deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-0028
Published: 2012-06-21
Description: The robust futex implementation in the Linux kernel before 2.6.28 does not properly handle processes that make exec system calls, which allows local users to cause a denial of service or possibly gain privileges by writing to a memory location in a child process.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8141c7f3e7aee618312fa1c15109e1219de784a7; http://www.openwall.com/lists/oss-security/2012/05/08/1
CVE: CVE-2012-2127
Published: 2012-06-21
Description: fs/proc/root.c in the procfs implementation in the Linux kernel before 3.2 does not properly interact with CLONE_NEWPID clone system calls, which allows remote attackers to cause a denial of service (reference leak and memory consumption) by making many connections to a daemon that uses PID namespaces to isolate clients, as demonstrated by vsftpd.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=905ad269c55fc62bee3da29f7b1d1efeba8aa1e1; http://ubuntu.com/usn/usn-1607-1; http://www.kernel.org/pub/linux/kernel/v3.x/
CVE: CVE-2012-0186
Published: 2012-06-22
Description: Directory traversal vulnerability in the Eclipse Help component in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack allows remote attackers to discover the locations of files via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.ibm.com/support/docview.wss?uid=swg21575642; https://exchange.xforce.ibmcloud.com/vulnerabilities/72096; http://www.ibm.com/support/docview.wss?uid=swg21575642
CVE: CVE-2012-0187
Published: 2012-06-22
Description: Untrusted search path vulnerability in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVSS Score: 9.3 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg21575642; https://exchange.xforce.ibmcloud.com/vulnerabilities/72097; http://www.ibm.com/support/docview.wss?uid=swg21575642
CVE: CVE-2012-0191
Published: 2012-06-22
Description: The web container in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack does not properly perform access control for requests, which allows remote attackers to spoof a localhost request origin via crafted headers.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.ibm.com/support/docview.wss?uid=swg21575642; https://exchange.xforce.ibmcloud.com/vulnerabilities/72156; http://www.ibm.com/support/docview.wss?uid=swg21575642
CVE: CVE-2012-0304
Published: 2012-06-22
Description: Symantec LiveUpdate Administrator before 2.3.1 uses weak permissions (Everyone: Full Control) for the installation directory, which allows local users to gain privileges via a Trojan horse file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://www.nessus.org/plugins/index.php?view=single&id=59193; http://www.securityfocus.com/bid/53903; http://www.securitytracker.com/id?1027182
CVE: CVE-2012-2171
Published: 2012-06-22
Description: SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a state_viewmodulelog action to the ModuleServlet URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172; http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/75236
CVE: CVE-2012-2172
Published: 2012-06-22
Description: Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the updateRegn parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172; http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/75239
CVE: CVE-2012-2179
Published: 2012-06-22
Description: libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/libodm_advisory.asc; http://www.ibm.com/support/docview.wss?uid=isg1IV21379; http://www.ibm.com/support/docview.wss?uid=isg1IV21381
CVE: CVE-2012-2660
Published: 2012-06-22
Description: actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
CVE: CVE-2012-2661
Published: 2012-06-22
Description: The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html; http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
CVE: CVE-2012-2694
Published: 2012-06-22
Description: actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "['xyz', nil]" values, a related issue to CVE-2012-2660.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
CVE: CVE-2012-2695
Published: 2012-06-22
Description: The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
CVE: CVE-2012-3792
Published: 2012-06-25
Description: Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a denial of service (out-of-bounds read operation) via a crafted packet that triggers a certain Find Node check attempt.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://aluigi.org/adv/proservrex_1-adv.txt; http://ics-cert.us-cert.gov/advisories/ICSA-12-179-01; http://secunia.com/advisories/49172
CVE: CVE-2012-3793
Published: 2012-06-25
