deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2530
Published: 2012-11-14
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application, aka "Win32k Use After Free Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/51239; http://www.securitytracker.com/id?1027750; http://www.us-cert.gov/cas/techalerts/TA12-318A.html
CVE: CVE-2012-2531
Published: 2012-11-14
Description: Microsoft Internet Information Services (IIS) 7.5 uses weak permissions for the Operational log, which allows local users to discover credentials by reading this file, aka "Password Disclosure Vulnerability."
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/56439; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-073; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15959
CVE: CVE-2012-2532
Published: 2012-11-14
Description: Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) processes unspecified commands before TLS is enabled for a session, which allows remote attackers to obtain sensitive information by reading the replies to these commands, aka "FTP Command Injection Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/56440; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-073; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15786
CVE: CVE-2012-2543
Published: 2012-11-14
Description: Stack-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 SP1; Office 2011 for Mac; Excel Viewer; and Office Compatibility Pack SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Stack Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/56431; http://www.securitytracker.com/id?1027752; http://www.us-cert.gov/cas/techalerts/TA12-318A.html
CVE: CVE-2012-2553
Published: 2012-11-14
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application, aka "Win32k Use After Free Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/51239; http://www.securityfocus.com/bid/56448; http://www.securitytracker.com/id?1027750
CVE: CVE-2012-4775
Published: 2012-11-14
Description: Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka "CTreeNode Use After Free Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/51202; http://www.securityfocus.com/bid/56422; http://www.securitytracker.com/id?1027749
CVE: CVE-2012-4776
Published: 2012-11-14
Description: The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not validate configuration data that is returned during acquisition of proxy settings, which allows remote attackers to execute arbitrary JavaScript code by providing crafted data during execution of (1) an XAML browser application (aka XBAP) or (2) a .NET Framework application, aka "Web Proxy Auto-Discovery Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://osvdb.org/87266; http://secunia.com/advisories/51236; http://www.securityfocus.com/bid/56463
CVE: CVE-2012-4777
Published: 2012-11-14
Description: The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka "WPF Reflection Optimization Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://osvdb.org/87267; http://secunia.com/advisories/51236; http://www.securityfocus.com/bid/56464
CVE: CVE-2012-2619
Published: 2012-11-14
Description: The Broadcom BCM4325 and BCM4329 Wi-Fi chips, as used in certain Acer, Apple, Asus, Ford, HTC, Kyocera, LG, Malata, Motorola, Nokia, Pantech, Samsung, and Sony products, allow remote attackers to cause a denial of service (out-of-bounds read and Wi-Fi outage) via an RSN 802.11i information element.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Jan/msg00001.html; http://support.apple.com/kb/HT5642
CVE: CVE-2012-3330
Published: 2012-11-14
Description: The proxy server in IBM WebSphere Application Server 7.0 before 7.0.0.27, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, and WebSphere Virtual Enterprise, allows remote attackers to cause a denial of service (daemon outage) via a crafted request.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM71319; http://www.ibm.com/support/docview.wss?uid=swg21614265; https://exchange.xforce.ibmcloud.com/vulnerabilities/78047
CVE: CVE-2012-3569
Published: 2012-11-14
Description: Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.5, and other products, allows user-assisted remote attackers to execute arbitrary code via a crafted OVF file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://osvdb.org/87117; http://packetstormsecurity.com/files/120101/VMWare-OVF-Tools-Format-String.html; http://secunia.com/advisories/51240
CVE: CVE-2012-4847
Published: 2012-11-14
Description: IBM Cognos Business Intelligence (BI) 8.4 and 8.4.1 allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted request containing a zero-valued byte.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-189
References: http://www.ibm.com/support/docview.wss?uid=swg21615445; https://exchange.xforce.ibmcloud.com/vulnerabilities/79536; http://www.ibm.com/support/docview.wss?uid=swg21615445
CVE: CVE-2012-4850
Published: 2012-11-14
Description: IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1, when JAX-RS is used, does not properly validate requests, which allows remote attackers to gain privileges via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM67082; http://www.ibm.com/support/docview.wss?uid=swg21614265; http://www.securityfocus.com/bid/56460
CVE: CVE-2012-4851
Published: 2012-11-14
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM68643; http://www.ibm.com/support/docview.wss?uid=swg21614265; http://www.securityfocus.com/bid/56423
CVE: CVE-2012-4853
Published: 2012-11-14
Description: Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger information disclosure.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM62920; http://www.ibm.com/support/docview.wss?uid=swg21614265; http://www.securityfocus.com/bid/56458
CVE: CVE-2012-4948
Published: 2012-11-14
Description: The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Fortinet_CA_SSLProxy certificate in a list of trusted root certification authorities.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: http://osvdb.org/87048; http://www.kb.cert.org/vuls/id/111708; http://www.securityfocus.com/bid/56382
CVE: CVE-2012-4949
Published: 2012-11-14
Description: SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/795644; https://exchange.xforce.ibmcloud.com/vulnerabilities/79977; http://www.kb.cert.org/vuls/id/795644
CVE: CVE-2012-4953
Published: 2012-11-14
Description: The decomposer engine in Symantec Endpoint Protection (SEP) 11.0, Symantec Endpoint Protection Small Business Edition 12.0, Symantec AntiVirus Corporate Edition (SAVCE) 10.x, and Symantec Scan Engine (SSE) before 5.2.8 does not properly perform bounds checks of the contents of CAB archives, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/985625; http://www.securityfocus.com/bid/56399; http://www.securitytracker.com/id?1027726
CVE: CVE-2012-5458
Published: 2012-11-14
Description: VMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Windows use weak permissions for unspecified process threads, which allows host OS users to gain host OS privileges via a crafted application.
