deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-4029
Published: 2012-07-03
Description: The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://cgit.freedesktop.org/xorg/xserver/commit/?id=b67581cf825940fdf52bf2e0af4330e695d724a4; http://lists.freedesktop.org/archives/xorg/2011-October/053680.html; http://rhn.redhat.com/errata/RHSA-2012-0939.html
CVE: CVE-2012-0876
Published: 2012-07-03
Description: The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: http://bugs.python.org/issue13703#msg151870; http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html
CVE: CVE-2012-1147
Published: 2012-07-03
Description: readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor consumption) via a large number of crafted XML files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://expat.cvs.sourceforge.net/viewvc/expat/expat/xmlwf/readfilemap.c?r1=1.14&r2=1.15; http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html; http://sourceforge.net/projects/expat/files/expat/2.1.0/
CVE: CVE-2012-1148
Published: 2012-07-03
Description: Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.166&r2=1.167; http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html; http://rhn.redhat.com/errata/RHSA-2012-0731.html
CVE: CVE-2012-2214
Published: 2012-07-03
Description: proxy.c in libpurple in Pidgin before 2.10.4 does not properly handle canceled SOCKS5 connection attempts, which allows user-assisted remote authenticated users to cause a denial of service (application crash) via a sequence of XMPP file-transfer requests.
CVSS Score: 3.5 (LOW)
CWE: CWE-399
References: http://hg.pidgin.im/pidgin/main/rev/5f9d676cefdb; http://pidgin.im/news/security/?id=62; http://www.mandriva.com/security/advisories?name=MDVSA-2012:082
CVE: CVE-2012-2318
Published: 2012-07-03
Description: msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service (application crash) by placing these characters in a text/plain message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://hg.pidgin.im/pidgin/main/rev/4d6bcb4f4ea4; http://pidgin.im/news/security/?id=63; http://rhn.redhat.com/errata/RHSA-2012-1102.html
CVE: CVE-2012-2747
Published: 2012-07-03
Description: Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to gain privileges via unknown attack vectors related to "Inadequate checking."
CVSS Score: 7.5 (HIGH)
References: http://developer.joomla.org/security/news/[PII_REDACTED]1-core-privilege-escalation; http://osvdb.org/83070; http://secunia.com/advisories/49605
CVE: CVE-2012-2748
Published: 2012-07-03
Description: Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to obtain sensitive information via vectors related to "Inadequate filtering" and a "SQL error."
CVSS Score: 5.0 (MEDIUM)
References: http://developer.joomla.org/security/news/[PII_REDACTED]2-core-information-disclosure; http://osvdb.org/83069; http://secunia.com/advisories/49605
CVE: CVE-2012-3811
Published: 2012-07-03
Description: Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before 8.0.9.13 Q1 2012 Maintenance Release allows remote attackers to execute arbitrary code by uploading an executable file and then accessing it via a direct request.
CVSS Score: 10.0 (HIGH)
References: http://zerodayinitiative.com/advisories/ZDI-12-106/; https://downloads.avaya.com/css/P8/documents/100164021; http://zerodayinitiative.com/advisories/ZDI-12-106/
CVE: CVE-2011-5096
Published: 2012-07-03
Description: Stack-based buffer overflow in cstore.exe in the Media Application Server (MAS) in Avaya Aura Application Server 5300 (formerly Nortel Media Application Server) 1.x before 1.0.2 and 2.0 before Patch Bundle 10 allows remote attackers to execute arbitrary code via a crafted cs_anams parameter in a CONTENT_STORE_ADMIN_REQ packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://zerodayinitiative.com/advisories/ZDI-11-260/; https://downloads.avaya.com/css/P8/documents/100146108; http://zerodayinitiative.com/advisories/ZDI-11-260/
CVE: CVE-2012-2181
Published: 2012-07-03
Description: Directory traversal vulnerability in the Dojo module in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF14, and 8.0, allows remote attackers to read arbitrary files via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.ibm.com/support/docview.wss?uid=swg1PM64172; http://www.ibm.com/support/docview.wss?uid=swg21598363; https://exchange.xforce.ibmcloud.com/vulnerabilities/75584
CVE: CVE-2012-3368
Published: 2012-07-03
Description: Integer signedness error in attach.c in dtach 0.8 allows remote attackers to obtain sensitive information from daemon stack memory in opportunistic circumstances by reading application data after an improper connection-close request, as demonstrated by running an IRC client in dtach.