Description: Integer overflow in Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a denial of service (daemon crash) via a crafted packet with a certain opcode that triggers an incorrect memory allocation and a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://aluigi.org/adv/proservrex_1-adv.txt; http://ics-cert.us-cert.gov/advisories/ICSA-12-179-01; http://secunia.com/advisories/49172
CVE: CVE-2012-3794
Published: 2012-06-25
Description: Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a denial of service (unhandled exception and daemon crash) via a crafted packet with a certain opcode that triggers an invalid attempt to allocate a large amount of memory.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://aluigi.org/adv/proservrex_1-adv.txt; http://ics-cert.us-cert.gov/advisories/ICSA-12-179-01; http://secunia.com/advisories/49172
CVE: CVE-2012-3795
Published: 2012-06-25
Description: Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a denial of service (daemon crash) via a crafted packet with a certain opcode and a large value in a size field.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://aluigi.org/adv/proservrex_1-adv.txt; http://ics-cert.us-cert.gov/advisories/ICSA-12-179-01; http://secunia.com/advisories/49172
CVE: CVE-2012-3796
Published: 2012-06-25
Description: Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to obtain sensitive information from daemon memory via a crafted packet with a certain opcode.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://aluigi.org/adv/proservrex_1-adv.txt; http://ics-cert.us-cert.gov/advisories/ICSA-12-179-01; http://secunia.com/advisories/49172
CVE: CVE-2012-3797
Published: 2012-06-25
Description: Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, does not properly check packet sizes before reusing packet memory buffers, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a short crafted packet with a certain opcode.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/proservrex_1-adv.txt; http://ics-cert.us-cert.gov/advisories/ICSA-12-179-01; http://secunia.com/advisories/49172
CVE: CVE-2010-2021
Published: 2012-06-25
Description: Open redirect vulnerability in the Global Redirect module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, when non-clean to clean is enabled, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://drupal.org/node/1633054; http://drupal.org/node/768244; http://secunia.com/advisories/49523
CVE: CVE-2012-2380
Published: 2012-06-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-06/0376.html; http://archives.neohapsis.com/archives/fulldisclosure/2012-06/0376.html
CVE: CVE-2012-2381
Published: 2012-06-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-06/0377.html; http://archives.neohapsis.com/archives/fulldisclosure/2012-06/0377.html
CVE: CVE-2012-2639
Published: 2012-06-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-4940.  Reason: This candidate is a reservation duplicate of CVE-2011-4940.  Notes: All CVE users should reference CVE-2011-4940 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2122
Published: 2012-06-26
Description: sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-287
References: http://bugs.mysql.com/bug.php?id=64884; http://kb.askmonty.org/en/mariadb-5162-release-notes/; http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html
CVE: CVE-2012-2732
Published: 2012-06-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-2021.  Reason: This candidate is a duplicate of CVE-2010-2021.  Notes: All CVE users should reference CVE-2010-2021 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2699
Published: 2012-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-2339.  Reason: This candidate is a duplicate of CVE-2012-2339.  Notes: All CVE users should reference CVE-2012-2339 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2700
Published: 2012-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-2340.  Reason: This candidate is a duplicate of CVE-2012-2340.  Notes: All CVE users should reference CVE-2012-2340 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2701
Published: 2012-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-2341.  Reason: This candidate is a duplicate of CVE-2012-2341.  Notes: All CVE users should reference CVE-2012-2341 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2702
Published: 2012-06-27
Description: The Ubercart Product Keys module 6.x-1.x before 6.x-1.1 for Drupal does not properly check access for product keys, which allows remote attackers to read all unassigned product keys via certain conditions related to the uid.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1580752; http://drupal.org/node/1585532; http://drupalcode.org/project/uc_product_keys.git/commitdiff/19fa261
CVE: CVE-2012-2703
Published: 2012-06-27
Description: Cross-site scripting (XSS) vulnerability in the Advertisement module 6.x-2.x before 6.x-2.3 for Drupal, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to the "$conf variable in settings.php."