CVSS Score: 8.3 (HIGH)
CWE: CWE-264
References: http://osvdb.org/87118; http://www.securityfocus.com/bid/56469; http://www.vmware.com/security/advisories/VMSA-2012-0015.html
CVE: CVE-2012-5459
Published: 2012-11-14
Description: Untrusted search path vulnerability in VMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Windows allows host OS users to gain host OS privileges via a Trojan horse DLL in a "system folder."
CVSS Score: 7.9 (HIGH)
References: http://osvdb.org/87119; http://www.securityfocus.com/bid/56470; http://www.vmware.com/security/advisories/VMSA-2012-0015.html
CVE: CVE-2012-5860
Published: 2012-11-14
Description: Unspecified vulnerability on Oberthur ID-One COSMO 5.2, 5.2a, and 64 smart cards makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging the generation of non-compliant public keys.
CVSS Score: 4.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/659615; https://exchange.xforce.ibmcloud.com/vulnerabilities/80039; http://www.kb.cert.org/vuls/id/659615
CVE: CVE-2012-4951
Published: 2012-11-15
Description: Multiple SQL injection vulnerabilities in terminal/paramedit.aspx in VeriFone VeriCentre Web Console before 2.2 build 36 allow remote attackers to execute arbitrary SQL commands via the (1) TerminalId, (2) ModelName, or (3) ApplicationName parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.clearskies.net/documents/css-advisory-css1211-vericentre.pdf; http://www.kb.cert.org/vuls/id/180091; http://www.securityfocus.com/bid/56409
CVE: CVE-2012-4954
Published: 2012-11-15
Description: The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/611988; http://www.securityfocus.com/bid/56483; https://exchange.xforce.ibmcloud.com/vulnerabilities/80000
CVE: CVE-2012-4955
Published: 2012-11-15
Description: Cross-site scripting (XSS) vulnerability in Dell OpenManage Server Administrator (OMSA) before 6.5.0.1, 7.0 before 7.0.0.1, and 7.1 before 7.1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/87405; http://secunia.com/advisories/51297; http://www.dell.com/support/drivers/us/en/19/DriverDetails/Product/poweredge-r710?driverId=5JDN0&osCode=WNET&fileId=[PII_REDACTED]
CVE: CVE-2012-5851
Published: 2012-11-15
Description: html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not consider all possible output contexts of reflected data, which makes it easier for remote attackers to bypass a cross-site scripting (XSS) protection mechanism via a crafted string, aka rdar problem 12019108.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.opensecurityresearch.com/2012/09/simple-cross-site-scripting-vector-that.html; https://bugs.webkit.org/show_bug.cgi?id=92692; https://exchange.xforce.ibmcloud.com/vulnerabilities/80072
CVE: CVE-2012-4612
Published: 2012-11-16
Description: Cross-site scripting (XSS) vulnerability in EMC RSA Data Protection Manager Appliance and Software Server 2.7.x and 3.x before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0050.html; http://www.securityfocus.com/bid/56506; http://archives.neohapsis.com/archives/bugtraq/2012-11/0050.html
CVE: CVE-2012-4613
Published: 2012-11-16
Description: EMC RSA Data Protection Manager Appliance 2.7.x and 3.x before 3.2.1 does not properly restrict the number of authentication attempts by a user account, which makes it easier for local users to bypass intended access restrictions via a brute-force attack.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0050.html; http://www.securityfocus.com/bid/56508; http://archives.neohapsis.com/archives/bugtraq/2012-11/0050.html
CVE: CVE-2012-5522
Published: 2012-11-16
Description: MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html
CVE: CVE-2012-5523
Published: 2012-11-16
Description: core/email_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html
CVE: CVE-2012-5777
Published: 2012-11-16
Description: Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS 6.6 allows user-assisted remote attackers to execute arbitrary PHP code via a crafted template.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0027.html; http://packetstormsecurity.com/files/117902/EmpireCMS-6.6-PHP-Code-Execution.html; http://packetstormsecurity.org/files/117902/EmpireCMS-6.6-PHP-Code-Execution.html
CVE: CVE-2012-4189
Published: 2012-11-16
Description: Cross-site scripting (XSS) vulnerability in Bugzilla 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or HTML via a field value that is not properly handled during construction of a tabular report, as demonstrated by the Version field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.bugzilla.org/security/3.6.11/; http://www.mandriva.com/security/advisories?name=MDVSA-2013:066; https://bugzilla.mozilla.org/show_bug.cgi?id=790296
CVE: CVE-2012-4197
Published: 2012-11-16