CVSS Score: 2.6 (LOW)
CWE: CWE-189
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=625302; http://sourceforge.net/tracker/?func=detail&aid=3517812&group_id=36489&atid=417357; http://sourceforge.net/tracker/download.php?group_id=36489&atid=417357&file_id=441195&aid=3517812
CVE: CVE-2012-2314
Published: 2012-07-03
Description: The bootloader configuration module (pyanaconda/bootloader.py) in Anaconda uses 755 permissions for /etc/grub.d, which allows local users to obtain password hashes and conduct brute force password guessing attacks.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://git.fedorahosted.org/git/?p=anaconda.git%3Ba=commit%3Bh=03ef13b625cc06873a924e0610340f8489fd92df; http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080188.html; http://www.openwall.com/lists/oss-security/2012/05/04/10
CVE: CVE-2012-3828
Published: 2012-07-03
Description: Cross-site scripting (XSS) vulnerability in Joomla! 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the Host HTTP Header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112249/Joomla-2.5.3-Host-Header-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/53277; https://exchange.xforce.ibmcloud.com/vulnerabilities/75223
CVE: CVE-2012-3829
Published: 2012-07-03
Description: Joomla! 2.5.3 allows remote attackers to obtain the installation path via the Host HTTP Header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.org/files/112249/Joomla-2.5.3-Host-Header-Cross-Site-Scripting.html; http://packetstormsecurity.org/files/112249/Joomla-2.5.3-Host-Header-Cross-Site-Scripting.html
CVE: CVE-2012-3830
Published: 2012-07-03
Description: Cross-site scripting (XSS) vulnerability in decoda/templates/video.php in Decoda before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via the video directive.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/81637; http://secunia.com/advisories/48931; http://www.redteam-pentesting.de/en/advisories/rt-sa-2012-002/-php-decoda-cross-site-scripting-in-video-tags
CVE: CVE-2012-3831
Published: 2012-07-03
Description: Cross-site scripting (XSS) vulnerability in decoda/templates/video.php in Decoda before 3.3.1 allows remote attackers to inject arbitrary web script or HTML via multiple URLs in an img tag.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/81637; https://github.com/milesj/php-decoda/commit/104afad9d3cb1fbb766c4bc5b98e070a8a13fbd8; http://osvdb.org/81637
CVE: CVE-2012-3832
Published: 2012-07-03
Description: Cross-site scripting (XSS) vulnerability in decoda/Decoda.php in Decoda before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to (1) b or (2) div tags.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/milesj/php-decoda/commit/6f2b9fb48bc110edeab17459038feb2627d52320; https://github.com/milesj/php-decoda/commit/6f2b9fb48bc110edeab17459038feb2627d52320
CVE: CVE-2012-3833
Published: 2012-07-03
Description: Cross-site scripting (XSS) vulnerability in the default index page in admin/ in Quick.CMS 4.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hauntit.blogspot.com/2012/03/en-quickcmsv40-xss-over-get.html; http://packetstormsecurity.org/files/112243/Quick.CMS-4.0-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/53273
CVE: CVE-2012-3834
Published: 2012-07-03
Description: SQL injection vulnerability in forensics/base_qry_main.php in AlienVault Open Source Security Information Management (OSSIM) 3.1 allows remote authenticated users to execute arbitrary SQL commands via the time[0][0] parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/49005; http://www.darksecurity.de/index.php?/211-KORAMIS-ADV2012-002-Alienvault-OSSIM-Open-Source-SIEM-3.1-Multiple-security-vulnerabilities.html; http://www.exploit-db.com/exploits/18800
CVE: CVE-2012-3835
Published: 2012-07-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to top.php or (2) time[0][0] parameter to forensics/base_qry_main.php, which is not properly handled in an error page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49005; http://www.darksecurity.de/index.php?/211-KORAMIS-ADV2012-002-Alienvault-OSSIM-Open-Source-SIEM-3.1-Multiple-security-vulnerabilities.html; http://www.exploit-db.com/exploits/18800
CVE: CVE-2012-3836
Published: 2012-07-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) groupname parameter in a savecategory in the users module; (2) virtual_filename, (3) branch, (4) contact_person, (5) street, (6) city, (7) province, (8) postal, (9) country, (10) tollfree, (11) phone, (12) fax, or (13) mobile parameter in a saveitem action in the contacts module; (14) title parameter in a savecategory action in the menus module; (15) firstname or (16) lastname in a saveitem action in the users module; (17) meta_key or (18) meta_description in a saveitem action in the blog module; or (19) the PATH_INFO to admin/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49023; http://www.babygekko.com/site/news/general/baby-gekko-v1-2-0-released-with-3rd-party-independent-security-testing-performed-by-zero-science-lab.html; http://www.exploit-db.com/exploits/18827