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1585544; http://drupalcode.org/project/ad.git/commitdiff/4337f34; http://www.openwall.com/lists/oss-security/2012/06/14/3
CVE: CVE-2012-2705
Published: 2012-06-27
Description: The filter_titles function in the Smart Breadcrumb module 6.x-1.x before 6.x-1.3 for Drupal does not properly convert a title to plain-text, which allows remote authenticated users with create or edit node permissions to conduct cross-site scripting (XSS) attacks via the title parameter.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://drupal.org/node/1568216; http://drupal.org/node/1585564; http://drupalcode.org/project/smart_breadcrumb.git/commitdiff/834f75a
CVE: CVE-2012-2706
Published: 2012-06-27
Description: Cross-site scripting (XSS) vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to user registration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1585648; http://www.openwall.com/lists/oss-security/2012/06/14/3; http://www.securityfocus.com/bid/53589
CVE: CVE-2012-2707
Published: 2012-06-27
Description: The Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal does not properly exit when users do not have access to package/task nodes, which allows remote attackers to bypass intended access restrictions and edit unauthorized nodes.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://community.aegirproject.org/1.9; http://drupal.org/node/1585658; http://drupal.org/node/1585678
CVE: CVE-2012-2708
Published: 2012-06-27
Description: Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules/hosting/task/hosting_task.module in the Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a Drush log message in a provision task log.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://community.aegirproject.org/1.9; http://drupal.org/node/1585658; http://drupal.org/node/1585678
CVE: CVE-2012-2710
Published: 2012-06-27
Description: Cross-site scripting (XSS) vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal, when "Append the content title to the end of the breadcrumb" is enabled, allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1585960; http://drupal.org/node/628480; http://www.openwall.com/lists/oss-security/2012/06/14/3
CVE: CVE-2012-2711
Published: 2012-06-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy List module 6.x-1.x before 6.x-1.4 for Drupal allow remote authenticated users with create or edit taxonomy terms permissions to inject arbitrary web script or HTML via vectors related to taxonomy information.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1595396; http://drupal.org/node/1597262; http://drupalcode.org/project/taxonomy_list.git/commitdiff/7dd21a0
CVE: CVE-2012-2712
Published: 2012-06-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.1 for Drupal, when supporting manual entry of field identifiers, allow remote attackers to inject arbitrary web script or HTML via vectors related to thrown exceptions and logging errors.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1596524; http://drupal.org/node/1597364; http://drupalcode.org/project/search_api.git/commitdiff/5a18c8c
CVE: CVE-2012-2713
Published: 2012-06-27
Description: Cross-site request forgery (CSRF) vulnerability in the BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that login a user to another web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/1597414; http://drupalcode.org/project/browserid.git/commitdiff/5e5cdcd; http://secunia.com/advisories/49227
CVE: CVE-2012-2715
Published: 2012-06-27
Description: Cross-site scripting (XSS) vulnerability in the themes_links function in template.php in the Amadou theme module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to class attributes in a list of links.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1608730; http://drupal.org/node/1608780; http://drupalcode.org/project/amadou.git/commitdiff/071ea83
CVE: CVE-2012-2719
Published: 2012-06-27
Description: The filedepot module 6.x-1.x before 6.x-1.3 for Drupal, when accessed using multiple different browsers from the same IP address, causes Internet Explorer sessions to "switch users" when uploading a file, which has unspecified impact possibly involving file uploads to the wrong user directory, aka "Session Management Vulnerability."
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1598782; http://drupal.org/node/1608864; http://secunia.com/advisories/49316
CVE: CVE-2012-2720
Published: 2012-06-27
Description: The Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remote attackers to perform requests with extra privileges.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1618476; http://drupal.org/node/1619808; http://secunia.com/advisories/49400
CVE: CVE-2012-2721
Published: 2012-06-27
Description: The default views in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal do not properly check permissions when all users have the "access content" permission removed, which allows remote attackers to bypass access restrictions and possibly have other unspecified impact.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1619736; http://drupal.org/node/1619810; http://drupalcode.org/project/og.git/commitdiff/1485708
CVE: CVE-2012-2722
Published: 2012-06-27
Description: The node selection interface in the WYSIWYG editor (CKEditor) in the Node Embed module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.0 for Drupal does not properly check permissions, which allows remote attackers to bypass intended access restrictions and read node titles.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1618428; http://drupal.org/node/1618430; http://drupal.org/node/1619824
CVE: CVE-2012-2723
Published: 2012-06-27
Description: Cross-site scripting (XSS) vulnerability in the Maestro module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with maestro admin permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1617952; http://drupal.org/node/1619830; http://drupalcode.org/project/maestro.git/commitdiff/c499971
CVE: CVE-2012-2725
Published: 2012-06-27
Description: classes/Filter/WhitelistedExternalFilter.php in the Authoring HTML module 6.x-1.x before 6.x-1.1 for Drupal does not properly validate sources with the host white list, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://drupal.org/node/1619086; http://drupal.org/node/1619852; http://drupalcode.org/project/authoring_html.git/commitdiff/ceae1ab
CVE: CVE-2012-2726
Published: 2012-06-27
Description: Cross-site scripting (XSS) vulnerability in the Protest module 6.x-1.x before 6.x-1.2 or 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer protest" permission to inject arbitrary web script or HTML via the protest_body parameter.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1618090; http://drupal.org/node/1618092; http://drupal.org/node/1619856
CVE: CVE-2012-2727
Published: 2012-06-27
Description: Open redirect vulnerability in the Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when synchronizing user data, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://drupal.org/node/1632702; http://drupal.org/node/1632704; http://drupal.org/node/1632734