deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-4670
Published: 2011-12-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) viewname parameter in a CalendarAjax action, (2) activity_mode parameter in a DetailView action, (3) contact_id and (4) parent_id parameters in an EditView action, (5) day, (6) month, (7) subtab, (8) view, and (9) viewOption parameters in the index action, and (10) start parameter in the ListView action to the Calendar module; (11) return_action and (12) return_module parameters in the EditView action, and (13) query parameter in an index action to the Campaigns module; (14) return_url and (15) workflow_id parameters in an editworkflow action to the com_vtiger_workflow module; (16) display_view parameter in an index action to the Dashboard module; (17) closingdate_end, (18) closingdate_start, (19) date_closed, (20) owner, (21) leadsource, (22) sales_stage, and (23) type parameters in a ListView action to the Potentials module; (24) folderid parameter in a SaveandRun action to the Reports module; (25) returnaction and (26) groupId parameters in a createnewgroup action, (27) mode and (28) parent parameters in a createrole action, (29) src_module in a ModuleManager action, (30) mode and (31) profile_id parameters in a profilePrivileges action, and (32) roleid parameter in a RoleDetailView to the Settings module; and (33) action parameter to the Home module and (34) module parameter to phprint.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/76005; http://osvdb.org/76006; http://seclists.org/fulldisclosure/2011/Oct/154
CVE: CVE-2011-4671
Published: 2011-12-02
Description: SQL injection vulnerability in adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter (aka redirect URL).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://downloads.wordpress.org/plugin/adrotate.3.6.8.zip; http://secunia.com/advisories/46814; http://unconciousmind.blogspot.com/2011/11/wordpress-adrotate-plugin-366-sql.html
CVE: CVE-2011-4672
Published: 2011-12-02
Description: Multiple SQL injection vulnerabilities in Valid tiny-erp 1.6 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to (1) _partner_list.php, (2) proioncategory_list.php, (3) _rantevou_list.php, (4) syncategory_list.php, (5) synallasomenos_list.php, (6) ypelaton_list.php, and (7) yproion_list.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2011/Nov/303; http://www.exploit-db.com/exploits/18128; http://www.securityfocus.com/archive/1/520572/100/0/threaded
CVE: CVE-2011-4673
Published: 2011-12-02
Description: SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18126; http://www.securityfocus.com/bid/50730; https://exchange.xforce.ibmcloud.com/vulnerabilities/71404
CVE: CVE-2011-4674
Published: 2011-12-02
Description: SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the only_hostid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18155; http://www.securityfocus.com/bid/50803; https://exchange.xforce.ibmcloud.com/vulnerabilities/71479
CVE: CVE-2011-1932
Published: 2011-12-05
Description: Directory traversal vulnerability in io/filesystem/filesystem.cc in Widelands before 15.1 might allow remote attackers to overwrite arbitrary files via . (dot) characters in a pathname that is used for a file transfer in an Internet game.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://bazaar.launchpad.net/~widelands-dev/widelands/build-15/revision/5021; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=617960; http://bazaar.launchpad.net/~widelands-dev/widelands/build-15/revision/5021
CVE: CVE-2011-2397
Published: 2011-12-05
Description: The Agent service in Iron Mountain Connected Backup 8.4 allows remote attackers to execute arbitrary code via a crafted opcode 13 request that triggers use of the LaunchCompoundFileAnalyzer class to send request data to the System.getRunTime.exec method.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://osvdb.org/77495; http://www.zerodayinitiative.com/advisories/ZDI-11-339/; https://exchange.xforce.ibmcloud.com/vulnerabilities/71602
CVE: CVE-2011-4051
Published: 2011-12-05
Description: CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which allows remote attackers to execute arbitrary code via vectors related to creation of a file, loading a DLL, and process control.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.indusoft.com/hotfixes/hotfixes.php; http://www.us-cert.gov/control_systems/pdf/ICSA-11-319-01.pdf; http://www.zerodayinitiative.com/advisories/ZDI-11-330/
CVE: CVE-2011-4052
Published: 2011-12-05
Description: Stack-based buffer overflow in CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 allows remote attackers to execute arbitrary code via a crafted 0x15 (aka Remove File) operation for a file with a long name.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.indusoft.com/hotfixes/hotfixes.php; http://www.us-cert.gov/control_systems/pdf/ICSA-11-319-01.pdf; http://www.zerodayinitiative.com/advisories/ZDI-11-329/
