deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-1459
Published: 2012-03-21
Description: The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, nProtect Anti-Virus 2011-01-17.01, Panda Antivirus 10.0.2.7, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, Sophos Anti-Virus 4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field corresponding to that entire entry, plus part of the header of the next entry.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00002.html; http://osvdb.org/80389; http://osvdb.org/80390
CVE: CVE-2012-1460
Published: 2012-03-21
Description: The Gzip file parser in Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, and VBA32 3.12.14.2 allows remote attackers to bypass malware detection via a .tar.gz file with stray bytes at the end. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different Gzip parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.ieee-security.org/TC/SP2012/program.html; http://www.securityfocus.com/archive/1/522005; http://www.securityfocus.com/bid/52629
CVE: CVE-2012-1461
Published: 2012-03-21
Description: The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, Rising Antivirus 22.83.00.03, Sophos Anti-Virus 4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, and VBA32 3.12.14.2 allows remote attackers to bypass malware detection via a .tar.gz file with multiple compressed streams.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different Gzip parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80500; http://osvdb.org/80501; http://osvdb.org/80502
CVE: CVE-2012-1462
Published: 2012-03-21
Description: The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, Norman Antivirus 6.06.12, Sophos Anti-Virus 4.61.0, and AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11 allows remote attackers to bypass malware detection via a ZIP file containing an invalid block of data at the beginning.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ZIP parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.ieee-security.org/TC/SP2012/program.html; http://www.securityfocus.com/archive/1/522005; http://www.securityfocus.com/bid/52613
CVE: CVE-2012-1463
Published: 2012-03-21
Description: The ELF file parser in AhnLab V3 Internet Security 2011.01.18.00, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158, Norman Antivirus 6.06.12, nProtect Anti-Virus 2011-01-17.01, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified endianness field.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80426; http://osvdb.org/80433; http://www.ieee-security.org/TC/SP2012/program.html
CVE: CVE-2012-0719
Published: 2012-03-22
Description: Cross-site scripting (XSS) vulnerability in IBM Tivoli Endpoint Manager (TEM) 8 before 8.2 patch 3 allows remote attackers to inject arbitrary web script or HTML via the ScheduleParam parameter to the webreports program.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48352; http://www-01.ibm.com/support/docview.wss?uid=swg21587743; http://www.securityfocus.com/bid/52514
CVE: CVE-2012-1662
Published: 2012-03-22
Description: CA ARCserve Backup r12.0 through SP2, r12.5 before SP2, r15 through SP1, and r16 before SP1 on Windows allows remote attackers to cause a denial of service (service shutdown) via a crafted network request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0109.html; http://osvdb.org/80212; http://secunia.com/advisories/48459
CVE: CVE-2012-1836
Published: 2012-03-22
Description: Heap-based buffer overflow in dns.cpp in InspIRCd 2.0.5 might allow remote attackers to execute arbitrary code via a crafted DNS query that uses compression.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/80263; http://secunia.com/advisories/48474; http://www.debian.org/security/2012/dsa-2448
CVE: CVE-2012-1837
Published: 2012-03-22
Description: The (1) webreports, (2) post/create-role, and (3) post/update-role programs in IBM Tivoli Endpoint Manager (TEM) before 8.2 do not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/48352; http://www-01.ibm.com/support/docview.wss?uid=swg21587743; https://exchange.xforce.ibmcloud.com/vulnerabilities/74038
CVE: CVE-2012-1838
Published: 2012-03-22
Description: The web management interface on the LG-Nortel ELO GS24M switch allows remote attackers to bypass authentication, and consequently obtain cleartext credential and configuration information, via a direct request to a configuration web page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/80370; http://www.kb.cert.org/vuls/id/523027; https://exchange.xforce.ibmcloud.com/vulnerabilities/74237
CVE: CVE-2012-1839
Published: 2012-03-22
Description: Multiple directory traversal vulnerabilities in the Get Template feature in plugins/gui.ajax/class.AJXP_ClientDriver.php in AjaXplorer 3.2.x before 3.2.5 and 4.0.x before 4.0.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) pluginName or (2) pluginPath parameter in a get_template action. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://ajaxplorer.info/ajaxplorer-4-0-4/; http://secunia.com/advisories/48226; http://www.kb.cert.org/vuls/id/504019
CVE: CVE-2012-1840
Published: 2012-03-22
Description: AjaXplorer 3.2.x before 3.2.5 and 4.0.x before 4.0.4 does not properly perform cookie authentication, which allows remote attackers to obtain login access by leveraging knowledge of a password hash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://ajaxplorer.info/ajaxplorer-4-0-4/; http://www.kb.cert.org/vuls/id/504019; https://exchange.xforce.ibmcloud.com/vulnerabilities/74305
CVE: CVE-2012-1841
Published: 2012-03-22
Description: Absolute path traversal vulnerability in logShow.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to read arbitrary files via a full pathname in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/80226; http://secunia.com/advisories/48403; http://secunia.com/advisories/48453
CVE: CVE-2012-1842
Published: 2012-03-22
Description: Cross-site scripting (XSS) vulnerability in checkQKMProg.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/80225; http://osvdb.org/80239; http://secunia.com/advisories/48403
CVE: CVE-2012-1843
Published: 2012-03-22
Description: Cross-site request forgery (CSRF) vulnerability in saveRestore.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to hijack the authentication of users for requests that execute Linux commands via the fileName parameter, related to a "command-injection vulnerability."
