deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-6112
Published: 2013-01-27
Description: classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37283; http://openwall.com/lists/oss-security/2013/01/21/1; http://www.tinymce.com/develop/changelog/?type=phpspell
CVE: CVE-2012-4696
Published: 2013-01-28
Description: Buffer overflow in Beijer ADP 6.5.0-180_R1967 and 6.5.1-186_R2942, and H-Designer 6.5.0 B180_R1967, allows local users to gain privileges by inserting a long string into a DLL file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/57546; http://www.us-cert.gov/control_systems/pdf/ICSA-13-024-01.pdf; http://www.securityfocus.com/bid/57546
CVE: CVE-2013-4696
Published: 2013-01-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-4696.  Reason: This candidate is a duplicate of CVE-2012-4696.  A CNA inadvertently entered an unassigned ID.  Notes: All CVE users should reference CVE-2012-4696 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-0948
Published: 2013-01-29
Description: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://support.apple.com/kb/HT5642
CVE: CVE-2013-0949
Published: 2013-01-29
Description: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://support.apple.com/kb/HT5642
CVE: CVE-2013-0950
Published: 2013-01-29
Description: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://support.apple.com/kb/HT5642
CVE: CVE-2013-0951
Published: 2013-01-29
Description: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://support.apple.com/kb/HT5642
CVE: CVE-2013-0952
Published: 2013-01-29
Description: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://support.apple.com/kb/HT5642
CVE: CVE-2013-0953
Published: 2013-01-29
Description: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://support.apple.com/kb/HT5642
CVE: CVE-2013-0954
Published: 2013-01-29
Description: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://support.apple.com/kb/HT5642
CVE: CVE-2013-0955
Published: 2013-01-29
Description: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://support.apple.com/kb/HT5642
CVE: CVE-2013-0956
Published: 2013-01-29
Description: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://support.apple.com/kb/HT5642
CVE: CVE-2013-0958
Published: 2013-01-29
Description: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://support.apple.com/kb/HT5642
CVE: CVE-2013-0959
Published: 2013-01-29
Description: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://support.apple.com/kb/HT5642
CVE: CVE-2013-0962
Published: 2013-01-29
Description: Cross-site scripting (XSS) vulnerability in WebKit in Apple iOS before 6.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted content that is not properly handled during a copy-and-paste operation.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://support.apple.com/kb/HT5642
CVE: CVE-2013-0963
Published: 2013-01-29
Description: Identity Services in Apple iOS before 6.1 does not properly handle validation failures of AppleID certificates, which might allow physically proximate attackers to bypass authentication by leveraging an incorrect assignment of an empty string value to an AppleID.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html; http://support.apple.com/kb/HT5642
CVE: CVE-2013-0964
Published: 2013-01-29
Description: The kernel in Apple iOS before 6.1 and Apple TV before 5.2 does not properly validate copyin and copyout arguments, which allows local users to bypass intended pointer restrictions and access locations in the first kernel-memory page by specifying a length of less than one page.
CVSS Score: 3.6 (LOW)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Jan/msg00001.html; http://osvdb.org/89659
CVE: CVE-2013-0968
Published: 2013-01-29
Description: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://support.apple.com/kb/HT5642; http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html
CVE: CVE-2013-0974
Published: 2013-01-29
Description: StoreKit in Apple iOS before 6.1 does not properly handle the disabling of JavaScript within the preferences configuration of Mobile Safari, which allows remote attackers to bypass intended access restrictions and execute JavaScript code via a web site with a Smart App Banner.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html; http://osvdb.org/89658; http://support.apple.com/kb/HT5642
CVE: CVE-2013-1450
Published: 2013-01-29
Description: Microsoft Internet Explorer 8 and 9, when the Proxy Settings configuration has the same Proxy address and Port values in the HTTP and Secure rows, does not properly reuse TCP sessions to the proxy server, which allows remote attackers to obtain sensitive information intended for a specific host via a crafted HTML document that triggers many HTTPS requests and then triggers an HTTP request to that host, as demonstrated by reading a Cookie header, aka MSRC 12096gd.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-16
References: http://pastebin.com/raw.php?i=rz9BcBey; http://www.youtube.com/ChristianHaiderPoC; http://www.youtube.com/watch?v=TPqagWAvo8U
CVE: CVE-2013-1451
Published: 2013-01-29
Description: Microsoft Internet Explorer 8 and 9, when the Proxy Settings configuration has the same Proxy address and Port values in the HTTP and Secure rows, does not ensure that the SSL lock icon is consistent with the Address bar, which makes it easier for remote attackers to spoof web sites via a crafted HTML document that triggers many HTTPS requests to an arbitrary host, followed by an HTTPS request to a trusted host and then an HTTP request to an untrusted host, a related issue to CVE-2013-1450.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-16
References: http://pastebin.com/raw.php?i=rz9BcBey; http://www.youtube.com/ChristianHaiderPoC; http://www.youtube.com/watch?v=TPqagWAvo8U
CVE: CVE-2013-0333
