deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-1579
Published: 2011-04-27
Description: The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style Sheets (CSS) token sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information by using the \2f\2a and \2a\2f hex strings to surround CSS comments.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.html
CVE: CVE-2011-1580
Published: 2011-04-27
Description: The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to perform imports from any wgImportSources wiki via a crafted POST request.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.html
CVE: CVE-2011-1586
Published: 2011-04-27
Description: Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://openwall.com/lists/oss-security/2011/04/15/9; http://secunia.com/advisories/44124; http://secunia.com/advisories/44329
CVE: CVE-2011-1587
Published: 2011-04-27
Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-April/000097.html; http://openwall.com/lists/oss-security/2011/04/18/5; http://www.debian.org/security/2011/dsa-2366
CVE: CVE-2011-1599
Published: 2011-04-27
Description: manager.c in the Manager Interface in Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 does not properly check for the system privilege, which allows remote authenticated users to execute arbitrary commands via an Originate action that has an Async header in conjunction with an Application header.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://downloads.digium.com/pub/security/AST-2011-006.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058922.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059702.html
CVE: CVE-2011-1725
Published: 2011-04-27
Description: Unspecified vulnerability in HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, and 9.10 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02789514; http://osvdb.org/72049; http://secunia.com/advisories/44304
CVE: CVE-2011-1718
Published: 2011-04-27
Description: The Web Agents component in CA SiteMinder R6 before SP6 CR2 and R12 before SP3 CR2 does not properly handle multi-line headers, which allows remote authenticated users to conduct impersonation attacks and gain privileges via crafted data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/44218; http://securityreason.com/securityalert/8227; http://securitytracker.com/id?1025423
CVE: CVE-2011-1719
Published: 2011-04-27
Description: Multiple stack-based buffer overflows in the Web Viewer ActiveX controls in CA Output Management Web Viewer 11.0 and 11.5 allow remote attackers to execute arbitrary code via (1) a long SRC property value to the PPSViewer ActiveX control in PPSView.ocx before 1.0.0.7 or (2) a long Title property value to the UOMWV_Helper ActiveX control in UOMWV_HelperActiveX.ocx before 11.5.0.1.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/43681; http://secunia.com/secunia_research/2011-34/; http://secunia.com/secunia_research/2011-35/
CVE: CVE-2011-1839
Published: 2011-04-28
Description: IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg1PM29655; http://www.vupen.com/english/advisories/2011/0919; https://exchange.xforce.ibmcloud.com/vulnerabilities/66714
CVE: CVE-2011-0729
Published: 2011-04-29
Description: dbus_backend/ls-dbus-backend in the D-Bus backend in language-selector before 0.6.7 does not restrict access on the basis of a PolicyKit check result, which allows local users to modify the /etc/default/locale and /etc/environment files via a (1) SetSystemDefaultLangEnv or (2) SetSystemDefaultLanguageEnv call.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/44214; http://www.securityfocus.com/bid/47502; http://www.ubuntu.com/usn/USN-1115-1/
CVE: CVE-2011-1499
Published: 2011-04-29
Description: acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server.
CVSS Score: 2.6 (LOW)
CWE: CWE-16
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=621493; http://openwall.com/lists/oss-security/2011/04/07/9; http://openwall.com/lists/oss-security/2011/04/08/3
CVE: CVE-2011-1535
Published: 2011-04-29
Description: Unspecified vulnerability in HP Insight Control for Linux (aka IC-Linux) before 6.3 allows remote authenticated users to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777; http://secunia.com/advisories/44269; http://securitytracker.com/id?1025413
CVE: CVE-2011-1536
Published: 2011-04-29
Description: Unspecified vulnerability in HP Performance Insight 5.0, 5.1x. 5.2x, 5.3x, 5.4, 5.41, and 5.41.002 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0952&w=2; http://secunia.com/advisories/44258; http://securityreason.com/securityalert/8232
CVE: CVE-2011-1540
Published: 2011-04-29
Description: Unspecified vulnerability in HP System Management Homepage (SMH) before 6.3 allows remote authenticated users to execute arbitrary code via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7777&w=2; http://securityreason.com/securityalert/8233; http://www.securityfocus.com/bid/47507
CVE: CVE-2011-1541
Published: 2011-04-29
