deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-4016
Published: 2012-09-28
Description: The ATOK application before 1.0.4 for Android allows remote attackers to read the learning information file, and obtain sensitive input-string information, via a crafted application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN93344001/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000089; http://osvdb.org/85808
CVE: CVE-2012-4017
Published: 2012-09-28
Description: The jigbrowser+ application before 1.5.0 for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN86318665/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000091; http://osvdb.org/85819
CVE: CVE-2012-4051
Published: 2012-09-28
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in editAccount.html in the JAMF Software Server (JSS) interface in JAMF Casper Suite before 8.61 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts or (2) change passwords via a Save action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://infosec42.blogspot.com/2012/09/jamf-casper-suite-mdm-csrf-vulnerability.html; http://jamfsoftware.com/libraries/pdf/products/documentation/Casper_Suite_8.61_Release_Notes.pdf; http://www.kb.cert.org/vuls/id/555668
CVE: CVE-2012-4912
Published: 2012-09-28
Description: Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to inject arbitrary web script or HTML via a crafted signature in an HTML e-mail message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://download.novell.com/Download?buildid=O5hTjIiMdMo~; http://secunia.com/advisories/50622; http://www.novell.com/support/kb/doc.php?id=7010768
CVE: CVE-2012-5048
Published: 2012-09-28
Description: APIFTP Server in Optimalog Optima PLC 1.5.2 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/55712; http://www.us-cert.gov/control_systems/pdf/ICSA-12-271-02.pdf; http://www.securityfocus.com/bid/55712
CVE: CVE-2012-5049
Published: 2012-09-28
Description: APIFTP Server in Optimalog Optima PLC 1.5.2 and earlier allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/55712; http://www.us-cert.gov/control_systems/pdf/ICSA-12-271-02.pdf; http://www.securityfocus.com/bid/55712
CVE: CVE-2012-0956
Published: 2012-09-28
Description: ubiquity-slideshow-ubuntu before 58.2, during installation, allows remote man-in-the-middle attackers to execute arbitrary web script or HTML and read arbitrary files via a crafted attribute in the <a> tag of a Twitter feed.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://www.ubuntu.com/usn/USN-1561-1; https://bugs.launchpad.net/ubuntu/%2Bsource/ubiquity-slideshow-ubuntu/%2Bbug/991982; http://www.ubuntu.com/usn/USN-1561-1
CVE: CVE-2012-2145
Published: 2012-09-28
Description: Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2012-1269.html; http://rhn.redhat.com/errata/RHSA-2012-1277.html; http://secunia.com/advisories/50573
CVE: CVE-2012-2680
Published: 2012-09-28
Description: Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to (1) "web pages," (2) "export functionality," and (3) "image viewing."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=829421; http://rhn.redhat.com/errata/RHSA-2012-1278.html; http://rhn.redhat.com/errata/RHSA-2012-1281.html
CVE: CVE-2012-2681
Published: 2012-09-28
Description: Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, uses predictable random numbers to generate session keys, which makes it easier for remote attackers to guess the session key.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=827558; http://rhn.redhat.com/errata/RHSA-2012-1278.html; http://rhn.redhat.com/errata/RHSA-2012-1281.html
CVE: CVE-2012-2683
Published: 2012-09-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) "error message displays" or (2) "in source HTML on certain pages."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=830243; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092543.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092562.html
CVE: CVE-2012-2684
Published: 2012-09-28
Description: Multiple SQL injection vulnerabilities in the get_sample_filters_by_signature function in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to execute arbitrary SQL commands via the (1) agent or (2) object id.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=830245; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092543.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092562.html
CVE: CVE-2012-2685
Published: 2012-09-28
Description: Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to cause a denial of service (memory consumption) via a large size in an image request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=830248; http://rhn.redhat.com/errata/RHSA-2012-1278.html; http://rhn.redhat.com/errata/RHSA-2012-1281.html
CVE: CVE-2012-2734
Published: 2012-09-28
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to hijack the authentication of arbitrary users for requests that execute commands via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=832124; http://rhn.redhat.com/errata/RHSA-2012-1278.html; http://rhn.redhat.com/errata/RHSA-2012-1281.html
CVE: CVE-2012-2735
Published: 2012-09-28
Description: Session fixation vulnerability in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote attackers to hijack web sessions via a crafted session cookie.