Description: Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 allows remote attackers to read attachment descriptions from private bugs via an obsolete=1 insert action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.bugzilla.org/security/3.6.11/; http://www.mandriva.com/security/advisories?name=MDVSA-2013:066; https://bugzilla.mozilla.org/show_bug.cgi?id=802204
CVE: CVE-2012-4198
Published: 2012-11-16
Description: The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 has a different outcome for a groups request depending on whether a group exists, which allows remote authenticated users to discover private group names by observing whether a call throws an error.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.bugzilla.org/security/3.6.11/; http://www.mandriva.com/security/advisories?name=MDVSA-2013:066; https://bugzilla.mozilla.org/show_bug.cgi?id=781850
CVE: CVE-2012-4199
Published: 2012-11-16
Description: template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 generates JavaScript function calls containing private product names or private component names in certain circumstances involving custom-field visibility control, which allows remote attackers to obtain sensitive information by reading HTML source code.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.bugzilla.org/security/3.6.11/; http://www.mandriva.com/security/advisories?name=MDVSA-2013:066; https://bugzilla.mozilla.org/show_bug.cgi?id=731178
CVE: CVE-2012-5475
Published: 2012-11-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-5881, CVE-2012-5882, CVE-2012-5883. Reason: This candidate is a duplicate of CVE-2012-5881, CVE-2012-5882, and CVE-2012-5883. Notes: All CVE users should reference one or more of CVE-2012-5881, CVE-2012-5882, and CVE-2012-5883 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2012-5881
Published: 2012-11-16
Description: Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to charts.swf, a similar issue to CVE-2010-4207.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/56385; http://www.yuiblog.com/blog/2012/10/30/security-announcement-swf-vulnerability-in-yui-2/; http://www.yuiblog.com/blog/2012/11/05/post-mortem-swf-vulnerability-in-yui-2/
CVE: CVE-2012-5882
Published: 2012-11-16
Description: Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader.swf, a similar issue to CVE-2010-4208.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/56385; http://www.yuiblog.com/blog/2012/10/30/security-announcement-swf-vulnerability-in-yui-2/; http://www.yuiblog.com/blog/2012/11/05/post-mortem-swf-vulnerability-in-yui-2/
CVE: CVE-2012-5883
Published: 2012-11-16
Description: Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or HTML via vectors related to swfstore.swf, a similar issue to CVE-2010-4209.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.bugzilla.org/security/3.6.11/; http://www.mandriva.com/security/advisories?name=MDVSA-2013:066; http://www.securityfocus.com/bid/56385
CVE: CVE-2012-5884
Published: 2012-11-16
Description: The User.get method in Bugzilla/WebService/User.pm in Bugzilla 4.3.2 allows remote attackers to obtain sensitive information about the saved searches of arbitrary users via an XMLRPC request or a JSONRPC request, a different vulnerability than CVE-2012-4198.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=697224; https://bugzilla.mozilla.org/show_bug.cgi?id=781850; https://exchange.xforce.ibmcloud.com/vulnerabilities/80115
CVE: CVE-2012-2733
Published: 2012-11-16
Description: java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html; http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
CVE: CVE-2012-5172
Published: 2012-11-16
Description: The Asial Monaca Debugger application before 1.4.2 for Android allows remote attackers to obtain sensitive (1) account or (2) session ID information in a system log file via a crafted application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN56923652/995382/index.html; http://jvn.jp/en/jp/JVN56923652/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000103
CVE: CVE-2012-3439
Published: 2012-11-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-5885, CVE-2012-5886, CVE-2012-5887. Reason: This candidate is a duplicate of CVE-2012-5885, CVE-2012-5886, and CVE-2012-5887. Notes: All CVE users should reference one or more of CVE-2012-5885, CVE-2012-5886, and CVE-2012-5887 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2012-5856
Published: 2012-11-17
Description: Cross-site scripting (XSS) vulnerability in the Uk Cookie (aka uk-cookie) plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/118053/WordPress-UK-Cookie-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/56509; https://exchange.xforce.ibmcloud.com/vulnerabilities/80047
CVE: CVE-2012-5885
Published: 2012-11-17
Description: The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html; http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
CVE: CVE-2012-5886
Published: 2012-11-17
Description: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html; http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html