deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-1780
Published: 2012-03-19
Description: SQL injection vulnerability in search.php in SocialCMS 1.0.5 allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/79458; http://packetstormsecurity.org/files/110043/SocialCMS-Cross-Site-Scripting-SQL-Injection.html; http://secunia.com/advisories/44313
CVE: CVE-2012-1781
Published: 2012-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in ajax/commentajax.php in SocialCMS 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) TREF_email_address or (2) TR_name parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/79457; http://packetstormsecurity.org/files/110043/SocialCMS-Cross-Site-Scripting-SQL-Injection.html; http://secunia.com/advisories/48082
CVE: CVE-2012-1782
Published: 2012-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in questions/ask in OSQA 3b allow remote attackers to inject arbitrary web script or HTML via the (1) url bar or (2) picture bar.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0164.html; http://www.securityfocus.com/bid/52184; http://www.vulnerability-lab.com/get_content.php?id=461
CVE: CVE-2012-1783
Published: 2012-03-19
Description: Tiny Server 1.1.9 and earlier allows remote attackers to cause a denial of service (crash) via a long string in a GET request without an HTTP version number.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.exploit-db.com/exploits/18524; https://exchange.xforce.ibmcloud.com/vulnerabilities/73482; http://www.exploit-db.com/exploits/18524
CVE: CVE-2012-1784
Published: 2012-03-19
Description: SQL injection vulnerability in MyJobList 0.1.3 allows remote attackers to execute arbitrary SQL commands via the eid parameter in a profile action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/79637; http://packetstormsecurity.org/files/110225/MyJobList-0.1.3-SQL-Injection.html; http://secunia.com/advisories/48169
CVE: CVE-2012-1785
Published: 2012-03-19
Description: kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://plugins.trac.wordpress.org/changeset?old_path=%2Fvideo-embed-thumbnail-generator&old=507924&new_path=%2Fvideo-embed-thumbnail-generator&new=507924; http://secunia.com/advisories/48087; http://wordpress.org/extend/plugins/video-embed-thumbnail-generator/changelog/
CVE: CVE-2012-1786
Published: 2012-03-19
Description: The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://plugins.trac.wordpress.org/changeset?old_path=%2Fvideo-embed-thumbnail-generator&old=507924&new_path=%2Fvideo-embed-thumbnail-generator&new=507924; http://wordpress.org/extend/plugins/video-embed-thumbnail-generator/changelog/; http://www.securityfocus.com/bid/52652
CVE: CVE-2012-1787
Published: 2012-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in wgarcmin.cgi in Webglimpse 2.20.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) FILE, or (3) DOMAIN parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/79648; http://packetstormsecurity.org/files/110219/Webglimpse-Brute-Force-Cross-Site-Scripting.html; http://secunia.com/advisories/48049
CVE: CVE-2012-1788
Published: 2012-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in wonderdesk.cgi in WonderDesk SQL 4.14 allow remote attackers to inject arbitrary web script or HTML via the (1) cus_email parameter in a cust_lostpw action; or (2) help_name, (3) help_email, (4) help_website, or (5) help_example_url parameters in an hd_modify_record action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/79647; http://packetstormsecurity.org/files/110224/WonderDesk-Cross-Site-Scripting.html; http://secunia.com/advisories/48167
CVE: CVE-2012-1789
Published: 2012-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Kongreg8 1.7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) surname or (2) firstname parameters to modules/members/addmember.php; or (3) groupdescription or (4) groupname parameters to modules/groups/addgroupform.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0154.html; http://www.securityfocus.com/bid/52178; https://exchange.xforce.ibmcloud.com/vulnerabilities/73510
CVE: CVE-2012-1790
Published: 2012-03-19
Description: Absolute path traversal vulnerability in Webgrind 1.0 and 1.0.2 allows remote attackers to read arbitrary files via a full pathname in the file parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://code.google.com/p/webgrind/issues/detail?id=66; http://packetstormsecurity.org/files/110216; http://www.exploit-db.com/exploits/18523
CVE: CVE-2012-0054
Published: 2012-03-19
Description: libs/updater.py in GoLismero 0.6.3, and other versions before Git revision 2b3bb43d6867, as used in backtrack and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on GoLismero-controlled files, as demonstrated using Admin/changes.dat.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://code.google.com/p/golismero/source/detail?r=2b3bb43d68676efd687361f7de[PII_REDACTED]1ab8; http://www.openwall.com/lists/oss-security/2012/01/17/10; http://www.openwall.com/lists/oss-security/2012/01/17/7
CVE: CVE-2012-0808
Published: 2012-03-19
Description: as31 2.3.1-4 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack.