CVE: CVE-2011-4162
Published: 2011-12-05
Description: The (1) AddUser, (2) AddUserEx, (3) RemoveUser, (4) RemoveUserByGuide, (5) RemoveUserEx, and (6) RemoveUserRegardless methods in HP Protect Tools Device Access Manager (PTDAM) before 6.1.0.1 allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a long SidString argument.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4608&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6062&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/71600
CVE: CVE-2011-4356
Published: 2011-12-05
Description: Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/46973; http://www.securityfocus.com/bid/50825; https://github.com/ask/celery/blob/master/docs/sec/CELERYSA-0001.txt
CVE: CVE-2011-4543
Published: 2011-12-05
Description: Multiple directory traversal vulnerabilities in osCommerce 3.0.2 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) set or (2) module parameter to (a) OM/Core/Site/Admin/Application/templates_modules/pages/info.php, (b) OM/Core/Site/Admin/Application/templates_modules/pages/edit.php, or (c) OM/Core/Site/Admin/Application/templates_modules/pages/uninstall.php; the (3) set parameter to OM/Core/Site/Admin/Application/templates_modules/pages/main.php; the module parameter to (4) OM/Core/Site/Admin/Application/modules_order_total/pages/edit.php, (5) OM/Core/Site/Admin/Application/modules_order_total/pages/uninstall.php, (6) OM/Core/Site/Admin/Application/modules_order_total/pages/info.php, (7) OM/Core/Site/Admin/Application/modules_geoip/pages/edit.php, (8) OM/Core/Site/Admin/Application/modules_geoip/pages/uninstall.php, (9) OM/Core/Site/Admin/Application/images/pages/main.php, (10) OM/Core/Site/Admin/Application/modules_shipping/pages/edit.php, or (11) OM/Core/Site/Admin/Application/modules_shipping/pages/uninstall.php; the filter parameter to (12) OM/Core/Site/Admin/Application/templates_modules_layout/pages/main.php, (13) OM/Core/Site/Admin/Application/templates_modules_layout/pages/new.php, or (14) OM/Core/Site/Admin/Application/templates_modules_layout/pages/edit.php; or the template parameter to (15) OM/Core/Site/Admin/Application/templates/pages/info.php, (16) OM/Core/Site/Admin/Application/templates/pages/edit.php, or (17) OM/Core/Site/Admin/Application/templates/pages/uninstall.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/48308; http://www.securityfocus.com/bid/50793; https://www.dognaedis.com/vulns/DGS-SEC-4.html
CVE: CVE-2011-4675
Published: 2011-12-05
Description: The pathname canonicalization functionality in io/filesystem/filesystem.cc in Widelands before 15.1 expands leading ~ (tilde) characters to home-directory pathnames but does not restrict use of these characters in strings received from the network, which might allow remote attackers to conduct absolute path traversal attacks and overwrite arbitrary files via a ~ in a pathname that is used for a file transfer in an Internet game, a different vulnerability than CVE-2011-1932.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://bazaar.launchpad.net/~widelands-dev/widelands/build-15/revision/5021; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=617960; https://exchange.xforce.ibmcloud.com/vulnerabilities/71626
CVE: CVE-2011-4130
Published: 2011-12-06
Description: Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
CVSS Score: 9.0 (HIGH)
CWE: CWE-399
References: http://bugs.proftpd.org/show_bug.cgi?id=3711; http://www.proftpd.org/docs/NEWS-1.3.3g; http://www.securityfocus.com/bid/50631
CVE: CVE-2011-4552
Published: 2011-12-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in One Click Orgs before 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the description field of (1) a new vote or (2) the eject member proposal feature.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dmcdonald.net/?page_id=43; https://groups.google.com/group/oneclickorgs-devspace/msg/26c40a4cc9e127d2?hl=en&dmode=source&output=gplain; http://dmcdonald.net/?page_id=43
CVE: CVE-2011-4553
Published: 2011-12-06
Description: Multiple open redirect vulnerabilities in One Click Orgs before 1.2.3 allow (1) remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the return_to parameter, and allow (2) remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via crafted characters in the domain name of a subdomain.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://dmcdonald.net/?page_id=43; https://groups.google.com/group/oneclickorgs-devspace/msg/26c40a4cc9e127d2?hl=en&dmode=source&output=gplain; http://dmcdonald.net/?page_id=43
CVE: CVE-2011-4554
Published: 2011-12-06
