deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-3021
Published: 2012-02-16
Description: Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to subframe loading.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=111779; http://googlechromereleases.blogspot.com/2012/02/chrome-stable-update.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3022
Published: 2012-02-16
Description: translate/translate_manager.cc in Google Chrome before 17.0.963.56 and 19.x before 19.0.1036.7 uses an HTTP session to exchange data for translation, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-319
References: http://code.google.com/p/chromium/issues/detail?id=112236; http://googlechromereleases.blogspot.com/2012/02/chrome-stable-update.html; http://googlechromereleases.blogspot.com/2012/02/dev-channel-update_10.html
CVE: CVE-2011-3023
Published: 2012-02-16
Description: Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to drag-and-drop operations.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=112259; http://googlechromereleases.blogspot.com/2012/02/chrome-stable-update.html; http://secunia.com/advisories/48016
CVE: CVE-2011-3024
Published: 2012-02-16
Description: Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service (application crash) via an empty X.509 certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-295
References: http://code.google.com/p/chromium/issues/detail?id=112451; http://googlechromereleases.blogspot.com/2012/02/chrome-stable-update.html; http://secunia.com/advisories/48016
CVE: CVE-2011-3025
Published: 2012-02-16
Description: Google Chrome before 17.0.963.56 does not properly parse H.264 data, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=112670; http://googlechromereleases.blogspot.com/2012/02/chrome-stable-update.html; http://secunia.com/advisories/48016
CVE: CVE-2011-3026
Published: 2012-02-16
Description: Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-190
References: http://code.google.com/p/chromium/issues/detail?id=112822; http://googlechromereleases.blogspot.com/2012/02/chrome-stable-update.html; http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
CVE: CVE-2011-3027
Published: 2012-02-16
Description: Google Chrome before 17.0.963.56 does not properly perform a cast of an unspecified variable during handling of columns, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-704
References: http://code.google.com/p/chromium/issues/detail?id=112847; http://googlechromereleases.blogspot.com/2012/02/chrome-stable-update.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2012-0352
Published: 2012-02-16
Description: Cisco NX-OS 4.2.x before 4.2(1)SV1(5.1) on Nexus 1000v series switches; 4.x and 5.0.x before 5.0(2)N1(1) on Nexus 5000 series switches; and 4.2.x before 4.2.8, 5.0.x before 5.0.5, and 5.1.x before 5.1.1 on Nexus 7000 series switches allows remote attackers to cause a denial of service (netstack process crash and device reload) via a malformed IP packet, aka Bug IDs CSCti23447, CSCti49507, and CSCtj01991.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120215-nxos; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120215-nxos
CVE: CVE-2012-0206
Published: 2012-02-17
Description: common_startup.cc in PowerDNS (aka pdns) Authoritative Server before 2.9.22.5 and 3.x before 3.0.1 allows remote attackers to cause a denial of service (packet loop) via a crafted UDP DNS response.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://doc.powerdns.com/changelog.html; http://doc.powerdns.com/powerdns-advisory-2012-01.html; https://bugzilla.redhat.com/show_bug.cgi?id=772570
CVE: CVE-2012-1191
Published: 2012-02-17
Description: The resolver in dnscache in Daniel J. Bernstein djbdns 1.05 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: https://www.isc.org/files/imce/ghostdomain_camera.pdf; https://www.isc.org/files/imce/ghostdomain_camera.pdf
CVE: CVE-2012-1192
Published: 2012-02-17
Description: The resolver in Unbound before 1.4.11 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
CVSS Score: 6.4 (MEDIUM)
References: https://www.isc.org/files/imce/ghostdomain_camera.pdf; https://www.isc.org/files/imce/ghostdomain_camera.pdf
CVE: CVE-2012-1193
Published: 2012-02-17
Description: The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
CVSS Score: 6.4 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102729.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104173.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104177.html
CVE: CVE-2012-1194
Published: 2012-02-17
Description: The resolver in the DNS Server service in Microsoft Windows Server 2008 before R2 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
CVSS Score: 6.4 (MEDIUM)
References: https://www.isc.org/files/imce/ghostdomain_camera.pdf; https://www.isc.org/files/imce/ghostdomain_camera.pdf
CVE: CVE-2011-4105
Published: 2012-02-17
Description: LightDM before 1.0.6 allows local users to change ownership of arbitrary files via a symlink attack on ~/.Xauthority.
