deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-6339
Published: 2012-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in Cerberus FTP Server before 5.0.6.0 allow (1) remote attackers to inject arbitrary web script or HTML via a log entry that is not properly handled within the Log Manager component, and might allow (2) remote authenticated administrators to inject arbitrary web script or HTML via a Messages field to the servermanager program.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-12/0118.html; http://sadgeeksinsnow.blogspot.com/2012/12/persistence-is-key-another-bug-hunt.html; http://www.cerberusftp.com/products/releasenotes.html
CVE: CVE-2012-6453
Published: 2012-12-31
Description: Cross-site scripting (XSS) vulnerability in the RSS Reader extension before 0.2.6 for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a crafted feed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/696179; http://www.mediawiki.org/wiki/Extension:RSS_Reader#0.2.6; http://bugs.debian.org/696179
CVE: CVE-2011-5251
Published: 2012-12-31
Description: Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter in a lostpw action.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.vbulletin.com/forum/showthread.php/381014-Potential-Phishing-Vector?p=2166441; http://www.vbulletin.com/forum/showthread.php/381014-Potential-Phishing-Vector?p=2166441
CVE: CVE-2012-6371
Published: 2012-12-31
Description: The WPA2 implementation on the Belkin N900 F9K1104v1 router establishes a WPS PIN based on 6 digits of the LAN/WLAN MAC address, which makes it easier for remote attackers to obtain access to a Wi-Fi network by reading broadcast packets, a different vulnerability than CVE-2012-4366.
CVSS Score: 3.3 (LOW)
CWE: CWE-310
References: http://ednolo.alumnos.upv.es/?p=1295; http://ednolo.alumnos.upv.es/?p=1295
CVE: CVE-2012-4970
Published: 2013-01-01
Description: Cross-site scripting (XSS) vulnerability in the web management interface on Polycom HDX Video End Points with UC APL software before 2.7.1.1_J, and commercial software before 3.0.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-12/0146.html; http://knowledgebase-iframe.polycom.com/kb/knowledgebase/End%20User/Tech%20Alerts/Video/15990_fHDX%20XSS%20Vulnerability%20-%20Security%20Bulletin%20101521.pdf; http://www.securitytracker.com/id?1027926
CVE: CVE-2012-5573
Published: 2013-01-01
Description: The connection_edge_process_relay_cell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell arrives, which might allow remote attackers to cause a denial of service (memory consumption or excessive cell reception rate) or bypass intended flow-control restrictions via a RELAY_COMMAND_SENDME command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://openwall.com/lists/oss-security/2012/11/26/11; http://secunia.com/advisories/51329; http://security.gentoo.org/glsa/glsa-201301-03.xml
CVE: CVE-2012-5769
Published: 2013-01-01
Description: IBM SPSS Modeler 14.0, 14.1, 14.2 through FP3, and 15.0 before FP2 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference.
CVSS Score: 5.8 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM79454; http://www-01.ibm.com/support/docview.wss?uid=swg21620758; http://www-01.ibm.com/support/docview.wss?uid=swg24034122
CVE: CVE-2012-6084
Published: 2013-01-01
Description: modules/m_capab.c in (1) ircd-ratbox before 3.0.8 and (2) Charybdis before 3.4.2 does not properly support capability negotiation during server handshakes, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed request.
CVSS Score: 5.0 (MEDIUM)
References: http://openwall.com/lists/oss-security/2013/01/01/4; http://rabbit.dereferenced.org/~nenolod/ASA-2012-12-31.txt; http://www.debian.org/security/2013/dsa-2612
CVE: CVE-2012-6426
Published: 2013-01-01
Description: LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://jira.ow2.org/browse/LEMONLDAP-570; http://openwall.com/lists/oss-security/2012/12/19/6; http://openwall.com/lists/oss-security/2012/12/20/6
CVE: CVE-2012-6459
Published: 2013-01-01
Description: ConnMan 1.3 on Tizen continues to list the bluetooth service after offline mode has been enabled, which might allow remote attackers to obtain sensitive information via Bluetooth packets.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://bugs.tizen.org/jira/browse/TIVI-211; https://bugs.tizen.org/jira/browse/TIVI-211
CVE: CVE-2012-6460
Published: 2013-01-02
Description: Opera before 11.67 and 12.x before 12.02 allows remote attackers to cause truncation of a dialog, and possibly trigger downloading and execution of arbitrary programs, via a crafted web site.
