deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2728
Published: 2012-06-27
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Node Hierarchy module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to hijack the authentication of administrators for requests that change a node hierarchy position via an (1) up or (2) down action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1632432; http://drupal.org/node/1632900; http://drupalcode.org/project/nodehierarchy.git/commitdiff/8b4b3f5
CVE: CVE-2012-2729
Published: 2012-06-27
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the SimpleMeta module 6.x-1.x before 6.x-2.0 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) delete or (2) add a meta tag entry.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1534874; http://drupal.org/node/1632908; http://www.openwall.com/lists/oss-security/2012/06/14/3
CVE: CVE-2012-2730
Published: 2012-06-27
Description: The Protected Node module 6.x-1.x before 6.x-1.6 for Drupal does not properly "protect node access when nodes are accessed outside of the standard node view," which allows remote attackers to bypass intended access restrictions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://drupal.org/node/1258034; http://drupal.org/node/1632918; http://secunia.com/advisories/49509
CVE: CVE-2012-2731
Published: 2012-06-27
Description: The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://drupal.org/node/1619586; http://drupal.org/node/1633048; http://drupalcode.org/project/uc_ajax_cart.git/commitdiff/b59cdd5
CVE: CVE-2012-3798
Published: 2012-06-27
Description: The Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when creating a local user account, allows attackers to obtain part of the initial input used to generate passwords, which makes it easier to conduct brute force password guessing attacks.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://drupal.org/node/1632702; http://drupal.org/node/1632704; http://drupal.org/node/1632734
CVE: CVE-2012-3799
Published: 2012-06-27
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) change workflows or (2) insert cross-site scripting (XSS) sequences.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1617952; http://drupal.org/node/1619830; http://drupalcode.org/project/maestro.git/commitdiff/c499971
CVE: CVE-2012-3800
Published: 2012-06-27
Description: Cross-site scripting (XSS) vulnerability in og.js in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal, when used with the Vertical Tabs module, allows remote authenticated users to inject arbitrary web script or HTML via vectors related the group title.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1619736; http://drupal.org/node/1619810; http://drupalcode.org/project/og.git/commitdiff/d48fef5
CVE: CVE-2012-3801
Published: 2012-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-2704.  Reason: This candidate is a duplicate of CVE-2012-2704.  Notes: All CVE users should reference CVE-2012-2704 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-4940
Published: 2012-06-27
Description: The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://bugs.python.org/issue11442; http://jvn.jp/en/jp/JVN51176027/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000063
CVE: CVE-2012-2200
Published: 2012-06-27
Description: The default configuration of sendmail in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, allows local users to gain privileges by entering a command in a .forward file in a home directory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/sendmail1_advisory.asc; http://www.ibm.com/support/docview.wss?uid=isg1IV22963; http://www.ibm.com/support/docview.wss?uid=isg1IV22964
CVE: CVE-2012-2764
Published: 2012-06-27
Description: Untrusted search path vulnerability in Google Chrome before 20.0.1132.43 on Windows might allow local users to gain privileges via a Trojan horse Metro DLL in the current working directory.