CVSS Score: 1.9 (LOW)
CWE: CWE-59
References: http://lists.freedesktop.org/archives/lightdm/2011-November/000178.html; http://www.openwall.com/lists/oss-security/2011/11/02/10; http://www.openwall.com/lists/oss-security/2011/11/02/6
CVE: CVE-2011-4113
Published: 2012-02-17
Description: SQL injection vulnerability in the Views module before 6.x-2.13 for Drupal allows remote attackers to execute arbitrary SQL commands via vectors related to "filters/arguments on certain types of views with specific configurations of arguments."
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/1329842; http://drupal.org/node/1329898; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069499.html
CVE: CVE-2011-3361
Published: 2012-02-18
Description: Cross-site scripting (XSS) vulnerability in CGI/Browse.pm in BackupPC 3.2.0 and possibly other versions before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a browse action to index.cgi.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://backuppc.cvs.sourceforge.net/viewvc/backuppc/BackupPC/ChangeLog?revision=1.60&view=markup; http://backuppc.cvs.sourceforge.net/viewvc/backuppc/BackupPC/lib/BackupPC/CGI/Browse.pm?r1=1.23&r2=1.24; http://secunia.com/advisories/44259
CVE: CVE-2011-4320
Published: 2012-02-18
Description: The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service (infinite loop) via a stanza with a publish tag that lacks a node attribute.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/46915; http://www.openwall.com/lists/oss-security/2011/11/19/1; http://www.openwall.com/lists/oss-security/2011/11/19/2
CVE: CVE-2011-4614
Published: 2012-02-18
Description: PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and development versions of 4.7 allows remote attackers to execute arbitrary PHP code via a URL in the BACK_PATH parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/47201; http://typo3.org/fileadmin/security-team/bug32571/32571.diff; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/
CVE: CVE-2011-4923
Published: 2012-02-18
Description: Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to index.cgi, related to the log file viewer, a different vulnerability than CVE-2011-3361.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/46615; http://ubuntu.com/usn/usn-1249-1; http://www.openwall.com/lists/oss-security/2011/10/27/8
CVE: CVE-2011-5081
Published: 2012-02-18
Description: Cross-site scripting (XSS) vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile action to index.cgi.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/bugtraq/2011/Apr/266; http://secunia.com/advisories/44385; http://www.osvdb.org/72055
CVE: CVE-2012-1195
Published: 2012-02-18
Description: Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a PutUpdateFileCore command in a RunAMTCommand SOAP request, then accessing the file via a direct request to the file in the web root.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/79276; http://secunia.com/advisories/47666; http://www.securityfocus.com/bid/52023
CVE: CVE-2012-1196
Published: 2012-02-18
Description: Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. (dot dot) in the filename parameter in a SetTaskLogByFile SOAP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/79277; http://secunia.com/advisories/47666; http://www.securityfocus.com/bid/52023
CVE: CVE-2012-1197
Published: 2012-02-18
Description: Integer overflow in the IDE_ACDStd.apl module for ACDSee 14.1 Build 137 allows remote attackers to execute arbitrary code via crafted "image dimension values" in a BMP file, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://osvdb.org/79305; http://secunia.com/advisories/47450; http://www.securityfocus.com/bid/52047
CVE: CVE-2012-1198
Published: 2012-02-18
Description: base_ag_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allows remote attackers to execute arbitrary code by uploading contents of the file with an executable extension via a create action, then accessing it via a view action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.org/files/109663/BASE-1.4.5-Remote-File-Inclusion-Shell-Creation.html; http://www.securityfocus.com/bid/51979; https://exchange.xforce.ibmcloud.com/vulnerabilities/73201
CVE: CVE-2012-1199
Published: 2012-02-18
Description: Multiple PHP remote file inclusion vulnerabilities in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) BASE_path parameter to base_ag_main.php, (2) base_db_setup.php, (3) base_graph_common.php, (4) base_graph_display.php, (5) base_graph_form.php, (6) base_graph_main.php, (7) base_local_rules.php, (8) base_logout.php, (9) base_main.php, (10) base_maintenance.php, (11) base_payload.php, (12) base_qry_alert.php, (13) base_qry_common.php, (14) base_qry_main.php, (15) base_stat_alerts.php, (16) base_stat_class.php, (17) base_stat_common.php, (18) base_stat_ipaddr.php, (19) base_stat_iplink.php, (20) base_stat_ports.php, (21) base_stat_sensor.php, (22) base_stat_time.php, (23) base_stat_uaddr.php, (24) base_user.php, (25) index.php, (26) admin/base_roleadmin.php, (27) admin/base_useradmin.php, (28) admin/index.php, (29) help/base_setup_help.php, (30) includes/base_action.inc.php, (31) includes/base_cache.inc.php, (32) includes/base_db.inc.php, (33) includes/base_db.inc.php, (34) includes/base_include.inc.php, (35) includes/base_output_html.inc.php, (36) includes/base_output_query.inc.php, (37) includes/base_state_criteria.inc.php, (38) includes/base_state_query.inc.php or (39) setup/base_conf_contents.php; (40) GLOBALS[user_session_path] parameter to includes/base_state_common.inc.php; (41) BASE_Language parameter to setup/base_conf_contents.php; or (42) ado_inc_php parameter to setup/setup2.