deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-3176
Published: 2012-04-09
Description: Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x4c request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=rs4B5jhWKf8~; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5127930.html; http://www.exploit-db.com/exploits/19959
CVE: CVE-2011-4188
Published: 2012-04-09
Description: Buffer overflow in the Create Attribute function in jclient in Novell iManager 2.7.4 before patch 4 allows remote authenticated users to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted EnteredAttrName parameter, a related issue to CVE-2010-1929.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/48672; http://www.novell.com/support/viewContent.do?externalId=7002971; http://www.securitytracker.com/id?1026894
CVE: CVE-2012-0742
Published: 2012-04-09
Description: IBM Tivoli Event Pump 4.2.2, when the LOG_REQUESTS and VALIDATE_SOAP_USERS options are enabled, places credentials into the AOPSCLOG (aka AOPLOG) data set, which allows local users to obtain sensitive information by reading the data.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1OA38586; https://exchange.xforce.ibmcloud.com/vulnerabilities/74641; http://www-01.ibm.com/support/docview.wss?uid=swg1OA38586
CVE: CVE-2012-2215
Published: 2012-04-09
Description: Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://download.novell.com/Download?buildid=rs4B5jhWKf8~; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5127930.html; http://www.novell.com/support/viewContent.do?externalId=7010044
CVE: CVE-2012-0146
Published: 2012-04-10
Description: Open redirect vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "UAG Blind HTTP Redirect Vulnerability."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/81131; http://secunia.com/advisories/48787; http://www.securityfocus.com/bid/52903
CVE: CVE-2012-0147
Published: 2012-04-10
Description: Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 does not properly configure the default web site, which allows remote attackers to obtain sensitive information via a crafted HTTPS request, aka "Unfiltered Access to UAG Default Website Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://osvdb.org/81132; http://secunia.com/advisories/48787; http://www.securityfocus.com/bid/52909
CVE: CVE-2012-0151
Published: 2012-04-10
Description: The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute arbitrary code via a modified file with additional content, aka "WinVerifyTrust Signature Validation Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://osvdb.org/81135; http://secunia.com/advisories/48581; http://www.securitytracker.com/id?1026906
CVE: CVE-2012-0158
Published: 2012-04-10
Description: The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://opensources.info/comment-on-the-curious-case-of-a-cve-2012-0158-exploit-by-chris-pierce/; http://www.securityfocus.com/bid/52911; http://www.securitytracker.com/id?1026899
CVE: CVE-2012-0163
Published: 2012-04-10
Description: Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate function parameters, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Parameter Validation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id?1026907; http://www.us-cert.gov/cas/techalerts/TA12-101A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-025
CVE: CVE-2012-0168
Published: 2012-04-10
Description: Microsoft Internet Explorer 6 through 9 allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document that is not properly handled during a "Print table of links" print operation, aka "Print Feature Remote Code Execution Vulnerability."
CVSS Score: 7.6 (HIGH)
CWE: CWE-94
References: http://osvdb.org/81126; http://www.securitytracker.com/id?1026901; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-023
CVE: CVE-2012-0169
Published: 2012-04-10
Description: Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "JScript9 Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/81127; http://www.securityfocus.com/bid/52902; http://www.securitytracker.com/id?1026901
CVE: CVE-2012-0170
Published: 2012-04-10
Description: Microsoft Internet Explorer 6 and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnReadyStateChange Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/81128; http://www.securitytracker.com/id?1026901; http://www.us-cert.gov/cas/techalerts/TA12-101A.html
CVE: CVE-2012-0171
Published: 2012-04-10
Description: Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "SelectAll Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securitytracker.com/id?1026901; http://www.us-cert.gov/cas/techalerts/TA12-101A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-023
CVE: CVE-2012-0172
Published: 2012-04-10
Description: Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "VML Style Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securitytracker.com/id?1026901; http://www.us-cert.gov/cas/techalerts/TA12-101A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-023
CVE: CVE-2012-0177
Published: 2012-04-10
Description: Heap-based buffer overflow in the Office Works File Converter in Microsoft Office 2007 SP2, Works 9, and Works 6-9 File Converter allows remote attackers to execute arbitrary code via a crafted Works (aka .wps) file, aka "Office WPS Converter Heap Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/81134; http://secunia.com/advisories/48723; http://www.securityfocus.com/bid/52867
CVE: CVE-2012-1182
Published: 2012-04-10
Description: The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2012/May/msg00001.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078258.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078726.html
CVE: CVE-2012-0774
Published: 2012-04-10
Description: Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitrary code via a crafted TrueType font.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00017.html
CVE: CVE-2012-0775
Published: 2012-04-10
Description: The JavaScript implementation in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00017.html
CVE: CVE-2012-0776
Published: 2012-04-10
Description: The installer in Adobe Reader 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.adobe.com/support/security/bulletins/apsb12-08.html; http://www.securitytracker.com/id?1026908; http://www.us-cert.gov/cas/techalerts/TA12-101B.html
CVE: CVE-2012-0777
Published: 2012-04-10
Description: The JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 on Mac OS X and Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00017.html
CVE: CVE-2012-0041
Published: 2012-04-11
Description: The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a capture file, as demonstrated by an airopeek file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=40164; http://rhn.redhat.com/errata/RHSA-2013-0125.html; http://secunia.com/advisories/47494
CVE: CVE-2012-0042
Published: 2012-04-11
Description: Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet, related to epan/to_str.c.