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/80227; http://secunia.com/advisories/48403; http://secunia.com/advisories/48453
CVE: CVE-2012-1844
Published: 2012-03-22
Description: The Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100) and the IBM TS3310 tape library with firmware before R6C (606G.GS001), uses default passwords for unspecified user accounts, which makes it easier for remote attackers to obtain access via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://osvdb.org/80372; http://www.kb.cert.org/vuls/id/913483; http://www.kb.cert.org/vuls/id/MAPG-8NNKN8
CVE: CVE-2011-3045
Published: 2012-03-22
Description: Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-195
References: http://code.google.com/p/chromium/issues/detail?id=116162; http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html; http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=a8c319a2b281af68f7ca0e2f9a28ca57b44ceb2b
CVE: CVE-2011-3050
Published: 2012-03-22
Description: Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 17.0.963.83 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the :first-letter pseudo-element.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=113902; http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3051
Published: 2012-03-22
Description: Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 17.0.963.83 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the cross-fade function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=116461; http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html
CVE: CVE-2011-3052
Published: 2012-03-22
Description: The WebGL implementation in Google Chrome before 17.0.963.83 does not properly handle CANVAS elements, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=116637; http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html
CVE: CVE-2011-3053
Published: 2012-03-22
Description: Use-after-free vulnerability in Google Chrome before 17.0.963.83 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to block splitting.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=116746; http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3054
Published: 2012-03-22
Description: The WebUI privilege implementation in Google Chrome before 17.0.963.83 does not properly perform isolation, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: http://code.google.com/p/chromium/issues/detail?id=117418; http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html
CVE: CVE-2011-3055
Published: 2012-03-22
Description: The browser native UI in Google Chrome before 17.0.963.83 does not require user confirmation before an unpacked extension installation, which allows user-assisted remote attackers to have an unspecified impact via a crafted extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-306
References: http://code.google.com/p/chromium/issues/detail?id=117736; http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html
CVE: CVE-2011-3056
Published: 2012-03-22
Description: Google Chrome before 17.0.963.83 allows remote attackers to bypass the Same Origin Policy via vectors involving a "magic iframe."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-346
References: http://code.google.com/p/chromium/issues/detail?id=117550; http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html; http://lists.apple.com/archives/security-announce/2012/May/msg00000.html
CVE: CVE-2011-3057
Published: 2012-03-22
Description: Google V8, as used in Google Chrome before 17.0.963.83, allows remote attackers to cause a denial of service via vectors that trigger an invalid read operation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=117794; http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html; http://secunia.com/advisories/48512
CVE: CVE-2012-1845
Published: 2012-03-22
Description: Use-after-free vulnerability in Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the DEP and ASLR protection mechanisms, and execute arbitrary code, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected product may be clarified later; it was not identified by the researcher, who reportedly stated "it really doesn't matter if it's third-party code."
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://pwn2own.zerodayinitiative.com/status.html; http://twitter.com/vupen/statuses/[PII_REDACTED]1237505; http://www.forbes.com/sites/andygreenberg/2012/03/21/meet-the-hackers-who-sell-spies-the-tools-to-crack-your-pc-and-get-paid-six-figure-fees/
CVE: CVE-2012-1846
Published: 2012-03-22
Description: Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the sandbox protection mechanism by leveraging access to a sandboxed process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.  NOTE: the primary affected product may be clarified later; it was not identified by the researcher, who reportedly stated "it really doesn't matter if it's third-party code."