CVSS Score: 4.9 (MEDIUM)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=832151; http://rhn.redhat.com/errata/RHSA-2012-1278.html; http://rhn.redhat.com/errata/RHSA-2012-1281.html
CVE: CVE-2012-3459
Published: 2012-09-28
Description: Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to modify Condor attributes and possibly gain privileges via crafted additional parameters in an HTTP POST request, which triggers a job attribute change request to Condor.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=846501; http://rhn.redhat.com/errata/RHSA-2012-1278.html; http://rhn.redhat.com/errata/RHSA-2012-1281.html
CVE: CVE-2012-3491
Published: 2012-09-28
Description: src/condor_schedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the permissions of jobs, which allows remote authenticated users to remove arbitrary idle jobs via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://condor-git.cs.wisc.edu/?p=condor.git%3Ba=commitdiff%3Bh=1fff5d40; http://research.cs.wisc.edu/condor/manual/v7.6/8_3Stable_Release.html; http://research.cs.wisc.edu/condor/manual/v7.8/9_3Stable_Release.html
CVE: CVE-2012-3492
Published: 2012-09-28
Description: The filesystem authentication (condor_io/condor_auth_fs.cpp) in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 uses authentication directories even when they have weak permissions, which allows remote attackers to impersonate users by renaming a user's authentication directory.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://condor-git.cs.wisc.edu/?p=condor.git%3Ba=commitdiff%3Bh=1db67805; http://research.cs.wisc.edu/condor/manual/v7.6/8_3Stable_Release.html; http://research.cs.wisc.edu/condor/manual/v7.8/9_3Stable_Release.html
CVE: CVE-2012-3493
Published: 2012-09-28
Description: The command_give_request_ad function in condor_startd.V6/command.cpp Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 allows remote attackers to obtain sensitive information, and possibly control or start arbitrary jobs, via a ClassAd request to the condor_startd port, which leaks the ClaimId.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: http://condor-git.cs.wisc.edu/?p=condor.git%3Ba=commitdiff%3Bh=d2f33972; http://research.cs.wisc.edu/condor/manual/v7.6/8_3Stable_Release.html; http://research.cs.wisc.edu/condor/manual/v7.8/9_3Stable_Release.html
CVE: CVE-2012-5196
Published: 2012-09-28
Description: Multiple buffer overflows in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://research.cs.wisc.edu/condor/manual/v7.6/8_3Stable_Release.html; http://research.cs.wisc.edu/condor/manual/v7.8/9_3Stable_Release.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/78975
CVE: CVE-2012-5197
Published: 2012-09-28
Description: Multiple unspecified vulnerabilities in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 have unknown impact and attack vectors related to "error checking of system calls."
CVSS Score: 10.0 (HIGH)
References: http://research.cs.wisc.edu/condor/manual/v7.6/8_3Stable_Release.html; http://research.cs.wisc.edu/condor/manual/v7.8/9_3Stable_Release.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/78974
CVE: CVE-2012-1833
Published: 2012-09-28
Description: VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/51113; http://support.springsource.com/security/cve-2012-1833; http://www.securityfocus.com/bid/55763
CVE: CVE-2012-4448
Published: 2012-09-28
Description: Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard_incoming_links edit action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://openwall.com/lists/oss-security/2012/09/25/15; http://packetstormsecurity.org/files/116785/WordPress-3.4.2-Cross-Site-Request-Forgery.html; http://secunia.com/advisories/50715
CVE: CVE-2011-4551
Published: 2012-10-01
Description: Cross-site scripting (XSS) vulnerability in tiki-cookie-jar.php in TikiWiki CMS/Groupware before 8.2 and LTS before 6.5 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://info.tiki.org/article183-Tiki-Wiki-CMS-Groupware-8-2-and-6-5LTS-Security-Patches-Available; http://secunia.com/advisories/47278; http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-07.txt
CVE: CVE-2012-1588
Published: 2012-10-01
Description: Algorithmic complexity vulnerability in the _filter_url function in the text filtering system (modules/filter/filter.module) in Drupal 7.x before 7.14 allows remote authenticated users with certain roles to cause a denial of service (CPU consumption) via a long email address.
