deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-4661
Published: 2012-10-29
Description: Stack-based buffer overflow in the DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.34), 8.4 before 8.4(4.4), 8.5 before 8.5(1.13), and 8.6 before 8.6(1.3) and the Firewall Services Module (FWSM) 4.1 before 4.1(9) in Cisco Catalyst 6500 series switches and 7600 series routers might allow remote attackers to execute arbitrary code via a crafted DCERPC packet, aka Bug IDs CSCtr21359 and CSCtr27522.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/86146; http://secunia.com/advisories/50857; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-asa
CVE: CVE-2012-4662
Published: 2012-10-29
Description: The DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.25), 8.4 before 8.4(2.5), and 8.5 before 8.5(1.13) and the Firewall Services Module (FWSM) 4.1 before 4.1(7) in Cisco Catalyst 6500 series switches and 7600 series routers allows remote attackers to cause a denial of service (device reload) via a crafted DCERPC packet, aka Bug IDs CSCtr21376 and CSCtr27524.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://osvdb.org/86147; http://secunia.com/advisories/50857; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-asa
CVE: CVE-2012-4663
Published: 2012-10-29
Description: The DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.25), 8.4 before 8.4(2.5), and 8.5 before 8.5(1.13) and the Firewall Services Module (FWSM) 4.1 before 4.1(7) in Cisco Catalyst 6500 series switches and 7600 series routers allows remote attackers to cause a denial of service (device reload) via a crafted DCERPC packet, aka Bug IDs CSCtr21346 and CSCtr27521.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://osvdb.org/86148; http://secunia.com/advisories/50857; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-asa
CVE: CVE-2012-0023
Published: 2012-10-30
Description: Double free vulnerability in the get_chunk_header function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TiVo (TY) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=7d282fac1cc455b5a5eca2bb56375efcbf879b06; http://secunia.com/advisories/47325; http://securitytracker.com/id?1026449
CVE: CVE-2012-5979
Published: 2012-10-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-5079.  Reason: This candidate is a duplicate of CVE-2012-5079.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2012-5079 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-4547
Published: 2012-10-31
Description: Unspecified vulnerability in awredir.pl in AWStats before 7.1 has unknown impact and attack vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://awstats.sourceforge.net/docs/awstats_changelog.txt; http://openwall.com/lists/oss-security/2012/10/26/1; http://openwall.com/lists/oss-security/2012/10/29/7
CVE: CVE-2012-4610
Published: 2012-10-31
Description: EMC Avamar Client for VMware 6.1 stores the cleartext server root password on the proxy client, which might allow remote attackers to obtain sensitive information by leveraging "network access" to the proxy client.
CVSS Score: 3.3 (LOW)
CWE: CWE-255
References: http://www.securityfocus.com/archive/1/524532; http://www.securityfocus.com/bid/56317; https://exchange.xforce.ibmcloud.com/vulnerabilities/79661
CVE: CVE-2012-4934
Published: 2012-10-31
Description: TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://osvdb.org/86883; http://www.kb.cert.org/vuls/id/207540; http://www.securityfocus.com/bid/56333
CVE: CVE-2012-5692
Published: 2012-10-31
Description: Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://community.invisionpower.com/topic/371625-ipboard-31x-32x-and-33x-security-update/; http://secunia.com/advisories/51104; http://www.securityfocus.com/bid/56288
CVE: CVE-2012-2625
Published: 2012-10-31
Description: The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service (memory consumption) via a large (1) bzip2 or (2) lzma compressed kernel image.