Description: One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via (1) " (double quote) and newline characters in an org name or (2) " (double quote) characters in an e-mail address, related to a "2nd Order SMTP Injection" issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://dmcdonald.net/?page_id=43; https://groups.google.com/group/oneclickorgs-devspace/msg/26c40a4cc9e127d2?hl=en&dmode=source&output=gplain; http://dmcdonald.net/?page_id=43
CVE: CVE-2011-4555
Published: 2011-12-06
Description: One Click Orgs before 1.2.3 does not require unique e-mail addresses for user accounts, which allows remote authenticated users to cause a denial of service (login disruption) or spoof votes or comments by selecting a conflicting e-mail address.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://dmcdonald.net/?page_id=43; https://groups.google.com/group/oneclickorgs-devspace/msg/26c40a4cc9e127d2?hl=en&dmode=source&output=gplain; http://dmcdonald.net/?page_id=43
CVE: CVE-2011-4677
Published: 2011-12-06
Description: One Click Orgs before 1.2.3 does not have an off autocomplete attribute for authentication fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://dmcdonald.net/?page_id=43; https://groups.google.com/group/oneclickorgs-devspace/msg/26c40a4cc9e127d2?hl=en&dmode=source&output=gplain; http://dmcdonald.net/?page_id=43
CVE: CVE-2011-4678
Published: 2011-12-06
Description: The password reset feature in One Click Orgs before 1.2.3 generates different error messages for failed reset attempts depending on whether the e-mail address is registered, which allows remote attackers to enumerate user accounts via a series of requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://dmcdonald.net/?page_id=43; https://groups.google.com/group/oneclickorgs-devspace/msg/26c40a4cc9e127d2?hl=en&dmode=source&output=gplain; http://dmcdonald.net/?page_id=43
CVE: CVE-2002-2435
Published: 2011-12-07
Description: The Cascading Style Sheets (CSS) implementation in Microsoft Internet Explorer 8.0 and earlier does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a related issue to CVE-2010-2264.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://bugzilla.mozilla.org/show_bug.cgi?id=147777; http://w2spconf.com/2010/papers/p26.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/71817
CVE: CVE-2002-2436
Published: 2011-12-07
Description: The Cascading Style Sheets (CSS) implementation in Mozilla Firefox before 4.0, Thunderbird before 3.3, and SeaMonkey before 2.1 does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a related issue to CVE-2010-2264.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://blog.mozilla.com/security/2010/03/31/plugging-the-css-history-leak/; http://bugzilla.mozilla.org/show_bug.cgi?id=147777; http://w2spconf.com/2010/papers/p26.pdf
CVE: CVE-2002-2437
Published: 2011-12-07
Description: The JavaScript implementation in Mozilla Firefox before 4.0, Thunderbird before 3.3, and SeaMonkey before 2.1 does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://blog.mozilla.com/security/2010/03/31/plugging-the-css-history-leak/; http://bugzilla.mozilla.org/show_bug.cgi?id=147777; http://w2spconf.com/2010/papers/p26.pdf
CVE: CVE-2010-5068
Published: 2011-12-07
Description: The Cascading Style Sheets (CSS) implementation in Opera 10.5 does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a related issue to CVE-2010-2264.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://w2spconf.com/2010/papers/p26.pdf; http://w2spconf.com/2010/papers/p26.pdf
CVE: CVE-2010-5069
Published: 2011-12-07
Description: The Cascading Style Sheets (CSS) implementation in Google Chrome 4 does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document.  NOTE: this may overlap CVE-2010-2264.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://w2spconf.com/2010/papers/p26.pdf; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14253; http://w2spconf.com/2010/papers/p26.pdf
CVE: CVE-2010-5070
Published: 2011-12-07
Description: The JavaScript implementation in Apple Safari 4 does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method, a different vulnerability than CVE-2010-2264.  NOTE: this may overlap CVE-2010-5073.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://w2spconf.com/2010/papers/p26.pdf; http://w2spconf.com/2010/papers/p26.pdf
CVE: CVE-2010-5071
Published: 2011-12-07
Description: The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://w2spconf.com/2010/papers/p26.pdf; http://w2spconf.com/2010/papers/p26.pdf
CVE: CVE-2010-5072
Published: 2011-12-07
Description: The JavaScript implementation in Opera 10.5 does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://w2spconf.com/2010/papers/p26.pdf; http://w2spconf.com/2010/papers/p26.pdf
CVE: CVE-2010-5073
Published: 2011-12-07
Description: The JavaScript implementation in Google Chrome 4 does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method. NOTE: this may overlap CVE-2010-5070.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://w2spconf.com/2010/papers/p26.pdf; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13767; http://w2spconf.com/2010/papers/p26.pdf