CVSS Score: 3.5 (LOW)
CWE: CWE-399
References: http://drupal.org/drupal-7.14; http://drupal.org/node/1557938; http://drupal.org/node/1558468
CVE: CVE-2012-1590
Published: 2012-10-01
Description: The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/drupal-7.14; http://drupal.org/node/1302404; http://drupal.org/node/1557938
CVE: CVE-2012-1591
Published: 2012-10-01
Description: The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/drupal-7.14; http://drupal.org/node/1507988; http://drupal.org/node/1557938
CVE: CVE-2012-2153
Published: 2012-10-01
Description: Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/drupal-7.14; http://drupal.org/node/1557938; http://drupal.org/node/1558478
CVE: CVE-2012-2240
Published: 2012-10-01
Description: scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to "arguments to external commands."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/50600; http://www.debian.org/security/2012/dsa-2549; http://www.securityfocus.com/bid/55564
CVE: CVE-2012-2241
Published: 2012-10-01
Description: scripts/dget.pl in devscripts before 2.12.3 allows remote attackers to delete arbitrary files via a crafted (1) .dsc or (2) .changes file, probably related to a NULL byte in a filename.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git%3Ba=commitdiff%3Bh=0fd15bdec07b085f9ef438dacd18e159ac60b810; http://secunia.com/advisories/50600; http://www.debian.org/security/2012/dsa-2549
CVE: CVE-2012-2242
Published: 2012-10-01
Description: scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to "arguments to external commands" that are not properly escaped, a different vulnerability than CVE-2012-2240.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/50600; http://www.debian.org/security/2012/dsa-2549; http://www.securityfocus.com/bid/55564
CVE: CVE-2012-3500
Published: 2012-10-01
Description: scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.
CVSS Score: 1.2 (LOW)
CWE: CWE-362
References: http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git%3Ba=commit%3Bh=4d23a5e6c90f7a37b0972b30f5d31dce97a93eb0; http://git.fedorahosted.org/cgit/rpmdevtools.git/commit/?id=90b4400c2ab2e80cecfd8dfdf031536376ed2cdb; http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086138.html
CVE: CVE-2012-4429
Published: 2012-10-01
Description: Vino 2.28, 2.32, 3.4.2, and earlier allows remote attackers to read clipboard activity by listening on TCP port 5900.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2013-0169.html; http://secunia.com/advisories/50527; http://www.openwall.com/lists/oss-security/2012/09/13/25
CVE: CVE-2012-4415
Published: 2012-10-01
Description: Stack-based buffer overflow in the guac_client_plugin_open function in libguac in Guacamole before 0.6.3 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long protocol name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-09/0107.html; http://guac-dev.org/trac/changeset/7dcefa744b4a38825619c00ae8b47e5bae6e38c0/libguac; http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088031.html
CVE: CVE-2012-4427
Published: 2012-10-01
Description: The gnome-shell plugin 3.4.1 in GNOME allows remote attackers to force the download and installation of arbitrary extensions from extensions.gnome.org via a crafted web page.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2012/09/08/1; http://www.openwall.com/lists/oss-security/2012/09/13/19; http://www.openwall.com/lists/oss-security/2012/09/13/26
CVE: CVE-2012-4432
Published: 2012-10-01
Description: Use-after-free vulnerability in opngreduc.c in OptiPNG Hg and 0.7.x before 0.7.3 might allow remote attackers to execute arbitrary code via unspecified vectors related to "palette reduction."