CVSS Score: 7.2 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=130276; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15375
CVE: CVE-2012-2807
Published: 2012-06-27
Description: Multiple integer overflows in libxml2, as used in Google Chrome before 20.0.1132.43 and other products, on 64-bit Linux platforms allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://code.google.com/p/chromium/issues/detail?id=129930; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html
CVE: CVE-2012-2815
Published: 2012-06-27
Description: Google Chrome before 20.0.1132.43 allows remote attackers to obtain potentially sensitive information from a fragment identifier by leveraging access to an IFRAME element associated with a different domain.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=118633; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2012-2816
Published: 2012-06-27
Description: Google Chrome before 20.0.1132.43 on Windows does not properly isolate sandboxed processes, which might allow remote attackers to cause a denial of service (process interference) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=119150; http://code.google.com/p/chromium/issues/detail?id=119250; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html
CVE: CVE-2012-2817
Published: 2012-06-27
Description: Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to tables that have sections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=120222; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; http://lists.apple.com/archives/security-announce/2012/Sep/msg00001.html
CVE: CVE-2012-2818
Published: 2012-06-27
Description: Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the layout of documents that use the Cascading Style Sheets (CSS) counters feature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=120944; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; http://lists.apple.com/archives/security-announce/2012/Sep/msg00001.html
CVE: CVE-2012-2819
Published: 2012-06-27
Description: The texSubImage2D implementation in the WebGL subsystem in Google Chrome before 20.0.1132.43 does not properly handle uploads to floating-point textures, which allows remote attackers to cause a denial of service (assertion failure and application crash) or possibly have unspecified other impact via a crafted web page, as demonstrated by certain WebGL performance tests, aka rdar problem 11520387.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=120977; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; http://trac.webkit.org/changeset/117191
CVE: CVE-2012-2820
Published: 2012-06-27
Description: Google Chrome before 20.0.1132.43 does not properly implement SVG filters, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=121926; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; https://hermes.opensuse.org/messages/15075728
CVE: CVE-2012-2821
Published: 2012-06-27
Description: The autofill implementation in Google Chrome before 20.0.1132.43 does not properly display text, which has unspecified impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=122925; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; https://hermes.opensuse.org/messages/15075728
CVE: CVE-2012-2822
Published: 2012-06-27
Description: The PDF functionality in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15166; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html
CVE: CVE-2012-2823
Published: 2012-06-27
Description: Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=124356; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; https://hermes.opensuse.org/messages/15075728
CVE: CVE-2012-2824
Published: 2012-06-27
Description: Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG painting.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=125374; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html
CVE: CVE-2012-2825
Published: 2012-06-27
Description: The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=127417; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html
CVE: CVE-2012-2826
Published: 2012-06-27
Description: Google Chrome before 20.0.1132.43 does not properly implement texture conversion, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=128688; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; https://hermes.opensuse.org/messages/15075728
CVE: CVE-2012-2827
Published: 2012-06-27
Description: Use-after-free vulnerability in the UI in Google Chrome before 20.0.1132.43 on Mac OS X allows attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=129826; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; http://code.google.com/p/chromium/issues/detail?id=129826
CVE: CVE-2012-2828
Published: 2012-06-27
Description: Multiple integer overflows in the PDF functionality in Google Chrome before 20.0.1132.43 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://code.google.com/p/chromium/issues/detail?id=129857; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15287
CVE: CVE-2012-2829
Published: 2012-06-27
Description: Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the :first-letter pseudo-element.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=129947; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; http://lists.apple.com/archives/security-announce/2012/Sep/msg00001.html
CVE: CVE-2012-2830
Published: 2012-06-27
Description: Google Chrome before 20.0.1132.43 does not properly set array values, which allows remote attackers to cause a denial of service (incorrect pointer use) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=129951; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; https://hermes.opensuse.org/messages/15075728
CVE: CVE-2012-2831
Published: 2012-06-27
Description: Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG references.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=130356; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; http://lists.apple.com/archives/security-announce/2012/Sep/msg00001.html
CVE: CVE-2012-2832
Published: 2012-06-27
Description: The image-codec implementation in the PDF functionality in Google Chrome before 20.0.1132.43 does not initialize an unspecified pointer, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.