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=1817; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00025.html
CVE: CVE-2012-4482
Published: 2012-10-31
Description: The Ubercart SecureTrading Payment Method module 6.x for Drupal does not properly verify payment notification information, which allows remote attackers to purchase an item without paying via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://drupal.org/node/1679820; http://www.openwall.com/lists/oss-security/2012/10/04/6; http://www.openwall.com/lists/oss-security/2012/10/07/1
CVE: CVE-2012-4483
Published: 2012-10-31
Description: The commons_discussion_views_default_views function in modules/features/commons_discussion/commons_discussion.views_default.inc in the Drupal Commons module 6.x-2.x before 6.x-2.8 for Drupal does not properly enforce intended node access restrictions, which might allow remote attackers to obtain sensitive information via the recent comments listing.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1679820; http://drupal.org/node/1679908; http://drupalcode.org/project/commons.git/commitdiff/8ef688b
CVE: CVE-2012-4484
Published: 2012-10-31
Description: Cross-site scripting (XSS) vulnerability in the administrative interface in the Campaign Monitor module before 6.x-2.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this refers to an issue in an independently developed Drupal module, and NOT an issue in the Campaign Monitor software itself (described on the campaignmonitor.com web site).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1689790; http://drupal.org/node/1691446; http://www.openwall.com/lists/oss-security/2012/10/04/6
CVE: CVE-2012-4485
Published: 2012-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the galleryformatter_field_formatter_view functiuon in galleryformatter.tpl.php the Gallery formatter module before 7.x-1.2 for Drupal allow remote authenticated users with permissions to create a node or entity to inject arbitrary web script or HTML via the (1) title or (2) alt parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1699744; http://drupal.org/node/1700578; http://drupalcode.org/project/galleryformatter.git/commitdiff/b0392a1
CVE: CVE-2012-4488
Published: 2012-10-31
Description: The Location module 6.x before 6.x-3.2 and 7.x before 7.x-3.0-alpha1 for Drupal does not properly check user or node access permissions, which allows remote attackers to read node or user results via the location search page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1699962; http://drupal.org/node/1699984; http://drupal.org/node/1700588
CVE: CVE-2012-4489
Published: 2012-10-31
Description: Open redirect vulnerability in the securelogin_secure_redirect function in the Secure Login module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://drupal.org/node/1700594; http://drupalcode.org/project/securelogin.git/commitdiff/88518df; http://www.openwall.com/lists/oss-security/2012/10/04/6
CVE: CVE-2012-4490
Published: 2012-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Excluded Users module 6.x-1.x before 6.x-1.1 for Drupal allow remote attackers to inject arbitrary web script or HTML via a (1) user name or (2) email address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1702984; http://drupal.org/node/1708058; http://www.openwall.com/lists/oss-security/2012/10/04/6
CVE: CVE-2012-4491
Published: 2012-10-31
Description: The Monthly Archive by Node Type module 6.x for Drupal does not properly check permissions defined by node_access modules, which allows remote attackers to access restricted nodes via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1708198; http://www.openwall.com/lists/oss-security/2012/10/04/6; http://www.openwall.com/lists/oss-security/2012/10/07/1
CVE: CVE-2012-4492
Published: 2012-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Shorten URLs module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors to the (1) report or (2) Custom Services List page.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1719392; http://www.openwall.com/lists/oss-security/2012/10/04/6; http://www.openwall.com/lists/oss-security/2012/10/07/1
CVE: CVE-2012-4494
Published: 2012-10-31
Description: The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users, which allows remote blocked users to access bypass intended access restrictions and possibly have other impacts by logging in.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1493244; http://drupal.org/node/1719392; http://drupalcode.org/project/shib_auth.git/commitdiff/2032f0a
CVE: CVE-2012-4495
Published: 2012-10-31
Description: The Mime Mail module 6.x-1.x before 6.x-1.1 for Drupal does not properly restrict access to files outside Drupal's publish files directory, which allows remote authenticated users to send arbitrary files as attachments.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1719446; http://drupal.org/node/1719482; http://drupalcode.org/project/mimemail.git/commitdiff/ae065d1
CVE: CVE-2012-4496
Published: 2012-10-31