CVE: CVE-2010-5074
Published: 2011-12-07
Description: The layout engine in Mozilla Firefox before 4.0, Thunderbird before 3.3, and SeaMonkey before 2.1 executes different code for visited and unvisited links during the processing of Cascading Style Sheets (CSS) token sequences, which makes it easier for remote attackers to obtain sensitive information about visited web pages via a timing attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://blog.mozilla.com/security/2010/03/31/plugging-the-css-history-leak/; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14456; http://blog.mozilla.com/security/2010/03/31/plugging-the-css-history-leak/
CVE: CVE-2011-2462
Published: 2011-12-07
Description: Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html; http://www.adobe.com/support/security/advisories/apsa11-04.html
CVE: CVE-2011-4263
Published: 2011-12-07
Description: Cross-site scripting (XSS) vulnerability in Schneider Electric PowerChute Business Edition before 8.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN61695284/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000100; http://jvn.jp/en/jp/JVN61695284/index.html
CVE: CVE-2011-4679
Published: 2011-12-07
Description: vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7003; http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7004; http://wiki.vtiger.com/index.php/Oct2011:ODUpdate
CVE: CVE-2011-4680
Published: 2011-12-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in the customer portal in vtiger CRM before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://wiki.vtiger.com/index.php/Jan2011:ODUpdate; http://wiki.vtiger.com/index.php/Jan2011:ODUpdate
CVE: CVE-2011-4681
Published: 2011-12-07
Description: Opera before 11.60 does not properly consider the number of . (dot) characters that conventionally exist in domain names of different top-level domains, which allows remote attackers to bypass the Same Origin Policy by leveraging access to a different domain name in the same top-level domain, as demonstrated by the .no or .uk domain.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.opera.com/docs/changelogs/mac/1160/; http://www.opera.com/docs/changelogs/unix/1160/; http://www.opera.com/docs/changelogs/windows/1160/
CVE: CVE-2011-4682
Published: 2011-12-07
Description: The JavaScript engine in Opera before 11.60 does not properly implement the in operator, which allows remote attackers to bypass the Same Origin Policy via vectors related to variables on different web sites.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www.opera.com/docs/changelogs/mac/1160/; http://www.opera.com/docs/changelogs/unix/1160/; http://www.opera.com/docs/changelogs/windows/1160/
CVE: CVE-2011-4683
Published: 2011-12-07
Description: Unspecified vulnerability in Opera before 11.60 has unknown impact and attack vectors, related to a "moderately severe issue."
CVSS Score: 10.0 (HIGH)
References: http://www.opera.com/docs/changelogs/mac/1160/; http://www.opera.com/docs/changelogs/unix/1160/; http://www.opera.com/docs/changelogs/windows/1160/
CVE: CVE-2011-4684
Published: 2011-12-07
Description: Opera before 11.60 does not properly handle certificate revocation, which has unspecified impact and remote attack vectors related to "corner cases."
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: http://www.opera.com/docs/changelogs/mac/1160/; http://www.opera.com/docs/changelogs/unix/1160/; http://www.opera.com/docs/changelogs/windows/1160/
CVE: CVE-2011-4685
Published: 2011-12-07
Description: Dragonfly in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unspecified content on a web page, as demonstrated by forbes.com.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.opera.com/docs/changelogs/mac/1160/; http://www.opera.com/docs/changelogs/unix/1160/; http://www.opera.com/docs/changelogs/windows/1160/
CVE: CVE-2011-4686
Published: 2011-12-07
Description: Unspecified vulnerability in the Web Workers implementation in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.opera.com/docs/changelogs/mac/1160/; http://www.opera.com/docs/changelogs/unix/1160/; http://www.opera.com/docs/changelogs/windows/1160/
CVE: CVE-2011-4687
Published: 2011-12-07
Description: Opera before 11.60 allows remote attackers to cause a denial of service (CPU and memory consumption) via unspecified content on a web page, as demonstrated by a page under the cisco.com home page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.opera.com/docs/changelogs/mac/1160/; http://www.opera.com/docs/changelogs/unix/1160/; http://www.opera.com/docs/changelogs/windows/1160/
CVE: CVE-2011-4688
Published: 2011-12-07
Description: Mozilla Firefox 8.0.1 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lcamtuf.coredump.cx/cachetime/; http://secunia.com/advisories/47090; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13770