deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-10199
Published: 2018-04-18
Description: In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilialize_copy(). An attacker that can cause Ruby code to be run can possibly use this to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/mruby/mruby/commit/b51b21fc63c[PII_REDACTED]551387d9036f2b63433; https://github.com/mruby/mruby/issues/4001; https://github.com/mruby/mruby/commit/b51b21fc63c[PII_REDACTED]551387d9036f2b63433
CVE: CVE-2018-6413
Published: 2018-04-18
Description: There is a buffer overflow in the Hikvision Camera DS-2CD9111-S of V4.1.2 build 160203 and before, and this vulnerability allows remote attackers to launch a denial of service attack (service interruption) via a crafted network setting interface request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www1.hikvision.com/cn/support_det_591_i514.html; http://www1.hikvision.com/cn/support_det_591_i514.html
CVE: CVE-2016-2169
Published: 2018-04-18
Description: Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw. An application developer may create an application with a route that conflicts with a platform service route and receive traffic intended for the service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-17
References: https://github.com/cloudfoundry/cloud_controller_ng/issues/568; https://github.com/cloudfoundry/cloud_controller_ng/issues/568
CVE: CVE-2016-8220
Published: 2018-04-18
Description: Pivotal Gemfire for PCF, versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0, contain an information disclosure vulnerability. The application inadvertently exposed WAN replication credentials at a public route.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://docs.pivotal.io/gemfire-cf/relnotes.html; https://docs.pivotal.io/gemfire-cf/relnotes.html
CVE: CVE-2018-1088
Published: 2018-04-18
Description: A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.
CVSS Score: 8.1 (HIGH)
CWE: CWE-266
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html; https://access.redhat.com/errata/RHSA-2018:1136; https://access.redhat.com/errata/RHSA-2018:1137
CVE: CVE-2018-1240
Published: 2018-04-18
Description: Dell EMC ViPR Controller, versions after 3.0.0.38, contain an information exposure vulnerability in the VRRP. VRRP defaults to an insecure configuration in Linux's keepalived component which sends the cluster password in plaintext through multicast. A malicious user, having access to the vCloud subnet where ViPR is deployed, could potentially sniff the password and use it to take over the cluster's virtual IP and cause a denial of service on that ViPR Controller system.
CVSS Score: 8.0 (HIGH)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2018/Apr/29; http://seclists.org/fulldisclosure/2018/Apr/29
CVE: CVE-2018-1274
Published: 2018-04-18
Description: Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://www.securityfocus.com/bid/103769; https://pivotal.io/security/cve-2018-1274; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2018-8831
Published: 2018-04-18
Description: A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2018/Apr/36; https://trac.kodi.tv/ticket/17814; https://www.exploit-db.com/exploits/44487/
CVE: CVE-2[PII_REDACTED]
Published: 2018-04-18
Description: cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line "$url = $config['admin_url'] . '/login.php?recoverme=' . $code;" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://dev.cmsmadesimple.org/bug/view/11762; http://dev.cmsmadesimple.org/bug/view/11762
CVE: CVE-2[PII_REDACTED]
Published: 2018-04-18
Description: tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ct_check_cbc_mac_and_pad(); line "end_pos = data_len - 1 - mac.digest_size" that can result in an attacker manipulating the TLS ciphertext which will not be detected by receiving tlslite-ng. This attack appears to be exploitable via man in the middle on a network connection. This vulnerability appears to have been fixed after commit 3674815d1b0f[PII_REDACTED]e2737a352e0a6a93d8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-354
References: https://github.com/tomato42/tlslite-ng/pull/234; https://github.com/tomato42/tlslite-ng/pull/234
CVE: CVE-2[PII_REDACTED]
Published: 2018-04-18
Description: RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in isXss() function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of XSS strings(26) detailed in the GitHub issue #16.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://embed.plnkr.co/xHbhB29JWWyMUMeHsLrm; https://github.com/RisingStack/protect/blob/60b0c91e86686d34e5202419ce9ae7e8dc08edcd/lib/rules/xss.js#L4-L13; https://github.com/RisingStack/protect/issues/16