CVSS Score: 6.8 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=131553; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15455
CVE: CVE-2012-2833
Published: 2012-06-27
Description: Buffer overflow in the JS API in the PDF functionality in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=132156; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15584
CVE: CVE-2012-2834
Published: 2012-06-27
Description: Integer overflow in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted data in the Matroska container format.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://code.google.com/p/chromium/issues/detail?id=132779; http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html; https://hermes.opensuse.org/messages/15075728
CVE: CVE-2012-1989
Published: 2012-06-27
Description: telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2012-05/msg00012.html; http://projects.puppetlabs.com/issues/13606; http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.7.13
CVE: CVE-2012-3802
Published: 2012-06-27
Description: Unspecified vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote authenticated users to read the commissions of other users via unknown attack vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://drupal.org/node/1585648; http://www.openwall.com/lists/oss-security/2012/06/14/3; http://www.securityfocus.com/bid/53589
CVE: CVE-2011-4956
Published: 2012-06-27
Description: Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/44038; http://secunia.com/advisories/49138; http://wordpress.org/news/2011/04/wordpress-3-1-1/
CVE: CVE-2011-4957
Published: 2012-06-27
Description: The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service (crash) via a comment with a crafted URL that triggers many recursive calls.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://core.trac.wordpress.org/ticket/16892; http://secunia.com/advisories/44038; http://secunia.com/advisories/49138
CVE: CVE-2012-2388
Published: 2012-06-27
Description: The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00002.html; http://osvdb.org/82587; http://secunia.com/advisories/49315
CVE: CVE-2012-2451
Published: 2012-06-27
Description: The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.  NOTE: some of these details are obtained from third party information.  NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries.
CVSS Score: 3.6 (LOW)
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html
CVE: CVE-2012-2717
Published: 2012-06-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Mobile Tools module 6.x-2.x before 6.x-2.3 for Drupal allow remote attackers to inject arbitrary web script or HTML via the (1) Mobile URL field or (2) Desktop URL field to the General configuration page, or the (3) message to the Mobile Tools block message options.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1169008; http://drupal.org/node/1608828; http://drupalcode.org/project/mobile_tools.git/commitdiff/614b0fc
CVE: CVE-2012-3814
Published: 2012-06-27
Description: Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a .php.ttf extension, then accessing it via a direct request to the file in font-uploader/fonts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/82657; http://secunia.com/advisories/49327; http://www.exploit-db.com/exploits/18994
CVE: CVE-2012-3815
Published: 2012-06-27
Description: Buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 46824.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-06/0009.html; http://secunia.com/advisories/49395; http://securitytracker.com/id?1027128
CVE: CVE-2012-3816
Published: 2012-06-27
Description: WinRadius Server 2009 allows remote attackers to cause a denial of service (crash) via a long password in an Access-Request packet.
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2012-05/0135.html; http://secunia.com/advisories/49299; http://www.exploit-db.com/exploits/18945
CVE: CVE-2012-2742
Published: 2012-06-27
Description: Revelation 0.4.13-2 and earlier uses only the first 32 characters of a password followed by a sequence of zeros, which reduces the entropy and makes it easier for context-dependent attackers to crack passwords and obtain access to keys via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://knoxin.blogspot.co.uk/2012/06/revelation-password-manager-considered.html; http://oss.codepoet.no/revelation/issue/61/file-format-magic-string-version-mismatch; http://www.openwall.com/lists/oss-security/2012/06/18/1
CVE: CVE-2012-2743
Published: 2012-06-27
Description: Revelation 0.4.13-2 and earlier does not iterate through SHA hashing algorithms for AES encryption, which makes it easier for context-dependent attackers to guess passwords via a brute force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://knoxin.blogspot.co.uk/2012/06/revelation-password-manager-considered.html; http://oss.codepoet.no/revelation/issue/61/file-format-magic-string-version-mismatch; http://www.openwall.com/lists/oss-security/2012/06/18/1
CVE: CVE-2012-3231
Published: 2012-06-27
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in web@all 2.0, as downloaded before May 30, 2012, allow remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information, as demonstrated by adding a file to execute arbitrary code via a do_addfile action to inc/browser/action.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/54109; https://www.htbridge.com/advisory/HTB23094; http://www.securityfocus.com/bid/54109
CVE: CVE-2012-3053
Published: 2012-06-29
Description: Buffer overflow in the Cisco WebEx Advanced Recording Format (ARF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP11, T27 LD before SP32 CP2, and T28 L10N before SP1 allows remote attackers to execute arbitrary code via a crafted ARF file, aka Bug ID CSCtz72985.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120627-webex; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120627-webex
CVE: CVE-2012-3054
Published: 2012-06-29
Description: Heap-based buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP11, T27 LD before SP32 CP2, and T28 L10N before SP1 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72977.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120627-webex; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120627-webex