deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-1423
Published: 2011-05-05
Description: Cross-site scripting (XSS) vulnerability in RSA Data Loss Prevention (DLP) Enterprise Manager 8.x before 8.5 SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/8242; http://www.securityfocus.com/archive/1/517763/100/0/threaded; http://www.securityfocus.com/bid/47642
CVE: CVE-2011-1825
Published: 2011-05-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Administrative Console in CA Arcot WebFort Versatile Authentication Server (VAS) before 6.2.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/72124; http://secunia.com/advisories/44317; http://www.securityfocus.com/archive/1/517702/100/0/threaded
CVE: CVE-2011-1826
Published: 2011-05-05
Description: Open redirect vulnerability in the Administrative Console in CA Arcot WebFort Versatile Authentication Server (VAS) before 6.2.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/72125; http://secunia.com/advisories/44317; http://www.securityfocus.com/archive/1/517702/100/0/threaded
CVE: CVE-2011-1901
Published: 2011-05-05
Description: The mail-filter web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers to bypass authentication via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.clearskies.net/documents/css-advisory-css1105-proofpoint.php; http://www.kb.cert.org/vuls/id/790980; https://support.proofpoint.com/article.cgi?article_id=338413
CVE: CVE-2011-1902
Published: 2011-05-05
Description: Directory traversal vulnerability in the web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.clearskies.net/documents/css-advisory-css1105-proofpoint.php; http://www.kb.cert.org/vuls/id/790980; https://support.proofpoint.com/article.cgi?article_id=338413
CVE: CVE-2011-1903
Published: 2011-05-05
Description: SQL injection vulnerability in an unspecified function in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.clearskies.net/documents/css-advisory-css1105-proofpoint.php; http://www.kb.cert.org/vuls/id/790980; https://support.proofpoint.com/article.cgi?article_id=338413
CVE: CVE-2011-1904
Published: 2011-05-05
Description: An unspecified function in the web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers to execute arbitrary commands via unknown vectors, related to a "command injection" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://www.clearskies.net/documents/css-advisory-css1105-proofpoint.php; http://www.kb.cert.org/vuls/id/790980; https://support.proofpoint.com/article.cgi?article_id=338413
CVE: CVE-2011-1905
Published: 2011-05-05
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified administrative modules in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allow remote attackers to hijack the authentication of administrators via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.clearskies.net/documents/css-advisory-css1105-proofpoint.php; http://www.kb.cert.org/vuls/id/790980; https://support.proofpoint.com/article.cgi?article_id=338413
CVE: CVE-2011-1906
Published: 2011-05-05
Description: Trustwave WebDefend Enterprise before 5.0 7.01.903-1.4 stores specific user-account credentials in a MySQL database, which makes it easier for remote attackers to read the event collection table via requests to the management port, a different vulnerability than CVE-2011-0756.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://securitytracker.com/id?1025447; https://www.trustwave.com/spiderlabs/advisories/TWSL2011-001.txt; http://securitytracker.com/id?1025447
CVE: CVE-2011-1501
Published: 2011-05-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-1571.  Reason: This candidate is a duplicate of CVE-2011-1571.  Notes: All CVE users should reference CVE-2011-1571 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-0065
Published: 2011-05-07
Description: Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, allows remote attackers to execute arbitrary code via vectors related to OBJECT's mChannel.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://downloads.avaya.com/css/P8/documents/100144158; http://securityreason.com/securityalert/8326; http://securityreason.com/securityalert/8331
CVE: CVE-2011-0066
Published: 2011-05-07
Description: Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, allows remote attackers to execute arbitrary code via vectors related to OBJECT's mObserverList.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://downloads.avaya.com/css/P8/documents/100144158; http://www.debian.org/security/2011/dsa-2227; http://www.debian.org/security/2011/dsa-2228
CVE: CVE-2011-0067
Published: 2011-05-07
Description: Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, does not properly implement autocompletion for forms, which allows remote attackers to read form history entries via a Java applet that spoofs interaction with the autocomplete controls.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://downloads.avaya.com/css/P8/documents/100144158; http://www.debian.org/security/2011/dsa-2227; http://www.debian.org/security/2011/dsa-2228
CVE: CVE-2011-0069
Published: 2011-05-07
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19, 3.6.x before 3.6.17, and 4.x before 4.0.1; Thunderbird before 3.1.10; and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-0070.