Description: Unspecified vulnerability in HP System Management Homepage (SMH) before 6.3 allows remote attackers to bypass intended access restrictions, and consequently execute arbitrary code, via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7777&w=2; http://securityreason.com/securityalert/8233; http://www.securityfocus.com/bid/47512
CVE: CVE-2011-1542
Published: 2011-04-29
Description: Cross-site scripting (XSS) vulnerability in HP Systems Insight Manager (SIM) before 6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1603&w=2; http://securityreason.com/securityalert/8234; http://www.securityfocus.com/bid/47511
CVE: CVE-2011-1543
Published: 2011-04-29
Description: Cross-site request forgery (CSRF) vulnerability in HP Systems Insight Manager (SIM) before 6.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1603&w=2; http://securityreason.com/securityalert/8234; http://www.securityfocus.com/bid/47513
CVE: CVE-2011-1589
Published: 2011-04-29
Description: Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952; http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.16/Changes; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058885.html
CVE: CVE-2011-1590
Published: 2011-04-29
Description: The X.509if dissector in Wireshark 1.2.x before 1.2.16 and 1.4.x before 1.4.5 does not properly initialize certain global variables, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://anonsvn.wireshark.org/viewvc?revision=36608&view=revision; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058900.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058983.html
CVE: CVE-2011-1591
Published: 2011-04-29
Description: Stack-based buffer overflow in the DECT dissector in epan/dissectors/packet-dect.c in Wireshark 1.4.x before 1.4.5 allows remote attackers to execute arbitrary code via a crafted .pcap file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058900.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058983.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058993.html
CVE: CVE-2011-1592
Published: 2011-04-29
Description: The NFS dissector in epan/dissectors/packet-nfs.c in Wireshark 1.4.x before 1.4.5 on Windows uses an incorrect integer data type during decoding of SETCLIENTID calls, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://anonsvn.wireshark.org/viewvc?revision=34115&view=revision; http://openwall.com/lists/oss-security/2011/04/18/2; http://openwall.com/lists/oss-security/2011/04/18/8
CVE: CVE-2009-5074
Published: 2011-05-03
Description: Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes; http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes
CVE: CVE-2010-4802
Published: 2011-05-03
Description: Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952; http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes; http://www.debian.org/security/2011/dsa-2239
CVE: CVE-2010-4803
Published: 2011-05-03
Description: Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952; http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes; http://www.debian.org/security/2011/dsa-2239
CVE: CVE-2011-1841
Published: 2011-05-03
Description: Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes; http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060122.html; http://www.debian.org/security/2011/dsa-2239
CVE: CVE-2011-1842
Published: 2011-05-03
Description: dbus_backend/lsd.py in the D-Bus backend in language-selector before 0.6.7 does not validate the arguments to the (1) SetSystemDefaultLangEnv and (2) SetSystemDefaultLanguageEnv functions, which allows local users to gain privileges via shell metacharacters in a string argument, a different vulnerability than CVE-2011-0729.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/44214; http://www.securityfocus.com/bid/47502; http://www.ubuntu.com/usn/USN-1115-1/
CVE: CVE-2011-1843
Published: 2011-05-03
Description: Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCP connection, related to improper handling of invalid port numbers.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/bid/47715; https://banu.com/bugzilla/show_bug.cgi?id=90; https://banu.com/cgit/tinyproxy/diff/?id=97b[PII_REDACTED]b2ce72f8f4fc3706dab8a3a8439
CVE: CVE-2011-0610
Published: 2011-05-03
Description: The CoolType library in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb11-08.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13967; http://www.adobe.com/support/security/bulletins/apsb11-08.html
CVE: CVE-2011-1087
Published: 2011-05-03
Description: Buffer overflow in VideoLAN VLC media player 1.0.5 allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .mp3 file that is played during bookmark creation.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://openwall.com/lists/oss-security/2011/03/02/3; http://openwall.com/lists/oss-security/2011/03/03/8; http://openwall.com/lists/oss-security/2011/03/03/9
CVE: CVE-2011-1169
Published: 2011-05-03
Description: Array index error in the asihpi_hpi_ioctl function in sound/pci/asihpi/hpioctl.c in the AudioScience HPI driver in the Linux kernel before 2.6.38.1 might allow local users to cause a denial of service (memory corruption) or possibly gain privileges via a crafted adapter index value that triggers access to an invalid kernel pointer.