CVE: CVE-2012-3837
Published: 2012-07-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) email_address, (3) password, (4) password_verify, (5) firstname, (6) lastname, or (7) verification_code parameter to users/action/register.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49052; http://www.babygekko.com/site/news/general/baby-gekko-v1-2-0-released-with-3rd-party-independent-security-testing-performed-by-zero-science-lab.html; http://www.exploit-db.com/exploits/18827
CVE: CVE-2012-3838
Published: 2012-07-03
Description: Gekko before 1.2.0 allows remote attackers to obtain the installation path via a direct request to (1) admin/templates/babygekko/index.php or (2) templates/html5demo/index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.babygekko.com/site/news/general/baby-gekko-v1-2-0-released-with-3rd-party-independent-security-testing-performed-by-zero-science-lab.html; http://www.exploit-db.com/exploits/18827; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5086.php
CVE: CVE-2012-3839
Published: 2012-07-03
Description: Multiple SQL injection vulnerabilities in application/core/MY_Model.php in MyClientBase 0.12 allow remote attackers to execute arbitrary SQL commands via the (1) invoice_number or (2) tags parameter to index.php/invoice_search.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://myclientbase.com/; http://secunia.com/advisories/48961; http://www.exploit-db.com/exploits/18814
CVE: CVE-2012-3840
Published: 2012-07-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php/users/form/user_id in MyClientBase 0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name or (2) last_name parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48961; http://www.exploit-db.com/exploits/18814; http://www.securityfocus.com/bid/53311
CVE: CVE-2012-3841
Published: 2012-07-03
Description: Untrusted search path vulnerability in KMPlayer 3.2.0.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ehtrace.dll that is located in the current working directory.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/81558; http://packetstormsecurity.org/files/112218/KMPlayer-3.2.0.19-DLL-Hijack.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/75193
CVE: CVE-2012-3842
Published: 2012-07-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the (1) select0 or (2) select8 parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0214.html; http://www.securityfocus.com/bid/53281; http://www.vulnerability-lab.com/get_content.php?id=509
CVE: CVE-2012-3843
Published: 2012-07-03
Description: Cross-site scripting (XSS) vulnerability in the registration page in e107, probably 1.0.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hauntit.blogspot.com/2012/04/en-e107-cms-reflected-xss-in.html; http://packetstormsecurity.org/files/112241/e107-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/53271
CVE: CVE-2012-3844
Published: 2012-07-03
Description: Cross-site scripting (XSS) vulnerability in vBulletin 4.1.12 allows remote attackers to inject arbitrary web script or HTML via a long string in the subject parameter when creating a post.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hauntit.blogspot.com/2012/04/en-vbulletin-4112-cross-site-scripting.html; http://packetstormsecurity.org/files/112385/vBulletin-4.1.12-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/53319
CVE: CVE-2012-3845
Published: 2012-07-03
Description: Buffer overflow in LAN Messenger 1.2.28 and earlier allows remote attackers to cause a denial of service (crash) via a long string in an initiation request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-05/0005.html; http://www.exploit-db.com/exploits/18816; http://www.securityfocus.com/bid/53333
CVE: CVE-2012-3846
Published: 2012-07-03
Description: Cross-site scripting (XSS) vulnerability in index.php in PHP-pastebin 2.1 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/112375/PHP-Pastebin-Cross-Site-Scripting.html; http://secunia.com/advisories/49025; http://www.osvdb.org/81661
CVE: CVE-2012-1830
Published: 2012-07-05
Description: Stack-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf; http://www.wellintech.com/index.php/news/33-patch-for-kingview653; http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf
CVE: CVE-2012-1831
Published: 2012-07-05
Description: Heap-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf; http://www.wellintech.com/index.php/news/33-patch-for-kingview653; http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf
CVE: CVE-2012-1832
Published: 2012-07-05
Description: WellinTech KingView 6.53 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted packet to (1) TCP or (2) UDP port 2001.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf; http://www.wellintech.com/index.php/news/33-patch-for-kingview653; http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf
