVE: CVE-2011-1753
Published: 2011-06-21
Description: expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062099.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062145.html; http://secunia.com/advisories/44765
CVE: CVE-2011-1754
Published: 2011-06-21
Description: jabberd14 1.6.1.1 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://packages.debian.org/changelogs/pool/main/j/jabberd14/jabberd14_1.6.1.1-5+squeeze1/changelog; http://secunia.com/advisories/44795; http://www.debian.org/security/2011/dsa-2249
CVE: CVE-2011-1755
Published: 2011-06-21
Description: jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 7.5 (HIGH)
CWE: CWE-776
References: http://codex.xiaoka.com/svn/jabberd2/tags/jabberd-2.2.14/ChangeLog; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061341.html
CVE: CVE-2011-1756
Published: 2011-06-21
Description: modules/xmpp/serv_xmpp.c in Citadel 7.86 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://code.citadel.org/cgit.cgi/git.citadel.org/commit/?id=27c991cc2059f5530d3d4e9689dc976b745f5b0c; http://code.citadel.org/cgit.cgi/git.citadel.org/commit/?id=95040add546a705cc2d1d8f16293141f9f9845a6; http://packages.debian.org/changelogs/pool/main/c/citadel/citadel_7.37-8+lenny1/changelog
CVE: CVE-2011-1757
Published: 2011-06-21
Description: DJabberd 0.84 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://groups.google.com/group/djabberd/msg/e3b250f3c1877ede?dmode=source; http://groups.google.com/group/djabberd/msg/e3b250f3c1877ede?dmode=source
CVE: CVE-2011-2188
Published: 2011-06-21
Description: LuaExpat before 1.2.0 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629225; http://secunia.com/advisories/44866; http://www.openwall.com/lists/oss-security/2011/06/06/19
CVE: CVE-2011-2205
Published: 2011-06-22
Description: Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://blog.prosody.im/prosody-0-8-1-released/; http://hg.prosody.im/0.8/rev/5305a665bdd4; http://hg.prosody.im/0.8/rev/ee6a18f10a8d
CVE: CVE-2011-2530
Published: 2011-06-22
Description: Buffer overflow in RSEds.dll in RSHWare.exe in the EDS Hardware Installation Tool 1.0.5.1 and earlier in Rockwell Automation RSLinx Classic before 2.58 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed .eds file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://rockwellautomation.custhelp.com/app/answers/detail/a_id/279194; http://www.kb.cert.org/vuls/id/127584; http://www.kb.cert.org/vuls/id/MAPG-8G9PWX
CVE: CVE-2011-2531
Published: 2011-06-22
Description: Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service (data truncation) by sending a large amount of data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://blog.prosody.im/prosody-0-8-1-released/; http://hg.prosody.im/0.8/rev/c806a599224a; http://hg.prosody.im/0.8/rev/d2406f0ce8a5
CVE: CVE-2011-2532
Published: 2011-06-22
Description: The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite loop) via invalid JSON data, as demonstrated by truncated data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://blog.prosody.im/prosody-0-8-1-released/; http://hg.prosody.im/0.8/rev/20979f124ad9; http://prosody.im/doc/release/0.8.1
CVE: CVE-2011-1170
Published: 2011-06-22
Description: net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://downloads.avaya.com/css/P8/documents/100145416; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=42eab94fff18cb1091d3501cd284d6bd6cc9c143; http://marc.info/?l=netfilter-devel&m=[PII_REDACTED]9955&w=2
CVE: CVE-2011-1171
Published: 2011-06-22
Description: net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://downloads.avaya.com/css/P8/documents/100145416; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=78b79876761b86653df89c48a7010b5cbd41a84a; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]9894&w=2