CVSS Score: 5.0 (MEDIUM)
References: http://www.opera.com/docs/changelogs/unified/1202/; http://www.opera.com/support/kb/view/1028/; http://www.opera.com/docs/changelogs/unified/1202/
CVE: CVE-2012-6461
Published: 2013-01-02
Description: The X.509 certificate-validation functionality in the https implementation in Opera before 12.10 allows remote attackers to trigger a false indication of successful revocation-status checking by causing a failure of a single checking service.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.opera.com/docs/changelogs/unified/1210/; http://www.opera.com/support/kb/view/1029/; http://www.opera.com/docs/changelogs/unified/1210/
CVE: CVE-2012-6462
Published: 2013-01-02
Description: Opera before 12.10 does not properly implement the Cross-Origin Resource Sharing (CORS) specification, which allows remote attackers to bypass intended page-content restrictions via a crafted request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.opera.com/docs/changelogs/unified/1210/; http://www.opera.com/support/kb/view/1030/; http://www.opera.com/docs/changelogs/unified/1210/
CVE: CVE-2012-6463
Published: 2013-01-02
Description: Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an unspecified sequence of loading of documents and loading of data: URLs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.opera.com/docs/changelogs/unified/1210/; http://www.opera.com/support/kb/view/1031/; http://www.opera.com/docs/changelogs/unified/1210/
CVE: CVE-2012-6464
Published: 2013-01-02
Description: Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript code that overrides methods of unspecified native objects in documents that have different origins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.opera.com/docs/changelogs/unified/1210/; http://www.opera.com/support/kb/view/1032/; http://www.opera.com/docs/changelogs/unified/1210/
CVE: CVE-2012-6465
Published: 2013-01-02
Description: Opera before 12.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed SVG image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.opera.com/docs/changelogs/unified/1210/; http://www.opera.com/support/kb/view/1033/; http://www.opera.com/docs/changelogs/unified/1210/
CVE: CVE-2012-6466
Published: 2013-01-02
Description: Opera before 12.10 does not properly handle incorrect size data in a WebP image, which allows remote attackers to obtain potentially sensitive information from process memory by using a crafted image as the fill pattern for a canvas.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.opera.com/docs/changelogs/unified/1210/; http://www.opera.com/support/kb/view/1035/; http://www.opera.com/docs/changelogs/unified/1210/
CVE: CVE-2012-6467
Published: 2013-01-02
Description: Opera before 12.10 follows Internet shortcuts that are referenced by a (1) IMG element or (2) other inline element, which makes it easier for remote attackers to conduct phishing attacks via a crafted web site, as exploited in the wild in November 2012.
CVSS Score: 4.3 (MEDIUM)
References: http://www.opera.com/docs/changelogs/unified/1210/; http://www.opera.com/support/kb/view/1034/; http://www.securityfocus.com/bid/57132
CVE: CVE-2012-6468
Published: 2013-01-02
Description: Heap-based buffer overflow in Opera before 12.11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a long HTTP response.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.opera.com/docs/changelogs/unified/1211/; http://www.opera.com/support/kb/view/1036/; http://www.securityfocus.com/bid/56594
CVE: CVE-2012-6469
Published: 2013-01-02
Description: Opera before 12.11 allows remote attackers to determine the existence of arbitrary local files via vectors involving web script in an error page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.opera.com/docs/changelogs/unified/1211/; http://www.opera.com/support/kb/view/1037/; http://www.securityfocus.com/bid/56594
CVE: CVE-2012-6470
Published: 2013-01-02
Description: Opera before 12.12 does not properly allocate memory for GIF images, which allows remote attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a malformed image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.opera.com/docs/changelogs/unified/1212/; http://www.opera.com/support/kb/view/1038/; http://www.opera.com/docs/changelogs/unified/1212/
CVE: CVE-2012-6471
Published: 2013-01-02
Description: Opera before 12.12 allows remote attackers to spoof the address field via a high rate of HTTP requests.
