deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-4704
Published: 2012-01-25
Description: The Voxofon (com.voxofon) application before 2.5.2 for Android does not properly protect data, which allows remote attackers to read or modify SMS information via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4704-vulnerability-in-Voxofon.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4704-vulnerability-in-Voxofon.html
CVE: CVE-2011-4705
Published: 2012-01-25
Description: The Ming Blacklist Free (vc.software.blacklist) application 1.8.1 and 1.9.2.1 for Android does not properly protect data, which allows remote attackers to read or modify blacklists and a contact list via a crafted application that launches a "data-flow attack."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4705-vulnerability-in-Blacklist.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4705-vulnerability-in-Blacklist.html
CVE: CVE-2011-4769
Published: 2012-01-25
Description: The 360 MobileSafe (com.qihoo360.mobilesafe) application 2.x before 2.3.0 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and a contact list via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4769-vulnerability-in-360MobileSafe.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4769-vulnerability-in-360MobileSafe.html
CVE: CVE-2011-4770
Published: 2012-01-25
Description: The QIWI Wallet (ru.mw) application before 1.14.2 for Android does not properly protect data, which allows remote attackers to read or modify financial information via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4770-vulnerability-in-QIWIWallet.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4770-vulnerability-in-QIWIWallet.html
CVE: CVE-2011-4771
Published: 2012-01-25
Description: The Scan to PDF Free (com.scan.to.pdf.trial) application 2.0.4 for Android does not properly protect data, which allows remote attackers to read or modify scanned files and a Google account via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4771-vulnerability-in-ScanToPDF.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4771-vulnerability-in-ScanToPDF.html
CVE: CVE-2011-4772
Published: 2012-01-25
Description: The 360 KouXin (com.qihoo360.kouxin) application 1.5.3 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and a contact list via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4772-vulnerability-in-360KouXin.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4772-vulnerability-in-360KouXin.html
CVE: CVE-2011-4773
Published: 2012-01-25
Description: The AnGuanJia (com.anguanjia.safe) application 2.10.343 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and a contact list via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/48433; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4774-vulnerability-in-AnGuanJia.html; http://secunia.com/advisories/48433
CVE: CVE-2011-4863
Published: 2012-01-25
Description: The Tencent QQPimSecure (com.tencent.qqpimsecure) application 3.0.2 for Android does not properly protect data, which allows remote attackers to read or modify SMS/MMS messages and a contact list via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/48432; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4863-vulnerability-in-QQPimSecure.html; http://secunia.com/advisories/48432
CVE: CVE-2011-4864
Published: 2012-01-25
Description: The Tencent MobileQQ (com.tencent.mobileqq) application 2.2 for Android does not properly protect data, which allows remote attackers to read or modify messages and a friends list via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4864-vulnerability-in-MobileQQ.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4864-vulnerability-in-MobileQQ.html
CVE: CVE-2011-4865
Published: 2012-01-25
Description: The Tencent WBlog (com.tencent.WBlog) 3.3.1 and MicroBlogPad 1.4.0 applications for Android do not properly protect data, which allows remote attackers to read or modify message drafts and search keywords via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4865-vulnerability-in-WBlog-MicroBlogPad.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4865-vulnerability-in-WBlog-MicroBlogPad.html
CVE: CVE-2011-4866
Published: 2012-01-25
Description: The Kaixin001 (com.kaixin001.activity) application 1.3.1 and 1.3.3 for Android does not properly protect data, which allows remote attackers to read or modify contact information and a cleartext password via a crafted application.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4866-vulnerability-in-Kaixin001.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4866-vulnerability-in-Kaixin001.html
CVE: CVE-2011-4867
Published: 2012-01-25
Description: The Tencent QQPhoto (com.tencent.qqphoto) application 0.97 for Android does not properly protect data, which allows remote attackers to read or modify contact information and a password hash via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4867-vulnerability-in-QQPhoto.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4867-vulnerability-in-QQPhoto.html
CVE: CVE-2011-3478
Published: 2012-01-25
Description: The host-services component in Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), does not properly filter login and authentication data, which allows remote attackers to execute arbitrary code via a crafted session on TCP port 5631.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://osvdb.org/show/osvdb/78532; http://secunia.com/advisories/48092; http://www.securityfocus.com/bid/51592
CVE: CVE-2011-3479
Published: 2012-01-25
Description: Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), uses world-writable permissions for product-installation files, which allows local users to gain privileges by modifying a file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/48092; http://www.securityfocus.com/bid/51593; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120124_00
CVE: CVE-2012-0885
Published: 2012-01-25
Description: chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is used and media support is improperly configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted SDP message with a crypto attribute and a (1) video or (2) text media type, as demonstrated by CSipSimple.