CVSS Score: 3.6 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=655496; http://www.openwall.com/lists/oss-security/2012/01/24/11; http://www.openwall.com/lists/oss-security/2012/01/24/7
CVE: CVE-2012-0872
Published: 2012-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in OxWall 1.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) captchaField, (2) email, (3) form_name, (4) password, (5) realname, (6) repeatPassword, or (7) username parameters to Oxwall/join; (8) captcha, (9) email, (10) form_name, (11) from, or (12) subject parameters to Oxwall/contact; (13) tag parameter to Oxwall/blogs/browse-by-tag; or (14) PATH_INFO to Oxwall/photo/viewlist/tagged, (15) Oxwall/photo/viewlist, or (16) Oxwall/video/viewlist.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0106.html; http://archives.neohapsis.com/archives/bugtraq/2012-02/0113.html; http://www.openwall.com/lists/oss-security/2012/02/20/10
CVE: CVE-2012-1039
Published: 2012-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) login_data parameter to admin/auth.php; (2) nb parameter to admin/blogs.php; (3) type, (4) sortby, (5) order, or (6) status parameters to admin/comments.php; or (7) page parameter to admin/plugin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0183.html; http://dotclear.org/blog/post/2012/02/11/Dotclear-2.4.2; http://secunia.com/advisories/48209
CVE: CVE-2012-1464
Published: 2012-03-19
Description: Dashboard Server for NetMechanica NetDecision before 4.6.1 allows remote attackers to obtain the installation path via a request with a trailing "?" character, which causes Dashboard to attempt to access a non-existent resource.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/79653; http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_Dashboard_Server_Info_Disc_Vuln.txt; http://secpod.org/blog/?p=478
CVE: CVE-2012-1465
Published: 2012-03-19
Description: Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of service (application crash) via a long URL in an HTTP request.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/79651; http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_HTTP_Server_DoS_Vuln.txt; http://secpod.org/blog/?p=484
CVE: CVE-2012-1466
Published: 2012-03-19
Description: The Traffic Grapher Server for NetMechanica NetDecision before 4.6.1 allows remote attackers to obtain the source code of NtDecision script files with a .nd extension via an invalid version number in an HTTP request, as demonstrated using default.nd.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/79652; http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_Traffic_Grapher_Server_SourceCode_Disc_Vuln.txt; http://secpod.org/blog/?p=481
CVE: CVE-2012-1498
Published: 2012-03-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Webfolio CMS 1.1.4 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via an add action to admin/users/add or (2) modify a web page via a save action to admin/pages/edit/web_page_name.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://ivanobinetti.blogspot.com/2012/02/webfoliocms-114-csrf-add-adminmodify.html; http://osvdb.org/79658; http://packetstormsecurity.org/files/110294/WebfolioCMS-1.1.4-Cross-Site-Request-Forgery.html
CVE: CVE-2012-0328
Published: 2012-03-19
Description: Janetter before 3.3.0.0 (aka 3.3.0) allows remote attackers to obtain session information for twitter.com web sites via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://blog.janetter.net/; http://janetter.net/history.html; http://jvn.jp/en/jp/JVN10745573/index.html
CVE: CVE-2012-1181
Published: 2012-03-19
Description: fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests that triggers a process count higher than the intended limit.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615814; http://www.debian.org/security/2012/dsa-2436; http://www.openwall.com/lists/oss-security/2012/03/15/10
CVE: CVE-2012-1236
Published: 2012-03-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Janetter before 3.3.0.0 (aka 3.3.0) allow remote attackers to hijack the authentication of arbitrary users for requests that (1) tweet, (2) upload an image file, or (3) execute arbitrary commands.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://blog.janetter.net/; http://janetter.net/history.html; http://jvn.jp/en/jp/JVN83459967/index.html
CVE: CVE-2012-0399
Published: 2012-03-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0081.html; http://osvdb.org/80206; http://secunia.com/advisories/48484
CVE: CVE-2012-0400
Published: 2012-03-20
Description: EMC RSA enVision 4.x before 4.1 Patch 4 does not properly restrict the number of failed authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 7.9 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0081.html; http://osvdb.org/80207; http://secunia.com/advisories/48484
CVE: CVE-2012-0401
Published: 2012-03-20
Description: Multiple SQL injection vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0081.html; http://secunia.com/advisories/48484; http://www.securityfocus.com/bid/52557
CVE: CVE-2012-0402
Published: 2012-03-20
Description: EMC RSA enVision 4.x before 4.1 Patch 4 uses unspecified hardcoded credentials, which makes it easier for remote attackers to obtain access via unknown vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0081.html; http://secunia.com/advisories/48484; http://www.securityfocus.com/bid/52557
CVE: CVE-2012-0403
Published: 2012-03-20
Description: Directory traversal vulnerability in EMC RSA enVision 4.x before 4.1 Patch 4 allows remote authenticated users to have an unspecified impact via unknown vectors.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0081.html; http://osvdb.org/80210; http://secunia.com/advisories/48484
CVE: CVE-2012-1795
Published: 2012-03-20
Description: webglimpse.cgi in Webglimpse before 2.20.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter, as exploited in the wild in March 2012.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://osvdb.org/80344; http://secunia.com/advisories/48452; http://www.kb.cert.org/vuls/id/364363