CVSS Score: 10.0 (HIGH)
References: http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_thunderbird; http://downloads.avaya.com/css/P8/documents/100144158; http://www.debian.org/security/2011/dsa-2227
CVE: CVE-2011-0070
Published: 2011-05-07
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19, 3.6.x before 3.6.17, and 4.x before 4.0.1; Thunderbird before 3.1.10; and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-0069.
CVSS Score: 10.0 (HIGH)
References: http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_thunderbird; http://downloads.avaya.com/css/P8/documents/100144158; http://www.debian.org/security/2011/dsa-2227
CVE: CVE-2011-0071
Published: 2011-05-07
Description: Directory traversal vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 on Windows allows remote attackers to determine the existence of arbitrary files, and possibly load resources, via vectors involving a resource: URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://downloads.avaya.com/css/P8/documents/100144158; http://www.debian.org/security/2011/dsa-2227; http://www.debian.org/security/2011/dsa-2228
CVE: CVE-2011-0072
Published: 2011-05-07
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-0074, CVE-2011-0075, CVE-2011-0077, and CVE-2011-0078.
CVSS Score: 10.0 (HIGH)
References: http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_thunderbird; http://downloads.avaya.com/css/P8/documents/100134543; http://downloads.avaya.com/css/P8/documents/100144158
CVE: CVE-2011-0073
Published: 2011-05-07
Description: Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, does not properly use nsTreeRange data structures, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a "dangling pointer."
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://downloads.avaya.com/css/P8/documents/100134543; http://downloads.avaya.com/css/P8/documents/100144158; http://securityreason.com/securityalert/8310
CVE: CVE-2011-0074
Published: 2011-05-07
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-0072, CVE-2011-0075, CVE-2011-0077, and CVE-2011-0078.
CVSS Score: 10.0 (HIGH)
References: http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_thunderbird; http://downloads.avaya.com/css/P8/documents/100134543; http://downloads.avaya.com/css/P8/documents/100144158
CVE: CVE-2011-0075
Published: 2011-05-07
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-0072, CVE-2011-0074, CVE-2011-0077, and CVE-2011-0078.
CVSS Score: 10.0 (HIGH)
References: http://downloads.avaya.com/css/P8/documents/100134543; http://downloads.avaya.com/css/P8/documents/100144158; http://www.debian.org/security/2011/dsa-2227
CVE: CVE-2011-0076
Published: 2011-05-07
Description: Unspecified vulnerability in the Java Embedding Plugin (JEP) in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, on Mac OS X allows remote attackers to bypass intended access restrictions via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.mandriva.com/security/advisories?name=MDVSA-2011:079; http://www.mozilla.org/security/announce/2011/mfsa2011-15.html; https://bugzilla.mozilla.org/show_bug.cgi?id=634724
CVE: CVE-2011-0077
Published: 2011-05-07
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-0072, CVE-2011-0074, CVE-2011-0075, and CVE-2011-0078.
CVSS Score: 10.0 (HIGH)
References: http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_thunderbird; http://downloads.avaya.com/css/P8/documents/100134543; http://downloads.avaya.com/css/P8/documents/100144158
CVE: CVE-2011-0078
Published: 2011-05-07
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-0072, CVE-2011-0074, CVE-2011-0075, and CVE-2011-0077.