CVSS Score: 4.3 (MEDIUM)
References: http://downloads.asterisk.org/pub/security/AST-2012-001-1.8.diff; http://downloads.asterisk.org/pub/security/AST-2012-001-10.diff; http://downloads.asterisk.org/pub/security/AST-2012-001.html
CVE: CVE-2011-4123
Published: 2012-01-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-3874.  Reason: This candidate is a duplicate of CVE-2011-3874.  Notes: All CVE users should reference CVE-2011-3874 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-4276
Published: 2012-01-25
Description: The Bluetooth service (com/android/phone/BluetoothHeadsetService.java) in Android 2.3 before 2.3.6 allows remote attackers within Bluetooth range to obtain contact data via an AT phonebook transfer.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/android/issues/detail?id=21347; http://code.google.com/p/android/issues/detail?id=21347
CVE: CVE-2011-1940
Published: 2012-01-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to (1) libraries/tbl_links.inc.php and (2) tbl_tracking.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=7e10c132a3887c8ebfd7a8eee356b28375f1e287; http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=d3ccf798fdbd4f8a89d[PII_REDACTED]d8dee918492; http://www.debian.org/security/2012/dsa-2391
CVE: CVE-2011-1941
Published: 2012-01-26
Description: Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f; http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d; http://www.phpmyadmin.net/home_page/security/PMASA-2011-4.php
CVE: CVE-2012-0311
Published: 2012-01-26
Description: Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN36559450/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000004; http://sourceforge.jp/forum/forum.php?forum_id=28119
CVE: CVE-2012-0312
Published: 2012-01-26
Description: Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce Online Merchant before 2.3.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN64386898/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000005; http://sourceforge.jp/forum/forum.php?forum_id=28119
CVE: CVE-2011-4143
Published: 2012-01-27
Description: EMC RSA enVision 4.0 before SP4 P5 and 4.1 before P3 allows remote attackers to obtain sensitive information about environment variables in the web system via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/521375; http://www.securityfocus.com/archive/1/521375
CVE: CVE-2011-4354
Published: 2012-01-27
Description: crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://crypto.di.uminho.pt/CACE/CT-RSA2012-openssl-src.zip; http://cvs.openssl.org/filediff?f=openssl/crypto/bn/bn_nist.c&v1=1.14&v2=1.21; http://eprint.iacr.org/2011/633
CVE: CVE-2012-0395
Published: 2012-01-27
Description: Buffer overflow in the server in EMC NetWorker 7.5.x and 7.6.x before 7.6.3 SP1 Cumulative Release build 851 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/521374; http://www.securityfocus.com/archive/1/521374
CVE: CVE-2012-0806
Published: 2012-01-27
Description: Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of TCP connections that triggers use of many open file descriptors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657217; http://lists.fedoraproject.org/pipermail/package-announce/2012-February/072752.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-February/072767.html
CVE: CVE-2012-0807
Published: 2012-01-27
Description: Stack-based buffer overflow in the suhosin_encrypt_single_cookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might allow remote attackers to execute arbitrary code via a long string that is used in a Set-Cookie HTTP header.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-01/0296.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html
CVE: CVE-2011-1162
Published: 2012-01-27
Description: The tpm_read function in the Linux kernel 2.6 does not properly clear memory, which might allow local users to read the results of the previous TPM command.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/50764; https://bugzilla.redhat.com/show_bug.cgi?id=732629; http://www.securityfocus.com/bid/50764
CVE: CVE-2011-2203
Published: 2012-01-27
Description: The hfs_find_init function in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and Oops) by mounting an HFS file system with a malformed MDB extent record.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/47754; http://www.openwall.com/lists/oss-security/2011/06/13/16; http://www.securityfocus.com/bid/48236
CVE: CVE-2011-3626
Published: 2012-01-27
Description: Double free vulnerability in the prepare_exec function in src/exec.c in Logsurfer 1.5b and earlier, and Logsurfer+ 1.7 and earlier, allows remote attackers to execute arbitrary commands via crafted strings in a log file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/46389; http://secunia.com/advisories/47725; http://security.gentoo.org/glsa/glsa-201201-04.xml
CVE: CVE-2011-3874
Published: 2012-01-27
Description: Stack-based buffer overflow in libsysutils in Android 2.2.x through 2.2.2 and 2.3.x through 2.3.6 allows user-assisted remote attackers to execute arbitrary code via an application that calls the FrameworkListener::dispatchCommand method with the wrong number of arguments, as demonstrated by zergRush to trigger a use-after-free error.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/android/issues/detail?id=21681; http://www.openwall.com/lists/oss-security/2011/11/08/3; http://www.openwall.com/lists/oss-security/2011/11/08/4
CVE: CVE-2011-4077
Published: 2012-01-27
Description: Buffer overflow in the xfs_readlink function in fs/xfs/xfs_vnodeops.c in XFS in the Linux kernel 2.6, when CONFIG_XFS_DEBUG is disabled, allows local users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via an XFS image containing a symbolic link with a long pathname.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6211&w=2; http://oss.sgi.com/archives/xfs/2011-10/msg00345.html; http://secunia.com/advisories/48964
CVE: CVE-2011-4110
Published: 2012-01-27
Description: The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and "updating a negative key into a fully instantiated key."