Description: Cross-site scripting (XSS) vulnerability in the Custom Publishing Options module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users with the "administer nodes" permission to inject arbitrary web script or HTML via the status labels parameter.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1730766; http://secunia.com/advisories/50256; http://www.madirish.net/538
CVE: CVE-2012-4499
Published: 2012-10-31
Description: The contact formatter page in the Email Field module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to email the stored address in the entity via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1761948; http://drupal.org/node/1761968; http://drupal.org/node/1762470
CVE: CVE-2012-4500
Published: 2012-10-31
Description: The Announcements module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the "access announcements" permission to bypass node access restrictions and possibly have other unspecified impact.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://drupal.org/node/1761038; http://drupal.org/node/1762480; http://www.openwall.com/lists/oss-security/2012/10/04/6
CVE: CVE-2012-4531
Published: 2012-10-31
Description: Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/news/[PII_REDACTED]1-core-xss-vulnerability; http://secunia.com/advisories/49678; http://www.joomla.org/announcements/release-news/5463-joomla-2-5-7-released.html
CVE: CVE-2012-4532
Published: 2012-10-31
Description: Cross-site scripting (XSS) vulnerability in modules/mod_languages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/news/[PII_REDACTED]2-core-xss-vulnerability; http://secunia.com/advisories/49678; http://www.darksecurity.de/advisories/2012/SSCHADV2012-014.txt
CVE: CVE-2012-4544
Published: 2012-10-31
Description: The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091832.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091844.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092050.html
CVE: CVE-2012-5671
Published: 2012-10-31
Description: Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_verify," allows remote attackers to execute arbitrary code via an email from a malicious DNS server.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html
CVE: CVE-2012-4939
Published: 2012-10-31
Description: Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/203844; http://www.kb.cert.org/vuls/id/203844
CVE: CVE-2012-4940
Published: 2012-10-31
Description: Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. (dot dot) in (1) the fileName parameter in a download action to source/loggin/page_log_dwn_file.hsp, or the fileName parameter in (2) an edit action or (3) a delete action to the default URI.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/586556; http://www.securityfocus.com/bid/56343; http://www.kb.cert.org/vuls/id/586556
CVE: CVE-2012-3010
Published: 2012-11-01
Description: rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a different vulnerability than CVE-2012-3021 and CVE-2012-3026.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB15050; http://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/15000/KB15050/en_US/GEIP12-10%20Security%20Advisory%20-%20Proficy%20Portal%20rifsrvd.pdf; http://www.securityfocus.com/bid/55935
CVE: CVE-2012-3021
Published: 2012-11-01
Description: rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a different vulnerability than CVE-2012-3010 and CVE-2012-3026.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB15050; http://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/15000/KB15050/en_US/GEIP12-10%20Security%20Advisory%20-%20Proficy%20Portal%20rifsrvd.pdf; http://www.securityfocus.com/bid/55935
CVE: CVE-2012-3026
Published: 2012-11-01
Description: rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a different vulnerability than CVE-2012-3010 and CVE-2012-3021.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB15050; http://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/15000/KB15050/en_US/GEIP12-10%20Security%20Advisory%20-%20Proficy%20Portal%20rifsrvd.pdf; http://www.securityfocus.com/bid/55935
CVE: CVE-2012-5409
Published: 2012-11-01
Description: AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data to any memory location and consequently execute arbitrary code via crafted messages, as demonstrated by an arbitrary pointer dereference attack or a buffer overflow attack.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/advisories/ICSA-12-305-01; http://ioactive.com/pdfs/SIEMENS_Sipass_Integrated_Ethernet_Bus_Arbitrary_Pointer_Dereference_V4.pdf; http://secunia.com/advisories/50900
CVE: CVE-2012-5687
Published: 2012-11-01
Description: Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13.9 build 120201 Rel.54965n and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to the help/ URI.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-10/0154.html; http://archives.neohapsis.com/archives/bugtraq/2012-10/0154.html; http://packetstormsecurity.org/files/117749/TP-LINK-TL-WR841N-Local-File-Inclusion.html
CVE: CVE-2012-5704
Published: 2012-11-01
Description: The Hotblocks module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with the "administer hotblocks" permission to cause a denial of service (infinite loop and time out) via a block that references itself.