CVSS Score: 10.0 (HIGH)
References: http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_thunderbird; http://downloads.avaya.com/css/P8/documents/100134543; http://downloads.avaya.com/css/P8/documents/100144158
CVE: CVE-2011-0079
Published: 2011-05-07
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x before 4.0.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to gfx/layers/d3d10/ReadbackManagerD3D10.cpp and unknown other vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.mozilla.org/security/announce/2011/mfsa2011-12.html; https://bugzilla.mozilla.org/show_bug.cgi?id=601102; https://bugzilla.mozilla.org/show_bug.cgi?id=639343
CVE: CVE-2011-0080
Published: 2011-05-07
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_thunderbird; http://downloads.avaya.com/css/P8/documents/100134543; http://downloads.avaya.com/css/P8/documents/100144158
CVE: CVE-2011-0081
Published: 2011-05-07
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.6.x before 3.6.17 and 4.x before 4.0.1, and Thunderbird 3.1.x before 3.1.10, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_thunderbird; http://downloads.avaya.com/css/P8/documents/100144158; http://www.debian.org/security/2011/dsa-2227
CVE: CVE-2011-1502
Published: 2011-05-07
Description: Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://issues.liferay.com/browse/LPS-14927; http://openwall.com/lists/oss-security/2011/03/29/1; http://openwall.com/lists/oss-security/2011/04/08/5
CVE: CVE-2011-1503
Published: 2011-05-07
Description: The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://issues.liferay.com/browse/LPS-13762; http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952; http://openwall.com/lists/oss-security/2011/03/29/1
CVE: CVE-2011-1504
Published: 2011-05-07
Description: Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA allows remote authenticated users to inject arbitrary web script or HTML via a blog title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://issues.liferay.com/browse/LPS-11506; http://issues.liferay.com/browse/LPS-12145; http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952
CVE: CVE-2011-1570
Published: 2011-05-07
Description: Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://issues.liferay.com/browse/LPS-12628; http://issues.liferay.com/browse/LPS-13250; http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952
CVE: CVE-2011-1571
Published: 2011-05-07
Description: Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://issues.liferay.com/browse/LPS-14726; http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952; http://openwall.com/lists/oss-security/2011/03/29/1
CVE: CVE-2011-1728
Published: 2011-05-07
Description: Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed EXEC_BAR message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02810240; http://osvdb.org/72187; http://secunia.com/advisories/44402
CVE: CVE-2011-1729
Published: 2011-05-07
Description: Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed GET_FILE message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02810240; http://osvdb.org/72188; http://secunia.com/advisories/44402
CVE: CVE-2011-1730
Published: 2011-05-07
Description: Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed EXEC_SCRIPT message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02810240; http://osvdb.org/72189; http://secunia.com/advisories/44402
CVE: CVE-2011-1731
Published: 2011-05-07
Description: Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed EXEC_INTEGUTIL message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02810240; http://osvdb.org/72190; http://secunia.com/advisories/44402
CVE: CVE-2011-1732
Published: 2011-05-07
Description: Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed stutil message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02810240; http://osvdb.org/72191; http://secunia.com/advisories/44402
CVE: CVE-2011-1733
Published: 2011-05-07
Description: Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed HPFGConfig message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02810240; http://osvdb.org/72192; http://secunia.com/advisories/44402
CVE: CVE-2011-1734
Published: 2011-05-07
Description: Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed omniiaputil message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02810240; http://osvdb.org/72193; http://secunia.com/advisories/44402
CVE: CVE-2011-1735
Published: 2011-05-07
Description: Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed bm message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02810240; http://osvdb.org/72194; http://secunia.com/advisories/44402
CVE: CVE-2011-1736
Published: 2011-05-07
Description: Directory traversal vulnerability in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to read arbitrary files via directory traversal sequences in a filename in a GET_FILE message.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02810240; http://osvdb.org/72195; http://secunia.com/advisories/44402
CVE: CVE-2011-1013
Published: 2011-05-09
Description: Integer signedness error in the drm_modeset_ctl function in (1) drivers/gpu/drm/drm_irq.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.38 and (2) sys/dev/pci/drm/drm_irq.c in the kernel in OpenBSD before 4.9 allows local users to trigger out-of-bounds write operations, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via a crafted num_crtcs (aka vb_num) structure member in an ioctl argument.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=[PII_REDACTED]ddd[PII_REDACTED]6d92ba4a802bc658f; http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.38; http://www.openbsd.org/cgi-bin/cvsweb/src/sys/dev/pci/drm/drm_irq.c
CVE: CVE-2011-1090
Published: 2011-05-09
Description: The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a denial of service (panic) via a crafted attempt to set an ACL.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9e3d724e2145f5039b423c290ce2b2c3d8f94bc; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html; http://openwall.com/lists/oss-security/2011/03/07/12
CVE: CVE-2011-1323
Published: 2011-05-09
Description: Yamaha RTX, RT, SRT, RTV, RTW, and RTA series routers with firmware 6.x through 10.x, and NEC IP38X series routers with firmware 6.x through 10.x, do not properly handle IP header options, which allows remote attackers to cause a denial of service (device reboot) via a crafted option that triggers access to an invalid memory location.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN55714408/index.html; http://www.nec.co.jp/security-info/secinfo/nv11-004.html; http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN55714408.html
CVE: CVE-2011-1324
Published: 2011-05-09
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHR-4RV and FS-G54 routers with firmware 2.x; and AS-100 routers allow remote attackers to hijack the authentication of administrators for requests that modify settings, as demonstrated by changing the login password.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://buffalo.jp/support_s/20080808/csrf.html; http://jvn.jp/en/jp/JVN50505257/index.html; http://buffalo.jp/support_s/20080808/csrf.html