CVSS Score: 2.9 (LOW)
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=40194; http://rhn.redhat.com/errata/RHSA-2013-0125.html; http://secunia.com/advisories/47494
CVE: CVE-2012-0043
Published: 2012-04-11
Description: Buffer overflow in the reassemble_message function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a series of fragmented RLC packets.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=40266; http://secunia.com/advisories/47494; http://secunia.com/advisories/54425
CVE: CVE-2012-0066
Published: 2012-04-11
Description: Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or (3) NETMON 2 capture file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=40165; http://anonsvn.wireshark.org/viewvc?view=revision&revision=40166; http://rhn.redhat.com/errata/RHSA-2013-0125.html
CVE: CVE-2012-0067
Published: 2012-04-11
Description: wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in an AIX iptrace file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=40167; http://rhn.redhat.com/errata/RHSA-2013-0125.html; http://secunia.com/advisories/47494
CVE: CVE-2012-0068
Published: 2012-04-11
Description: The lanalyzer_read function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a Novell capture file containing a record that is too small.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=40169; http://secunia.com/advisories/47494; http://secunia.com/advisories/54425
CVE: CVE-2012-1030
Published: 2012-04-11
Description: Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://technet.microsoft.com/en-us/security/msvr/msvr12-003; http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx; http://technet.microsoft.com/en-us/security/msvr/msvr12-003
CVE: CVE-2012-1036
Published: 2012-04-11
Description: Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://technet.microsoft.com/en-us/security/msvr/msvr12-002; http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx; http://technet.microsoft.com/en-us/security/msvr/msvr12-002
CVE: CVE-2012-1499
Published: 2012-04-11
Description: The JPEG 2000 codec (jp2.c) in OpenJPEG before 1.5 allows remote attackers to execute arbitrary code via a crafted palette index in a CMAP record of a JPEG image, which triggers memory corruption, aka "out-of heap-based buffer write."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/openjpeg/source/detail?r=1330; http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html
CVE: CVE-2012-1593
Published: 2012-04-11
Description: epan/dissectors/packet-ansi_a.c in the ANSI A dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed packet.
CVSS Score: 3.3 (LOW)
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=40962; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078769.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078770.html
CVE: CVE-2012-1594
Published: 2012-04-11
Description: epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 3.3 (LOW)
CWE: CWE-94
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=40967; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078770.html; http://secunia.com/advisories/48548
CVE: CVE-2012-1595
Published: 2012-04-11
Description: The pcap_process_pseudo_header function in wiretap/pcap-common.c in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a WTAP_ENCAP_ERF file containing an Extension or Multi-Channel header with an invalid pseudoheader size, related to the pcap and pcap-ng file parsers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=41008; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078769.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078770.html
CVE: CVE-2012-1596
Published: 2012-04-11
Description: The mp2t_process_fragmented_payload function in epan/dissectors/packet-mp2t.c in the MP2T dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a packet containing an invalid pointer value that triggers an incorrect memory-allocation attempt.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://anonsvn.wireshark.org/viewvc?view=revision&revision=41001; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078769.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078770.html
CVE: CVE-2012-1672
Published: 2012-04-11
Description: SQL injection vulnerability in getcity.php in Hotel Booking Portal 0.1 allows remote attackers to execute arbitrary SQL commands via the country parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18702/; http://www.securityfocus.com/bid/52879; https://exchange.xforce.ibmcloud.com/vulnerabilities/74612
CVE: CVE-2012-1673
Published: 2012-04-11
Description: SQL injection vulnerability in loginscript.php in e-ticketing allows remote attackers to execute arbitrary SQL commands via the password parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18700/; http://www.securityfocus.com/bid/52878; https://exchange.xforce.ibmcloud.com/vulnerabilities/74613