CVSS Score: 5.0 (MEDIUM)
References: http://www.opera.com/docs/changelogs/unified/1212/; http://www.opera.com/support/kb/view/1040/; http://www.opera.com/docs/changelogs/unified/1212/
CVE: CVE-2012-6472
Published: 2013-01-02
Description: Opera before 12.12 on UNIX uses weak permissions for the profile directory, which allows local users to obtain sensitive information by reading a (1) cache file, (2) password file, or (3) configuration file, or (4) possibly gain privileges by modifying or overwriting a configuration file.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://www.opera.com/docs/changelogs/unified/1212/; http://www.opera.com/support/kb/view/1039/; http://www.opera.com/docs/changelogs/unified/1212/
CVE: CVE-2013-0721
Published: 2013-01-02
Description: wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/ref/88/wp-php-widget.txt; http://www.osvdb.org/88846; https://exchange.xforce.ibmcloud.com/vulnerabilities/80906
CVE: CVE-2012-2379
Published: 2013-01-03
Description: Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://cxf.apache.org/cve-2012-2379.html; http://rhn.redhat.com/errata/RHSA-2012-1559.html; http://rhn.redhat.com/errata/RHSA-2012-1573.html
CVE: CVE-2012-4545
Published: 2013-01-03
Description: The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-287
References: http://bugzilla.elinks.cz/show_bug.cgi?id=1124; http://repo.or.cz/w/elinks.git/blobdiff/89056e21fc7ab8e1c2d4e06ec9d0c6d01e70669a..da18694ff7dd0b67dfcb3c417fb0579b1e7d02d7:/src/protocol/http/http_negotiate.c; http://rhn.redhat.com/errata/RHSA-2013-0250.html
CVE: CVE-2012-5651
Published: 2013-01-03
Description: Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers to obtain sensitive information by reading the search results.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/SA-CORE-2012-004; http://drupalcode.org/project/drupal.git/commitdiff/b47f95d; http://drupalcode.org/project/drupal.git/commitdiff/da8023a
CVE: CVE-2012-5652
Published: 2013-01-03
Description: Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://drupal.org/SA-CORE-2012-004; http://drupalcode.org/project/drupal.git/commitdiff/da8023a; http://osvdb.org/88527
CVE: CVE-2012-5653
Published: 2013-01-03
Description: The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://drupal.org/SA-CORE-2012-004; http://drupalcode.org/project/drupal.git/commitdiff/b47f95d; http://drupalcode.org/project/drupal.git/commitdiff/da8023a
CVE: CVE-2012-5654
Published: 2013-01-03
Description: The Nodewords: D6 Meta Tags module before 6.x-1.14 for Drupal, when configured to automatically generate description meta tags from node text, does not properly filter node content when creating tags, which might allow remote attackers to obtain sensitive information by reading the (1) description, (2) dc.description or (3) og:description meta tags.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://drupal.org/node/1859208; http://drupal.org/node/1859282; http://www.openwall.com/lists/oss-security/2012/12/20/1
CVE: CVE-2012-5655
Published: 2013-01-03
Description: The Context module 6.x-3.x before 6.x-3.1 and 7.x-3.x before 7.x-3.0-beta6 for Drupal does not properly restrict access to block content, which allows remote attackers to obtain sensitive information via a crafted request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/1870550; http://drupalcode.org/project/context.git/commitdiff/4452bf1; http://drupalcode.org/project/context.git/commitdiff/d8bf8b6
CVE: CVE-2012-5665
Published: 2013-01-03
Description: ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 does not properly restrict access to settings.php, which allows remote attackers to edit app configurations of user_webdavauth and user_ldap by editing this file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://owncloud.org/changelog/; http://secunia.com/advisories/51614; http://www.openwall.com/lists/oss-security/2012/12/22/2
CVE: CVE-2012-5666
Published: 2013-01-03
Description: Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to apps/bookmark/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://owncloud.org/changelog/; http://secunia.com/advisories/51614; http://www.openwall.com/lists/oss-security/2012/12/22/2
CVE: CVE-2012-6080
Published: 2013-01-03
Description: Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52; http://moinmo.in/SecurityFixes; http://secunia.com/advisories/51663
CVE: CVE-2012-6081
Published: 2013-01-03
Description: Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.