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/files/109663/BASE-1.4.5-Remote-File-Inclusion-Shell-Creation.html; http://www.securityfocus.com/bid/51979; https://exchange.xforce.ibmcloud.com/vulnerabilities/73200
CVE: CVE-2012-1200
Published: 2012-02-18
Description: Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the (1) fileType parameter to optimizer/index.php, (2) id parameter to administrator/modules/moduleslist.php, (3) filename parameter to includes/function/gets.php, or (4) conf[blockfile] parameter to includes/function/usertpl.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/files/109669/Nova-CMS-Remote-File-Inclusion.html; http://www.securityfocus.com/bid/51976; https://exchange.xforce.ibmcloud.com/vulnerabilities/73159
CVE: CVE-2012-1214
Published: 2012-02-21
Description: Cross-site scripting (XSS) vulnerability in the Add friends module in Yoono Desktop Application before 1.8.21 allows remote attackers to inject arbitrary web script or HTML via the create field in a "Create a group" action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/109618/#comment-10343; http://packetstormsecurity.org/files/109618/Yoono-Desktop-1.8.16-Cross-Site-Scripting.html; http://support.yoono.com/yoono/topics/xss-w35in
CVE: CVE-2012-1215
Published: 2012-02-21
Description: Cross-site scripting (XSS) vulnerability in the Add friends module in the Yoono extension before 7.7.8 for Firefox allows remote attackers to inject arbitrary web script or HTML via the create field in a "Create a group" action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/109617/#comment-10344; http://packetstormsecurity.org/files/109617/Yoono-Firefox-7.7.0-Cross-Site-Scripting.html; http://support.yoono.com/yoono/topics/xss-w35in
CVE: CVE-2012-1216
Published: 2012-02-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in PBBoard 2.1.4 allow remote attackers to hijack the authentication of administrators for requests that (1) upload a file via an add action or (2) change the contents of a file via a dit action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.org/files/109706/PBBoard-2.1.4-Cross-Site-Request-Forgery-Shell-Upload.html; http://secunia.com/advisories/47948; http://packetstormsecurity.org/files/109706/PBBoard-2.1.4-Cross-Site-Request-Forgery-Shell-Upload.html
CVE: CVE-2012-1217
Published: 2012-02-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in STHS v2 Web Portal 2.2 allow remote attackers to inject arbitrary web script or HTML via the team parameter to (1) prospects.php, (2) prospect.php, or (3) team.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://0nto.wordpress.com/2012/02/13/sths-v2-web-portal-2-2-sql-injection-vulnerabilty/; http://packetstormsecurity.org/files/109665/STHS-v2-Web-Portal-2.2-SQL-Injection.html; http://www.securityfocus.com/bid/51991
CVE: CVE-2011-4185
Published: 2012-02-21
Description: The GetPrinterURLList2 method in the ActiveX control in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2008-2431 and CVE-2008-2436.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.novell.com/support/viewContent.do?externalId=7008708; http://www.novell.com/support/viewContent.do?externalId=7010144; http://www.novell.com/support/viewContent.do?externalId=7008708
CVE: CVE-2011-4186
Published: 2012-02-21
Description: Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a crafted client-file-name parameter in a printer-url, a different vulnerability than CVE-2011-1705.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.novell.com/support/viewContent.do?externalId=7008708; http://www.novell.com/support/viewContent.do?externalId=7010145; http://www.novell.com/support/viewContent.do?externalId=7008708
CVE: CVE-2011-4187
Published: 2012-02-21
Description: Buffer overflow in the GetDriverSettings function in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a long realm field, a different vulnerability than CVE-2011-3173.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.novell.com/support/viewContent.do?externalId=7008708; http://www.novell.com/support/viewContent.do?externalId=7010143; http://www.novell.com/support/viewContent.do?externalId=7008708
CVE: CVE-2012-0224
Published: 2012-02-21
Description: Untrusted search path vulnerability in 7-Technologies (7T) AQUIS 1.5 and earlier allows local users to gain privileges via a Trojan horse DLL in the current working directory, a different vulnerability than CVE-2012-0223.