CVE: CVE-2012-1992
Published: 2012-04-11
Description: Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/52850; http://www.webapp-security.com/wp-content/uploads/2012/04/CMS-Made-Simple-1.10.3-XSS-Vulnerability2.txt; http://www.securityfocus.com/bid/52850
CVE: CVE-2012-2156
Published: 2012-04-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the u_email parameter (aka Authors Email field) to manager/users.php, (2) the u_realname parameter (aka Authors Name field) to manager/users.php, or (3) the c_author parameter (aka Author field) in an ADD A COMMENT section.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/80960; http://osvdb.org/80961; http://www.exploit-db.com/exploits/18699
CVE: CVE-2012-2210
Published: 2012-04-11
Description: The Sony Bravia TV KDL-32CX525 allows remote attackers to cause a denial of service (configuration outage or device crash) via a flood of TCP SYN packets, as demonstrated by hping, a related issue to CVE-1999-0116.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0043.html; http://osvdb.org/80957; http://secunia.com/advisories/48705
CVE: CVE-2012-2223
Published: 2012-04-11
Description: The xplat agent in Novell ZENworks Configuration Management (ZCM) 10.3.x before 10.3.4 and 11.x before 11.2 enables the HTTP TRACE method, which might make it easier for remote attackers to conduct cross-site tracing (XST) attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.novell.com/support/viewContent.do?externalId=7008244; http://www.novell.com/support/viewContent.do?externalId=7010044; http://www.novell.com/support/viewContent.do?externalId=7010137
CVE: CVE-2012-2224
Published: 2012-04-11
Description: Xunlei Thunder before 7.2.6 allows remote attackers to execute arbitrary code via a crafted file, related to a "DLL injection vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://blog.vulnhunt.com/index.php/2012/03/06/cal-2012-0006xunlei-dll-injection-vulnerability/; http://safe.xunlei.com/announce/xl20120306.html; http://www.securityfocus.com/bid/53191
CVE: CVE-2012-2225
Published: 2012-04-11
Description: 360zip 1.93beta allows remote attackers to execute arbitrary code via vectors related to file browsing and file extraction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://blog.vulnhunt.com/index.php/2012/01/01/cal-2011-0080/; https://exchange.xforce.ibmcloud.com/vulnerabilities/74810; http://blog.vulnhunt.com/index.php/2012/01/01/cal-2011-0080/
CVE: CVE-2011-3846
Published: 2012-04-12
Description: Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) 6.2.2.7 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/43012; http://secunia.com/advisories/43012
CVE: CVE-2012-0133
Published: 2012-04-12
Description: HP ProCurve 5400 zl switches with certain serial numbers include a compact flash card that contains an unspecified virus, which might allow user-assisted remote attackers to execute arbitrary code on a PC by leveraging manual transfer of this card.
CVSS Score: 3.7 (LOW)
References: http://secunia.com/advisories/48738; http://www.securityfocus.com/archive/1/522288; http://www.securitytracker.com/id?1026916
CVE: CVE-2012-1574
Published: 2012-04-12
Description: The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0051.html; http://seclists.org/fulldisclosure/2012/Apr/70; http://secunia.com/advisories/48775
CVE: CVE-2012-2230
Published: 2012-04-12
Description: Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskcontroller.cfg, which allows remote authenticated users to impersonate arbitrary user accounts via unspecified vectors, a different vulnerability than CVE-2012-1574.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/48776; https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin; https://exchange.xforce.ibmcloud.com/vulnerabilities/74823
CVE: CVE-2011-4874
Published: 2012-04-13
Description: Use-after-free vulnerability in MICROSYS PROMOTIC before 8.1.7 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (data corruption and application crash) via a crafted project (aka .pra) file.
CVSS Score: 7.9 (HIGH)
CWE: CWE-399
References: http://www.promotic.eu/en/pmdoc/News.htm#ver80107; http://www.securityfocus.com/bid/52988; http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-03.pdf
CVE: CVE-2011-4880
Published: 2012-04-13
Description: Directory traversal vulnerability in the web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 allows remote attackers to read arbitrary files via a crafted HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-01.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-01.pdf