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6211&w=2; http://secunia.com/advisories/47754; http://www.openwall.com/lists/oss-security/2011/11/21/19
CVE: CVE-2011-4132
Published: 2012-01-27
Description: The cleanup_journal_tail function in the Journaling Block Device (JBD) functionality in the Linux kernel 2.6 allows local users to cause a denial of service (assertion error and kernel oops) via an ext3 or ext4 image with an "invalid log first block value."
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=8762202dd0d6e46854f786bdb6fb3780a1625efe; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
CVE: CVE-2011-4314
Published: 2012-01-27
Description: message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://openid.net/2011/05/05/attribute-exchange-security-alert/; http://rhn.redhat.com/errata/RHSA-2012-0441.html; http://rhn.redhat.com/errata/RHSA-2012-0519.html
CVE: CVE-2011-4325
Published: 2012-01-27
Description: The NFS implementation in Linux kernel before 2.6.31-rc6 calls certain functions without properly initializing certain data, which allows local users to cause a denial of service (NULL pointer dereference and O_DIRECT oops), as demonstrated using diotest4 from LTP.
CVSS Score: 4.9 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=1ae88b2e4; http://www.securityfocus.com/bid/51366; https://bugzilla.redhat.com/show_bug.cgi?id=755455
CVE: CVE-2011-4330
Published: 2012-01-27
Description: Stack-based buffer overflow in the hfs_mac2asc function in fs/hfs/trans.c in the Linux kernel 2.6 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via an HFS image with a crafted len field.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=bc5b8a9003132ae44559edd63a1623; http://www.openwall.com/lists/oss-security/2011/11/21/14; http://www.openwall.com/lists/oss-security/2011/11/21/5
CVE: CVE-2011-4608
Published: 2012-01-27
Description: mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.redhat.com/support/errata/RHSA-2012-0035.html; http://www.redhat.com/support/errata/RHSA-2012-0036.html; http://www.redhat.com/support/errata/RHSA-2012-0037.html
CVE: CVE-2011-4622
Published: 2012-01-27
Description: The create_pit_timer function in arch/x86/kvm/i8254.c in KVM 83, and possibly other versions, does not properly handle when Programmable Interval Timer (PIT) interrupt requests (IRQs) when a virtual interrupt controller (irqchip) is not available, which allows local users to cause a denial of service (NULL pointer dereference) by starting a timer.
CVSS Score: 4.9 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html; http://permalink.gmane.org/gmane.comp.emulators.kvm.devel/83564
CVE: CVE-2012-0029
Published: 2012-01-27
Description: Heap-based buffer overflow in the process_tx_desc function in the e1000 emulation (hw/e1000.c) in qemu-kvm 0.12, and possibly other versions, allows guest OS users to cause a denial of service (QEMU crash) and possibly execute arbitrary code via crafted legacy mode packets.
CVSS Score: 7.4 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=log%3Bh=refs/heads/stable-1.0; http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081972.html; http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00002.html
CVE: CVE-2012-0056
Published: 2012-01-27
Description: The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://blog.zx2c4.com/749; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=e268337dfe26dfc7efd422a804dbb27977a3cccc; http://secunia.com/advisories/47708
CVE: CVE-2012-0814
Published: 2012-01-27
Description: The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by the shared user account required by Gitolite.  NOTE: this can cross privilege boundaries because a user account may intentionally have no shell or filesystem access, and therefore may have no supported way to read an authorized_keys file in its own home directory.
CVSS Score: 3.5 (LOW)
CWE: CWE-255
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657445; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673; http://openwall.com/lists/oss-security/2012/01/26/15
CVE: CVE-2012-0929
Published: 2012-01-28
Description: Multiple buffer overflows in Schneider Electric Modicon Quantum PLC allow remote attackers to cause a denial of service via malformed requests to the (1) FTP server or (2) HTTP server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/47723; http://www.securityfocus.com/bid/51605; http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf
CVE: CVE-2012-0930
Published: 2012-01-28
Description: Cross-site scripting (XSS) vulnerability in Schneider Electric Modicon Quantum PLC allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/47723; http://www.securityfocus.com/bid/51605; http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf
CVE: CVE-2012-0931
Published: 2012-01-28
Description: Schneider Electric Modicon Quantum PLC does not perform authentication between the Unity software and PLC, which allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://secunia.com/advisories/47723; http://www.securityfocus.com/bid/51605; http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf
CVE: CVE-2012-0021
Published: 2012-01-28
Description: The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
CVSS Score: 2.6 (LOW)
CWE: CWE-20
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041; http://httpd.apache.org/security/vulnerabilities_22.html; http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html