Published: 2013-01-30
Description: lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html; http://rhn.redhat.com/errata/RHSA-2013-0201.html
CVE: CVE-2010-5287
Published: 2013-01-31
Description: SQL injection vulnerability in default.php in Cornerstone Technologies webConductor allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/13980; http://www.exploit-db.com/exploits/18319; http://www.securityfocus.com/bid/41042
CVE: CVE-2011-5255
Published: 2013-01-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/login in X3 CMS 0.4.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, (2) username, or (3) password parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0066.html; http://osvdb.org/78220; http://secunia.com/advisories/46748
CVE: CVE-2012-6522
Published: 2013-01-31
Description: Directory traversal vulnerability in the getContent function in codes/wcms.php in w-CMS 2.01 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/47527; http://www.exploit-db.com/exploits/18348; http://www.exploit-db.com/exploits/18711
CVE: CVE-2012-6523
Published: 2013-01-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in w-CMS 2.01 allow remote attackers to inject arbitrary web script or HTML via (1) the p parameter in the getMenus function in codes/wcms.php; or the COMMENT parameter in (2) blog.php, (3) guestbook.php, or (4) forum.php in codes/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/78267; http://osvdb.org/78268; http://secunia.com/advisories/47527
CVE: CVE-2012-6524
Published: 2013-01-31
Description: SQL injection vulnerability in kommentar.php in pGB 2.12 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/47530; http://www.exploit-db.com/exploits/18383; http://www.osvdb.org/78342
CVE: CVE-2012-6525
Published: 2013-01-31
Description: SQL injection vulnerability in members.php in PHPBridges allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18384; http://www.osvdb.org/82526; http://www.securityfocus.com/bid/51552
CVE: CVE-2012-6526
Published: 2013-01-31
Description: SQL injection vulnerability in show_code.php in Vastal I-Tech Freelance Zone allows remote attackers to execute arbitrary SQL commands via the code_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/108756/vastalfreelance-sql.txt; http://www.securityfocus.com/bid/51533; https://exchange.xforce.ibmcloud.com/vulnerabilities/72455
CVE: CVE-2012-6527
Published: 2013-01-31
Description: Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://plugins.trac.wordpress.org/changeset/490070/my-calendar; http://secunia.com/advisories/47579; http://wordpress.org/extend/plugins/my-calendar/changelog/
CVE: CVE-2012-6528
Published: 2013-01-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 2.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) themes/default/tile_search/index.tmpl.php, (2) login.php, (3) search.php, (4) password_reminder.php, (5) login.php/jscripts/infusion, (6) login.php/mods/_standard/flowplayer, (7) browse.php/jscripts/infusion/framework/fss, (8) registration.php/themes/default/ie_styles.css, (9) about.php, or (10) themes/default/social/basic_profile.tmpl.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0094.html; http://atutor.ca/atutor/change_log.php; http://secunia.com/advisories/47597
CVE: CVE-2012-6529
Published: 2013-01-31
Description: Multiple SQL injection vulnerabilities in Marinet CMS allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) galleryphoto.php or (2) gallery.php; or the roomid parameter to (3) room.php or (4) room2.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/108474/marinetcmsroomid-sql.txt; http://www.securityfocus.com/bid/51336; https://exchange.xforce.ibmcloud.com/vulnerabilities/72272
CVE: CVE-2012-6530
Published: 2013-01-31
Description: Stack-based buffer overflow in Sysax Multi Server before 5.52, when HTTP is enabled, allows remote authenticated users with the create folder permission to execute arbitrary code via a crafted request.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/18382; http://www.exploit-db.com/exploits/18420; http://www.pwnag3.com/2012/01/sysax-multi-server-550-exploit.html
CVE: CVE-2012-0203
Published: 2013-01-31
Description: Cross-site scripting (XSS) vulnerability in InfoSphere Metadata Workbench (MWB) 8.1 through 8.7 in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21623501; https://exchange.xforce.ibmcloud.com/vulnerabilities/73254; http://www-01.ibm.com/support/docview.wss?uid=swg21623501
CVE: CVE-2012-0204
Published: 2013-01-31
Description: Untrusted search path vulnerability in InfoSphere Import Export Manager 8.1 through 9.1 in InfoSphere Information Server MetaBrokers & Bridges (MBB) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, 8.7, and 9.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVSS Score: 9.3 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21623501; https://exchange.xforce.ibmcloud.com/vulnerabilities/73255; http://www-01.ibm.com/support/docview.wss?uid=swg21623501
CVE: CVE-2012-0205
Published: 2013-01-31
Description: InfoSphere Metadata Workbench (MWB) 8.1 through 8.7 in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 does not properly restrict use of the troubleshooting feature, which allows remote authenticated users to bypass intended access restrictions or cause a denial of service (workbench outage) via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21623501; https://exchange.xforce.ibmcloud.com/vulnerabilities/73265; http://www-01.ibm.com/support/docview.wss?uid=swg21623501
CVE: CVE-2012-0700
Published: 2013-01-31
Description: The client in InfoSphere FastTrack 8.1 through 8.7 in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 does not properly store credentials, which allows local users to bypass intended access restrictions via unspecified vectors.