CVE: CVE-2012-0709
Published: 2012-03-20
Description: IBM DB2 9.5 before FP9, 9.7 through FP5, and 9.8 through FP4 does not properly check variables, which allows remote authenticated users to bypass intended restrictions on viewing table data by leveraging the CREATEIN privilege to execute crafted SQL CREATE VARIABLE statements.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC81387; http://www-01.ibm.com/support/docview.wss?uid=swg1IC81390; http://www-01.ibm.com/support/docview.wss?uid=swg1IC81836
CVE: CVE-2012-0710
Published: 2012-03-20
Description: IBM DB2 9.1 before FP11, 9.5 before FP9, 9.7 before FP5, and 9.8 before FP4 allows remote attackers to cause a denial of service (daemon crash) via a crafted Distributed Relational Database Architecture (DRDA) request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC76781; http://www-01.ibm.com/support/docview.wss?uid=swg1IC76899; http://www-01.ibm.com/support/docview.wss?uid=swg1IC76901
CVE: CVE-2012-0711
Published: 2012-03-20
Description: Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.5 before FP9, and 9.7 through FP5 on UNIX platforms allows remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC80561; http://www-01.ibm.com/support/docview.wss?uid=swg1IC80728; http://www-01.ibm.com/support/docview.wss?uid=swg1IC80729
CVE: CVE-2012-0712
Published: 2012-03-20
Description: The XML feature in IBM DB2 9.5 before FP9, 9.7 through FP5, and 9.8 through FP4 allows remote authenticated users to cause a denial of service (infinite loop) by calling the XMLPARSE function with a crafted string expression.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC81379; http://www-01.ibm.com/support/docview.wss?uid=swg1IC81380; http://www-01.ibm.com/support/docview.wss?uid=swg1IC81837
CVE: CVE-2012-1796
Published: 2012-03-20
Description: Unspecified vulnerability in IBM Tivoli Monitoring Agent (ITMA), as used in IBM DB2 9.5 before FP9 on UNIX, allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC79970; http://www-01.ibm.com/support/docview.wss?uid=swg21586193; https://exchange.xforce.ibmcloud.com/vulnerabilities/74325
CVE: CVE-2012-1797
Published: 2012-03-20
Description: IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC79518; http://www-01.ibm.com/support/docview.wss?uid=swg1IC79518; https://exchange.xforce.ibmcloud.com/vulnerabilities/74326
CVE: CVE-2012-1419
Published: 2012-03-21
Description: The TAR file parser in ClamAV 0.96.4 and Quick Heal (aka Cat QuickHeal) 11.00 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial [aliases] character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80409; http://www.ieee-security.org/TC/SP2012/program.html; http://www.securityfocus.com/archive/1/522005
CVE: CVE-2012-1420
Published: 2012-03-21
Description: The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, Panda Antivirus 10.0.2.7, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \7fELF character sequence.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80403; http://osvdb.org/80406; http://osvdb.org/80407
CVE: CVE-2012-1421
Published: 2012-03-21
Description: The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Norman Antivirus 6.06.12, Rising Antivirus 22.83.00.03, and AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial MSCF character sequence.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80409; http://www.ieee-security.org/TC/SP2012/program.html; http://www.securityfocus.com/archive/1/522005
CVE: CVE-2012-1422
Published: 2012-03-21
Description: The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial ITSF character sequence.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80409; http://www.ieee-security.org/TC/SP2012/program.html; http://www.securityfocus.com/archive/1/522005
CVE: CVE-2012-1423
Published: 2012-03-21
Description: The TAR file parser in Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, K7 AntiVirus 9.77.3565, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial MZ character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80393; http://osvdb.org/80395; http://osvdb.org/80396
CVE: CVE-2012-1424
Published: 2012-03-21
Description: The TAR file parser in Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Jiangmin Antivirus 13.0.900, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a POSIX TAR file with a \19\04\00\10 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80390; http://osvdb.org/80391; http://osvdb.org/80392
CVE: CVE-2012-1425
Published: 2012-03-21
Description: The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, and Trend Micro HouseCall 9.120.0.1004 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \50\4B\03\04 character sequence.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80389; http://osvdb.org/80391; http://osvdb.org/80392
CVE: CVE-2012-1426
Published: 2012-03-21
Description: The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, K7 AntiVirus 9.77.3565, Norman Antivirus 6.06.12, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \42\5A\68 character sequence.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80406; http://osvdb.org/80407; http://osvdb.org/80409
CVE: CVE-2012-1427
Published: 2012-03-21
Description: The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Norman Antivirus 6.06.12, and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a POSIX TAR file with a \57\69\6E\5A\69\70 character sequence at a certain location.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80390; http://osvdb.org/80409; http://www.ieee-security.org/TC/SP2012/program.html
CVE: CVE-2012-1428
Published: 2012-03-21
Description: The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Norman Antivirus 6.06.12, and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a POSIX TAR file with a \4a\46\49\46 character sequence at a certain location.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/80390; http://osvdb.org/80409; http://www.ieee-security.org/TC/SP2012/program.html