CVSS Score: 3.5 (LOW)
CWE: CWE-399
References: http://drupal.org/node/1732828; http://drupal.org/node/1732946; http://www.madirish.net/543
CVE: CVE-2012-5705
Published: 2012-11-01
Description: Cross-site scripting (XSS) vulnerability in the settings page (admin/settings/hotblocks) in the Hotblocks module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with the "administer hotblocks" permission to inject arbitrary web script or HTML via the "block names."
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1732828; http://drupal.org/node/1732946; http://www.madirish.net/543
CVE: CVE-2012-5416
Published: 2012-11-02
Description: Buffer overflow in Cisco Unified MeetingPlace Web Conferencing before 7.1MR1 Patch 1, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 allows remote attackers to cause a denial of service (daemon hang) via unspecified parameters in a POST request, aka Bug ID CSCua66341.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://osvdb.org/86859; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121031-mp; https://exchange.xforce.ibmcloud.com/vulnerabilities/79721
CVE: CVE-2012-5417
Published: 2012-11-02
Description: Cisco Prime Data Center Network Manager (DCNM) before 6.1(1) does not properly restrict access to certain JBoss MainDeployer functionality, which allows remote attackers to execute arbitrary commands via JBoss Application Server Remote Method Invocation (RMI) services, aka Bug ID CSCtz44924.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121031-dcnm; http://www.securityfocus.com/bid/56348; http://www.securitytracker.com/id?1027712
CVE: CVE-2012-4486
Published: 2012-11-02
Description: Cross-site request forgery (CSRF) vulnerability in the Subuser module before 6.x-1.8 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that switch the user to a subuser via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1700550; http://drupal.org/node/1700584; http://www.openwall.com/lists/oss-security/2012/10/04/6
CVE: CVE-2012-4487
Published: 2012-11-02
Description: The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1700550; http://drupal.org/node/1700584; http://www.openwall.com/lists/oss-security/2012/10/04/6
CVE: CVE-2012-4493
Published: 2012-11-02
Description: Cross-site scripting (XSS) vulnerability in the administrative interface in the Better Revisions module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer better revisions" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1713378; http://drupal.org/node/1719402; http://www.openwall.com/lists/oss-security/2012/10/04/6
CVE: CVE-2012-4497
Published: 2012-11-02
Description: Cross-site scripting (XSS) vulnerability in the "3 slide gallery" in the Elegant Theme module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via a slide URL.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1722880; http://drupal.org/node/1733056; http://drupalcode.org/project/elegant_theme.git/commitdiff/bdea7b1
CVE: CVE-2012-4498
Published: 2012-11-02
Description: The Activism module 6.x-2.x before 6.x-2.1 for Drupal does not properly restrict access to the "Campaign" content type, which might allow remote attackers to bypass access restrictions and possibly have other unspecified impact.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://drupal.org/node/1762152; http://drupal.org/node/1762160; http://www.openwall.com/lists/oss-security/2012/10/04/6
CVE: CVE-2012-0025
Published: 2012-11-02
Description: Double free vulnerability in the Free_All_Memory function in jpeg/dectile.c in libfpx before 1.3.1-1, as used in the FlashPix PlugIn 4.2.2.0 for IrfanView, allows remote attackers to cause a denial of service (crash) via a crafted FPX image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/47246; http://secunia.com/advisories/47322; http://www.exploit-db.com/exploits/18256
CVE: CVE-2012-3748
Published: 2012-11-03
Description: Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript arrays.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-362
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0012.html; http://archives.neohapsis.com/archives/bugtraq/2012-11/0013.html; http://lists.apple.com/archives/security-announce/2012/Nov/msg00000.html