CVSS Score: 6.0 (MEDIUM)
References: http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f; http://moinmo.in/MoinMoinRelease1.9; http://moinmo.in/SecurityFixes
CVE: CVE-2012-6082
Published: 2013-01-03
Description: Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hg.moinmo.in/moin/1.9/rev/c98ec456e493; http://moinmo.in/SecurityFixes; http://secunia.com/advisories/51663
CVE: CVE-2012-6495
Published: 2013-01-03
Description: Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors.  NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f; http://moinmo.in/MoinMoinRelease1.9; http://moinmo.in/SecurityFixes
CVE: CVE-2012-5667
Published: 2013-01-03
Description: Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-189
References: http://git.savannah.gnu.org/cgit/grep.git/commit/?id=8fcf61523644df42e1905c81bed26838e0b04f91; http://git.savannah.gnu.org/cgit/grep.git/commit/?id=cbbc1a45b9f843c811905c97c90a5d31f8e6c189; http://git.sv.gnu.org/gitweb/?p=grep.git%3Ba=shortlog%3Bh=v2.11
CVE: CVE-2012-6433
Published: 2013-01-03
Description: Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the news_title parameter in a create action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://e107.org/changelog; http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/newspost.php?sortdir=down&r1=12622&r2=12992&sortby=rev; http://www.exploit-db.com/exploits/23828/
CVE: CVE-2012-6434
Published: 2013-01-03
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) download_url, (2) download_url_extended, (3) download_author_email, (4) download_author_website, (5) download_image, (6) download_thumb, (7) download_visible, or (8) download_class parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://e107.org/changelog; http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/download.php?sortdir=down&r1=13037&r2=13058&sortby=rev; http://www.exploit-db.com/exploits/23829/
CVE: CVE-2012-6496
Published: 2013-01-04
Description: SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/; http://rhn.redhat.com/errata/RHSA-2013-0154.html; http://rhn.redhat.com/errata/RHSA-2013-0155.html
CVE: CVE-2012-6497
Published: 2013-01-04
Description: The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in secret_token.rb in an open-source product.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-89
References: http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/; http://openwall.com/lists/oss-security/2013/01/03/12; http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html
CVE: CVE-2012-5976
Published: 2013-01-04
Description: Multiple stack consumption vulnerabilities in Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones allow remote attackers to cause a denial of service (daemon crash) via TCP data using the (1) SIP, (2) HTTP, or (3) XMPP protocol.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://downloads.asterisk.org/pub/security/AST-2012-014; http://www.debian.org/security/2013/dsa-2605; http://downloads.asterisk.org/pub/security/AST-2012-014
CVE: CVE-2012-6089
Published: 2013-01-04
Description: Multiple stack-based buffer overflows in the canoniseFileName function in os/pl-os.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://openwall.com/lists/oss-security/2013/01/03/7; http://www.swi-prolog.org/git/pl.git/commit/a9a6fc8a2a9cf3b9154b490a4b1ffaa8be4d723c; https://bugzilla.redhat.com/show_bug.cgi?id=891577
CVE: CVE-2012-6090
Published: 2013-01-04
Description: Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://openwall.com/lists/oss-security/2013/01/03/7; http://www.swi-prolog.org/git/pl.git/commit/b2c88972e7515ada025e97e7d3ce3e34f81cf33e; https://bugzilla.redhat.com/show_bug.cgi?id=891577
CVE: CVE-2012-5977
Published: 2013-01-04
Description: Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones, when anonymous calls are enabled, allow remote attackers to cause a denial of service (resource consumption) by making anonymous calls from multiple sources and consequently adding many entries to the device state cache.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://downloads.asterisk.org/pub/security/AST-2012-015; http://www.debian.org/security/2013/dsa-2605; https://issues.asterisk.org/jira/browse/ASTERISK-20175
CVE: CVE-2012-6329
Published: 2013-01-04
Description: The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695224; http://code.activestate.com/lists/perl5-porters/187746/; http://code.activestate.com/lists/perl5-porters/187763/