CVSS Score: 10.0 (HIGH)
CWE: CWE-668
References: http://pwn2own.zerodayinitiative.com/status.html; http://twitter.com/vupen/statuses/[PII_REDACTED]1237505; http://www.forbes.com/sites/andygreenberg/2012/03/21/meet-the-hackers-who-sell-spies-the-tools-to-crack-your-pc-and-get-paid-six-figure-fees/
CVE: CVE-2011-3049
Published: 2012-03-23
Description: Google Chrome before 17.0.963.83 does not properly restrict the extension web request API, which allows remote attackers to cause a denial of service (disrupted system requests) via a crafted extension.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=108648; http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html
CVE: CVE-2012-0047
Published: 2012-03-23
Description: Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0112.html; http://osvdb.org/80300; http://wicket.apache.org/2012/03/22/wicket-cve-2012-0047.html
CVE: CVE-2012-1089
Published: 2012-03-23
Description: Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a Wicket resource that corresponds to a null package.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/80301; http://wicket.apache.org/2012/03/22/wicket-cve-2012-1089.html; http://www.securityfocus.com/bid/52679
CVE: CVE-2012-0256
Published: 2012-03-26
Description: Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0118.html; http://seclists.org/fulldisclosure/2012/Mar/260; http://trafficserver.apache.org/downloads
CVE: CVE-2012-1569
Published: 2012-03-26
Description: The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html; http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5932; http://article.gmane.org/gmane.comp.gnu.libtasn1.general/53
CVE: CVE-2012-1573
Published: 2012-03-26
Description: gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html; http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5910; http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5912
CVE: CVE-2012-1916
Published: 2012-03-27
Description: @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/.
CVSS Score: 7.5 (HIGH)
References: http://atmail.org/download/atmailopen.tgz; http://en.securitylab.ru/lab/PT-2011-48; http://secunia.com/advisories/47012
CVE: CVE-2012-1917
Published: 2012-03-27
Description: compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot slash) sequence.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://atmail.org/download/atmailopen.tgz; http://en.securitylab.ru/lab/PT-2011-48; http://secunia.com/advisories/47012
CVE: CVE-2012-1918
Published: 2012-03-27
Description: Multiple directory traversal vulnerabilities in (1) compose.php and (2) libs/Atmail/SendMsg.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allow remote attackers to read arbitrary files via a .. (dot dot) in the Attachment[] parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://atmail.org/download/atmailopen.tgz; http://en.securitylab.ru/lab/PT-2011-48; http://secunia.com/advisories/47012
CVE: CVE-2012-1919
Published: 2012-03-27
Description: CRLF injection vulnerability in mime.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to conduct directory traversal attacks and read arbitrary files via a %0A sequence followed by a .. (dot dot) in the file parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-94
References: http://atmail.org/download/atmailopen.tgz; http://en.securitylab.ru/lab/PT-2011-48; http://secunia.com/advisories/47012
CVE: CVE-2012-1920
Published: 2012-03-27
Description: @Mail WebMail Client in AtMail Open-Source 1.04 and earlier allows remote attackers to obtain configuration information via a direct request to install/info.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://en.securitylab.ru/lab/PT-2011-48; http://secunia.com/advisories/47012; http://www.kb.cert.org/vuls/id/743555
CVE: CVE-2012-1924
Published: 2012-03-28
Description: Opera before 11.62 allows user-assisted remote attackers to trick users into downloading and executing arbitrary files via a small window for the download dialog.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00012.html; http://osvdb.org/80620; http://secunia.com/advisories/48535
CVE: CVE-2012-1925
Published: 2012-03-28
Description: Opera before 11.62 does not ensure that a dialog window is placed on top of content windows, which makes it easier for user-assisted remote attackers to trick users into downloading and executing arbitrary files via a download dialog located under other windows.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00012.html; http://osvdb.org/80621; http://secunia.com/advisories/48535
CVE: CVE-2012-1926
Published: 2012-03-28
Description: Opera before 11.62 allows remote attackers to bypass the Same Origin Policy via the (1) history.pushState and (2) history.replaceState functions in conjunction with cross-domain frames, leading to unintended read access to history.state information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00012.html; http://osvdb.org/80622; http://secunia.com/advisories/48535