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://optipng.hg.sourceforge.net/hgweb/optipng/optipng/rev/f1d5d44670a2; http://optipng.sourceforge.net/; http://secunia.com/advisories/50654
CVE: CVE-2012-4437
Published: 2012-10-01
Description: Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://advisories.mageia.org/MGASA-2014-0468.html; http://code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txt; http://code.google.com/p/smarty-php/source/detail?r=4658
CVE: CVE-2012-4450
Published: 2012-10-01
Description: 389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticated users with certain permissions to bypass ACL restrictions and access the DN entry.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://git.fedorahosted.org/cgit/389/ds.git/commit/?id=5beb93d42efb807838c09c5fab898876876f8d09; http://rhn.redhat.com/errata/RHSA-2013-0503.html; http://secunia.com/advisories/50713
CVE: CVE-2012-0748
Published: 2012-10-01
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified services in IBM Rational Team Concert (RTC) 4.x before 4.0.0.1 allow remote attackers to hijack the authentication of arbitrary users for requests that modify work items.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/50789; http://www-01.ibm.com/support/docview.wss?uid=swg21612356; http://www.securityfocus.com/bid/55730
CVE: CVE-2012-3035
Published: 2012-10-01
Description: Buffer overflow in Emerson DeltaV 9.3.1 and 10.3 through 11.3.1 allows remote attackers to cause a denial of service (daemon crash) via a long string to an unspecified port.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/55719; http://www.us-cert.gov/control_systems/pdf/ICSA-12-265-01.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/78972
CVE: CVE-2012-3319
Published: 2012-10-01
Description: IBM Rational Business Developer 8.x before 8.0.1.4 allows remote attackers to obtain potentially sensitive information via a connection to a web service created with the Rational Business Developer product.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/85867; http://www-01.ibm.com/support/docview.wss?uid=swg21612314; http://www.securityfocus.com/bid/55718
CVE: CVE-2012-4830
Published: 2012-10-01
Description: Unspecified vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11 and 7.0 through 7.0.0.6 allows remote attackers to obtain users' personal data via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/85868; http://www-01.ibm.com/support/docview.wss?uid=swg1SE53160; http://www-01.ibm.com/support/docview.wss?uid=swg21612484
CVE: CVE-2012-4833
Published: 2012-10-01
Description: fuser in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly restrict the -k option, which allows local users to kill arbitrary processes via a crafted command line.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/fuser_advisory.asc; http://secunia.com/advisories/50708; http://www.ibm.com/support/docview.wss?uid=isg1IV28151
CVE: CVE-2011-5202
Published: 2012-10-01
Description: BazisVirtualCDBus.sys in WinCDEmu 3.6 allows local users to cause a denial of service (system crash) via the unmount command to batchmnt.exe.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://forum.sysprogs.org/viewtopic.php?f=3&t=1418; http://secunia.com/advisories/47760; http://www.securityfocus.com/bid/51658
CVE: CVE-2012-1576
Published: 2012-10-01
Description: The myuser_delete function in libathemecore/account.c in Atheme 5.x before 5.2.7, 6.x before 6.0.10, and 7.x before 7.0.0-beta2 does not properly clean up CertFP entries when a user is deleted, which allows remote attackers to access a different user account or cause a denial of service (daemon crash) via a login as a deleted user.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-03/0248.html; http://git.atheme.org/atheme/commit/?id=3d9551761db2; http://jira.atheme.org/browse/SRV-166
CVE: CVE-2012-1639
Published: 2012-10-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in product/commerce_product.module in the Drupal Commerce module for Drupal before 7.x-1.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) sku or (2) title parameters.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1416824; http://drupalcode.org/project/commerce.git/blobdiff/45bc53875f1675750afe60e709a34c95e3008366..b74cdcd:/modules/product/commerce_product.module; http://osvdb.org/78528
CVE: CVE-2012-1897
Published: 2012-10-01
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Wolf CMS 0.75 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete users via the user id number to admin/user/delete; (2) delete pages via the page id number to admin/page/delete; delete the (3) images or (4) themes directory via the directory name to admin/plugin/file_manager/delete, and possibly other directories; or (5) logout the user via a request to admin/login/logout.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.org/files/111116/Wolfcms-0.75-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://secunia.com/advisories/48520; http://www.webapp-security.com/2012/03/wolfcms/
CVE: CVE-2012-1898
Published: 2012-10-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in wolfcms/admin/user/add in Wolf CMS 0.75 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user[name], (2) user[email], or (3) user[username] parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/111116/Wolfcms-0.75-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://www.webapp-security.com/2012/03/wolfcms/; http://www.webapp-security.com/wp-content/uploads/2012/03/Wolfcms-0.75-Multiple-Vulnerabilities-CSRF-XSS.txt