CVSS Score: 1.9 (LOW)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21623501; https://exchange.xforce.ibmcloud.com/vulnerabilities/73266; http://www-01.ibm.com/support/docview.wss?uid=swg21623501
CVE: CVE-2012-0701
Published: 2013-01-31
Description: The client applications in the DataStage Administrator client in InfoSphere DataStage in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 rely on client-side access control, which allows remote authenticated users to gain privileges via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21623501; https://exchange.xforce.ibmcloud.com/vulnerabilities/73285; http://www-01.ibm.com/support/docview.wss?uid=swg21623501
CVE: CVE-2012-0702
Published: 2013-01-31
Description: Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 does not properly determine authorization, which allows remote authenticated users to gain privileges via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg21623501; https://exchange.xforce.ibmcloud.com/vulnerabilities/73287; http://www-01.ibm.com/support/docview.wss?uid=swg21623501
CVE: CVE-2012-0703
Published: 2013-01-31
Description: Open redirect vulnerability in Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21623501; https://exchange.xforce.ibmcloud.com/vulnerabilities/73289; http://www-01.ibm.com/support/docview.wss?uid=swg21623501
CVE: CVE-2012-0705
Published: 2013-01-31
Description: InfoSphere Import Export Manager in InfoSphere Information Server MetaBrokers & Bridges (MBB) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, 8.7, and 9.1 does not validate unspecified input data, which allows remote authenticated users to execute arbitrary commands via unknown vectors.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21623501; https://exchange.xforce.ibmcloud.com/vulnerabilities/73292; http://www-01.ibm.com/support/docview.wss?uid=swg21623501
CVE: CVE-2012-4819
Published: 2013-01-31
Description: Cross-site scripting (XSS) vulnerability in InfoSphere Business Glossary 8.1.1 and 8.1.2, InfoSphere DataStage Operation Console, InfoSphere Administration, and Reporting and Repository Management Web Console in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21623501; https://exchange.xforce.ibmcloud.com/vulnerabilities/78666; http://www-01.ibm.com/support/docview.wss?uid=swg21623501
CVE: CVE-2012-4832
Published: 2013-01-31
Description: Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 and InfoSphere Business Glossary 8.1.1 and 8.1.2 does not have an off autocomplete attribute for the password field on the login page, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21623501; https://exchange.xforce.ibmcloud.com/vulnerabilities/78906; http://www-01.ibm.com/support/docview.wss?uid=swg21623501
CVE: CVE-2012-6029
Published: 2013-01-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web-authentication function on the Cisco NAC Appliance 4.9.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) cm or (2) uri parameters to (a) perfigo_weblogin.jsp, or the (3) cm, (4) provider, (5) session, (6) uri, (7) userip, or (8) username parameters to (b) perfigo_cm_validate.jsp, aka Bug ID CSCud15109.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6029; http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2013-001/; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6029
CVE: CVE-2012-6350
Published: 2013-01-31
Description: Cross-site scripting (XSS) vulnerability in the Web component in IBM Cognos TM1 before 9.5.2 FP3 and 10.1 before 10.1 FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21621782; https://exchange.xforce.ibmcloud.com/vulnerabilities/80670; http://www-01.ibm.com/support/docview.wss?uid=swg21621782