CVE: CVE-2[PII_REDACTED]
Published: 2018-04-18
Description: nmap version 6.49BETA6 through 7.60, up to and including SVN revision 37147 contains a Directory Traversal vulnerability in NSE script http-fetch that can result in file overwrite as the user is running it. This attack appears to be exploitable via a victim that runs NSE script http-fetch against a malicious web site. This vulnerability appears to have been fixed in 7.7.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-22
References: https://nmap.org/changelog.html; https://nmap.org/changelog.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-04-18
Description: Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This vulnerability appears to have been fixed in 1.7.0 and later.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Roave/SecurityAdvisories/issues/44#issuecomment-368594409; https://github.com/erusev/parsedown/pull/495; https://github.com/Roave/SecurityAdvisories/issues/44#issuecomment-368594409
CVE: CVE-2[PII_REDACTED]
Published: 2018-04-18
Description: Floodlight version 1.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in the web console that can result in javascript injections into the web page. This attack appears to be exploitable via the victim browsing the web console.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://xiaofen9.github.io/blog/floodlight-rce/; https://xiaofen9.github.io/blog/floodlight-rce/
CVE: CVE-2[PII_REDACTED]
Published: 2018-04-18
Description: gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-93
References: https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5; https://github.com/benoitc/gunicorn/issues/1227; https://lists.debian.org/debian-lts-announce/2018/04/msg00022.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-04-18
Description: LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://github.com/lightSAML/lightSAML/commit/47cef07bb09779df15620799f3763d1b8d32307a; https://github.com/lightSAML/lightSAML/releases/tag/1.3.5; https://github.com/lightSAML/lightSAML/commit/47cef07bb09779df15620799f3763d1b8d32307a
CVE: CVE-2[PII_REDACTED]
Published: 2018-04-18
Description: OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: config.py:136, config.py:142, sources.py:99 and sources.py:131. The "list-sources"-command is affected by this bug. that can result in Remote Code Execution(even as root if suricata-update is called by root). This attack appears to be exploitable via a specially crafted yaml-file at https://www.openinfosecfoundation.org/rules/index.yaml. This vulnerability appears to have been fixed in 1.0.0b1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://redmine.openinfosecfoundation.org/issues/2359; https://tech.feedyourhead.at/content/remote-code-execution-in-suricata-update; https://redmine.openinfosecfoundation.org/issues/2359
CVE: CVE-2018-1325
Published: 2018-04-18
Description: In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://markmail.org/message/6bxjyaolehhq7jrl; https://markmail.org/message/6bxjyaolehhq7jrl
CVE: CVE-2018-7240
Published: 2018-04-18
Description: A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could allow arbitrary code execution. An FTP command used to upgrade the firmware of the module can be misused to cause a denial of service, or in extreme cases, to load a malicious firmware.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103541; https://ics-cert.us-cert.gov/advisories/ICSA-18-086-01; https://www.schneider-electric.com/en/download/document/SEVD-2018-081-01/
CVE: CVE-2018-7241
Published: 2018-04-18
Description: Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.securityfocus.com/bid/103542; https://ics-cert.us-cert.gov/advisories/ICSA-18-086-01; https://www.schneider-electric.com/en/download/document/SEVD-2018-081-01/
CVE: CVE-2018-7242
Published: 2018-04-18
Description: Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules. The algorithm used to encrypt the password is vulnerable to hash collision attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-326
References: http://www.securityfocus.com/bid/103543; https://ics-cert.us-cert.gov/advisories/ICSA-18-086-01; https://www.schneider-electric.com/en/download/document/SEVD-2018-081-01/
CVE: CVE-2018-7243
Published: 2018-04-18
Description: An authorization bypass vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server (Port 80/443/TCP) of the affected devices could allow a remote attacker to get a full access to device, bypassing the authorization system.