CVSS Score: 7.2 (HIGH)
CWE: CWE-129
References: http://git.kernel.org/?p=linux/kernel/git/tiwai/sound-2.6.git%3Ba=commit%3Bh=4a122c10fbfe9020df469f0f669da129c5757671; http://openwall.com/lists/oss-security/2011/03/18/1; http://openwall.com/lists/oss-security/2011/03/18/2
CVE: CVE-2011-1494
Published: 2011-05-03
Description: Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-189
References: http://downloads.avaya.com/css/P8/documents/100145416; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html; http://lkml.org/lkml/2011/4/5/327
CVE: CVE-2011-1495
Published: 2011-05-03
Description: drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://downloads.avaya.com/css/P8/documents/100145416; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html; http://lkml.org/lkml/2011/4/5/327
CVE: CVE-2011-1523
Published: 2011-05-03
Description: Cross-site scripting (XSS) vulnerability in statusmap.c in statusmap.cgi in Nagios 3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the layer parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2011/03/25/3; http://openwall.com/lists/oss-security/2011/03/28/4; http://secunia.com/advisories/43287
CVE: CVE-2011-1537
Published: 2011-05-03
Description: Cross-site scripting (XSS) vulnerability in HP Proliant Support Pack (PSP) before 8.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6039&w=2; http://secunia.com/advisories/44234; http://securityreason.com/securityalert/8236
CVE: CVE-2011-1538
Published: 2011-05-03
Description: Open redirect vulnerability in HP Proliant Support Pack (PSP) before 8.7 allows remote authenticated users to redirect other users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6039&w=2; http://secunia.com/advisories/44234; http://securityreason.com/securityalert/8236
CVE: CVE-2011-1539
Published: 2011-05-03
Description: Unspecified vulnerability in HP Proliant Support Pack (PSP) before 8.7 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6039&w=2; http://secunia.com/advisories/44234; http://securityreason.com/securityalert/8236
CVE: CVE-2011-1544
Published: 2011-05-03
Description: Unspecified vulnerability in HP Insight Control Performance Management before 6.3 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6264&w=2; http://secunia.com/advisories/44216; http://securityreason.com/securityalert/8237
CVE: CVE-2011-1545
Published: 2011-05-03
Description: Cross-site request forgery (CSRF) vulnerability in HP Insight Control Performance Management before 6.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6264&w=2; http://secunia.com/advisories/44216; http://securityreason.com/securityalert/8237
CVE: CVE-2011-1577
Published: 2011-05-03
Description: Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38 and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: http://downloads.avaya.com/css/P8/documents/100145416; http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061236.html; http://openwall.com/lists/oss-security/2011/04/12/17
CVE: CVE-2011-1724
Published: 2011-05-03
Description: Unspecified vulnerability in HP Virtual Server Environment before 6.3 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6866&w=2; http://secunia.com/advisories/44227; http://securityreason.com/securityalert/8239
CVE: CVE-2011-1844
Published: 2011-05-03
Description: Memory leak in Microsoft Silverlight 4 before 4.0.60310.0 allows remote attackers to cause a denial of service (memory consumption) via an application involving a popup control and a custom DependencyProperty property, related to lack of garbage collection.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://isc.sans.edu/diary.html?storyid=10747; http://support.microsoft.com/kb/2526954; http://isc.sans.edu/diary.html?storyid=10747
CVE: CVE-2011-1845
Published: 2011-05-03
Description: Multiple memory leaks in the DataGrid control implementation in Microsoft Silverlight 4 before 4.0.60310.0 allow remote attackers to cause a denial of service (memory consumption) via an application involving (1) subscriptions to an INotifyDataErrorInfo.ErrorsChanged event or (2) a TextBlock or TextBox element.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://isc.sans.edu/diary.html?storyid=10747; http://support.microsoft.com/kb/2526954; http://isc.sans.edu/diary.html?storyid=10747
CVE: CVE-2009-5022
Published: 2011-05-03
Description: Heap-based buffer overflow in tif_ojpeg.c in the OJPEG decoder in LibTIFF before 3.9.5 allows remote attackers to execute arbitrary code via a crafted TIFF file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugzilla.maptools.org/show_bug.cgi?id=1999; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058478.html; http://openwall.com/lists/oss-security/2011/04/12/10
CVE: CVE-2010-4665
Published: 2011-05-03
Description: Integer overflow in the ReadDirectory function in tiffdump.c in tiffdump in LibTIFF before 3.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF file containing a directory data structure with many directory entries.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://bugzilla.maptools.org/show_bug.cgi?id=2218; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058478.html; http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
CVE: CVE-2011-1522
Published: 2011-05-03
Description: Multiple SQL injection vulnerabilities in the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery function in Doctrine 1.x before 1.2.4 and 2.x before 2.0.3 allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622674; http://openwall.com/lists/oss-security/2011/03/25/2; http://openwall.com/lists/oss-security/2011/03/28/3
CVE: CVE-2011-1593
Published: 2011-05-03
Description: Multiple integer overflows in the next_pidmap function in kernel/pid.c in the Linux kernel before 2.6.38.4 allow local users to cause a denial of service (system crash) via a crafted (1) getdents or (2) readdir system call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-190
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c78193e9c7bcbf25b8237ad0dec82f805c4ea69b; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d8bdc59f215e62098bc5b4256fd9928bf27053a1; http://groups.google.com/group/fa.linux.kernel/msg/4a28ecb7f755a88d?dmode=source
CVE: CVE-2011-1684
Published: 2011-05-03
Description: Heap-based buffer overflow in the MP4_ReadBox_skcr function in libmp4.c in the MP4 demultiplexer in VideoLAN VLC media player 1.x before 1.1.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted MP4 file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=5637ca8141bf39f263ecdb62035d2cb45c740821; http://openwall.com/lists/oss-security/2011/04/11/17; http://openwall.com/lists/oss-security/2011/04/13/14