CVE: CVE-2012-2515
Published: 2012-07-05
Description: Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HTML Help component), as used in EMC Documentum ApplicationXtender Desktop 5.4; EMC Captiva Quickscan Pro 4.6 SP1; GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; GE Intelligent Platforms Proficy HMI/SCADA iFIX 5.0 and 5.1; GE Intelligent Platforms Proficy Pulse 1.0; GE Intelligent Platforms Proficy Batch Execution 5.6; GE Intelligent Platforms SI7 I/O Driver 7.20 through 7.42; and other products, allow remote attackers to execute arbitrary code via a long string in the second argument to the (1) JumpMappedID or (2) JumpURL method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://retrogod.altervista.org/9sg_emc_keyhelp.html; http://secunia.com/advisories/36905; http://secunia.com/advisories/36914
CVE: CVE-2012-2516
Published: 2012-07-05
Description: An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other products, allows remote attackers to execute arbitrary commands via crafted input, related to a "command injection vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/14000/KB14863/en_US/GEIP12-04%20Security%20Advisory%20-%20Proficy%20HTML%20Help.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-131-02.pdf; http://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/14000/KB14863/en_US/GEIP12-04%20Security%20Advisory%20-%20Proficy%20HTML%20Help.pdf
CVE: CVE-2012-2559
Published: 2012-07-05
Description: WellinTech KingHistorian 3.0 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer write) via a crafted packet to TCP port 5678.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf
CVE: CVE-2012-2560
Published: 2012-07-05
Description: Directory traversal vulnerability in WellinTech KingView 6.53 allows remote attackers to read arbitrary files via a crafted HTTP request to port 8001.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf; http://www.wellintech.com/index.php/news/33-patch-for-kingview653; http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf
CVE: CVE-2012-3007
Published: 2012-07-05
Description: Stack-based buffer overflow in slssvc.exe before 58.x in Invensys Wonderware SuiteLink in the Invensys System Platform software suite, as used in InTouch/Wonderware Application Server IT before 10.5 and WAS before 3.5, DASABCIP before 4.1 SP2, DASSiDirect before 3.0, DAServer Runtime Components before 3.0 SP2, and other products, allows remote attackers to cause a denial of service (daemon crash or hang) via a long Unicode string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/49173; http://www.securityfocus.com/bid/53563; http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf
CVE: CVE-2012-3847
Published: 2012-07-05
Description: slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 allows remote attackers to cause a denial of service (resource consumption) via a long Unicode string, a different vulnerability than CVE-2012-3007.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/49173; http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf; http://secunia.com/advisories/49173
CVE: CVE-2012-0410
Published: 2012-07-05
Description: Directory traversal vulnerability in WebAccess in Novell GroupWise before 8.03 allows remote attackers to read arbitrary files via the User.interface parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.novell.com/support/kb/doc.php?id=7000708; http://www.securitytracker.com/id?1027217; https://bugzilla.novell.com/show_bug.cgi?id=712163
CVE: CVE-2012-2143
Published: 2012-07-05
Description: The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aab49e934de1fff046e659cbec46e3d053b41c34; http://git.postgresql.org/gitweb/?p=postgresql.git&a=commit&h=932ded2ed51e8333852e370c7a6dad75d9f236f9; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
CVE: CVE-2012-2281
Published: 2012-07-05
Description: EMC RSA Access Manager Server 6.x before 6.1 SP4 and RSA Access Manager Agent do not properly validate session tokens after a logout, which might allow remote attackers to conduct replay attacks via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2012-07/0037.html; http://www.securitytracker.com/id?1027220; http://archives.neohapsis.com/archives/bugtraq/2012-07/0037.html
CVE: CVE-2012-0300
Published: 2012-07-05
Description: Brightmail Control Center in Symantec Message Filter 6.3 does not properly restrict establishment of sessions to the listening port, which allows remote attackers to obtain potentially sensitive version information via unspecified vectors.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://www.securityfocus.com/bid/54136; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120626_00; http://www.securityfocus.com/bid/54136