CVSS Score: 9.8 (CRITICAL)
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-074-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-074-01/
CVE: CVE-2018-7244
Published: 2018-04-18
Description: An information disclosure vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server (Port 80/443/TCP) of the affected devices could allow a remote attacker to obtain sensitive device information if network access was obtained.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-074-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-074-01/
CVE: CVE-2018-7245
Published: 2018-04-18
Description: An improper authorization vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server (Port 80/443/TCP) of the affected devices could allow a remote attacker to change UPS control and shutdown parameters or other critical settings without authorization.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-074-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-074-01/
CVE: CVE-2018-7246
Published: 2018-04-18
Description: A cleartext transmission of sensitive information vulnerability exists in Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. he integrated web server (Port 80/443/TCP) of the affected devices could allow remote attackers to discover an administrative account. If default on device, it is not using a SSL in settings and if multiple request of the page "Access Control" (IP-address device/ups/pas_cont.htm) account data will be sent in cleartext
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-074-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-074-01/
CVE: CVE-2018-7758
Published: 2018-04-18
Description: A denial of service vulnerability exists in Schneider Electric's MiCOM Px4x (P540 range excluded) with legacy Ethernet board, MiCOM P540D Range with Legacy Ethernet Board, and MiCOM Px4x Rejuvenated could lose network communication in case of TCP/IP open requests on port 20000 (DNP3oE) if an older TCI/IP session is still open with identical IP address and port number.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-074-02/; https://www.schneider-electric.com/en/download/document/SEVD-2018-074-03/; https://www.schneider-electric.com/en/download/document/SEVD-2018-074-04/
CVE: CVE-2018-7759
Published: 2018-04-18
Description: A buffer overflow vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. The buffer overflow vulnerability is caused by the length of the source string specified (instead of the buffer size) as the number of bytes to be copied.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02/; https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02/
CVE: CVE-2018-7760
Published: 2018-04-18
Description: An authorization bypass vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. Requests to CGI functions allow malicious users to bypass authorization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02/; https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02/
CVE: CVE-2018-7761
Published: 2018-04-18
Description: A vulnerability exists in the HTTP request parser in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02/; https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02/
CVE: CVE-2018-7762
Published: 2018-04-18
Description: A vulnerability exists in the web services to process SOAP requests in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow result in a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02/; https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02/
CVE: CVE-2018-8840
Published: 2018-04-18
Description: A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag, alarm, or event related action such as read and write, which may allow remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-119
References: http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000125/; http://www.securityfocus.com/bid/103949; https://ics-cert.us-cert.gov/advisories/ICSA-18-107-01
CVE: CVE-2018-10110
Published: 2018-04-18
Description: D-Link DIR-615 T1 devices allow XSS via the Add User feature.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/147184/D-Link-DIR-615-Cross-Site-Scripting.html; https://hacksayan.wordpress.com/d-link-dir-615-wireless-router-persistent-cross-site-scripting-xss/; https://www.exploit-db.com/exploits/44473/
CVE: CVE-2018-10194
Published: 2018-04-18
Description: The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=39b1e54b[PII_REDACTED]bf32e96764c[PII_REDACTED]9; http://www.securitytracker.com/id/1040729; https://access.redhat.com/errata/RHSA-2018:2918
CVE: CVE-2018-10204
Published: 2018-04-18
Description: PureVPN 6.0.1 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "sevpnclient" service. When configured to use the OpenVPN protocol, the "sevpnclient" service executes "openvpn.exe" using the OpenVPN config file located at %PROGRAMDATA%\purevpn\config\config.ovpn. This file allows "Write" permissions to users in the "Everyone" group. An authenticated attacker may modify this file to specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://github.com/VerSprite/research/blob/master/advisories/VS-2018-021.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2018-021.md
CVE: CVE-2018-1035
Published: 2018-04-19
Description: A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka "Windows Security Feature Bypass Vulnerability." This affects Windows 10, Windows 10 Servers.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/103927; http://www.securitytracker.com/id/1040791; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1035
CVE: CVE-2018-1167
Published: 2018-04-19
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Spotify Music Player 1.0.69.336. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5501.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://zerodayinitiative.com/advisories/ZDI-18-280; https://zerodayinitiative.com/advisories/ZDI-18-280
CVE: CVE-2018-2563
Published: 2018-04-19
Description: Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: LDAP Library). Supported versions that are affected are 10 and 11.3. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVSS Score: 4.2 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/103888; http://www.securitytracker.com/id/1040702
CVE: CVE-2018-2572
Published: 2018-04-19
Description: Vulnerability in the Oracle Agile Product Lifecycle Management for Process component of Oracle Supply Chain Products Suite (subcomponent: Installation). Supported versions that are affected are 6.1.1.6, 6.2.0.0 and 6.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized read access to a subset of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 6.1 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/103907; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2018-2587
Published: 2018-04-19
Description: Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that are affected are 10.1.4.3.0, 11.1.2.3.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).
CVSS Score: 6.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/103822; http://www.securitytracker.com/id/1040695