CVSS Score: 9.3 (HIGH)
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-025-01.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-025-01.pdf
CVE: CVE-2012-0865
Published: 2012-02-21
Description: Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0058.html; http://osvdb.org/79140; http://osvdb.org/79141
CVE: CVE-2012-0993
Published: 2012-02-21
Description: Eval injection vulnerability in zp-core/zp-extensions/viewer_size_image.php in ZENphoto 1.4.2, when the viewer_size_image plugin is enabled, allows remote attackers to execute arbitrary PHP code via the viewer_size_image_saved cookie.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0037.html; http://secunia.com/advisories/47875; http://www.securityfocus.com/bid/51916
CVE: CVE-2012-0994
Published: 2012-02-21
Description: SQL injection vulnerability in the Manage Albums feature in zp-core/admin-albumsort.php in ZENphoto 1.4.2 allows remote authenticated users to execute arbitrary SQL commands via the sortableList parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0037.html; http://secunia.com/advisories/47875; http://www.securityfocus.com/bid/51916
CVE: CVE-2012-0995
Published: 2012-02-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in an external action to zp-core/admin.php, (2) PATH_INTO to an unspecified URL, as demonstrated using /1/, (3) PATH_INFO to zp-core/admin.php, or (4) album parameter to zp-core/admin-edit.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0037.html; http://secunia.com/advisories/47875; http://www.securityfocus.com/bid/51916
CVE: CVE-2012-1218
Published: 2012-02-21
Description: Multiple SQL injection vulnerabilities in freelancerKit 2.35 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to the (1) notes and (2) tickets components.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/47766; http://www.securityfocus.com/bid/51946; http://www.vulnerability-lab.com/get_content.php?id=402
CVE: CVE-2012-1219
Published: 2012-02-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in freelancerKit 2.35 allow remote attackers to inject arbitrary web script or HTML via the (1) ticket parameter to tickets.php, (2) title parameter to notes.php, or (3) task parameter to todo.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/47766; http://www.securityfocus.com/bid/51946; http://www.vulnerability-lab.com/get_content.php?id=402
CVE: CVE-2012-1220
Published: 2012-02-21
Description: Cross-site request forgery (CSRF) vulnerability in modules/config/admin_utente.php in GAzie 5.20 and earlier allows remote attackers to hijack the authentication of administrators for requests that change account information via an update action, as demonstrated by changing the password.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/47947; http://www.exploit-db.com/exploits/18464; https://exchange.xforce.ibmcloud.com/vulnerabilities/72991
CVE: CVE-2012-1221
Published: 2012-02-21
Description: Directory traversal vulnerability in the telnet server in RabidHamster R2/Extreme 1.65 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the File command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://aluigi.org/adv/r2_1-adv.txt; http://secunia.com/advisories/47966; http://www.osvdb.org/79094
CVE: CVE-2012-1222
Published: 2012-02-21
Description: Stack-based buffer overflow in RabidHamster R2/Extreme 1.65 and earlier allows remote authenticated users to execute arbitrary code via a long string to TCP port 23.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/r2_1-adv.txt; http://osvdb.org/79093; http://secunia.com/advisories/47966
CVE: CVE-2012-1223
Published: 2012-02-21
Description: RabidHamster R2/Extreme 1.65 and earlier uses a small search space of values for the PIN number, which allows remote attackers to obtain the PIN number via a brute force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://aluigi.org/adv/r2_1-adv.txt; http://osvdb.org/79095; http://secunia.com/advisories/47966
CVE: CVE-2012-1224
Published: 2012-02-21
Description: Cross-site scripting (XSS) vulnerability in system/classes/login.php in ContentLion Alpha 1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/78833; http://www.darksecurity.de/advisories/2012/SSCHADV2012-004.txt; http://osvdb.org/78833