deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2961
Published: 2012-07-23
Description: SQL injection vulnerability in the management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/108471; http://www.securityfocus.com/bid/54425; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
CVE: CVE-2012-2976
Published: 2012-07-23
Description: The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary shell commands via crafted input to application scripts, related to an "injection" issue.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www.kb.cert.org/vuls/id/108471; http://www.securityfocus.com/bid/54427; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
CVE: CVE-2012-2977
Published: 2012-07-23
Description: The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to change arbitrary passwords via crafted input to an application script.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/108471; http://www.securityfocus.com/bid/54430; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
CVE: CVE-2012-3387
Published: 2012-07-23
Description: Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33948; http://openwall.com/lists/oss-security/2012/07/17/1; http://secunia.com/advisories/49890
CVE: CVE-2012-3388
Published: 2012-07-23
Description: The is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 does not properly interact with the caching feature, which might allow remote authenticated users to bypass an intended capability check via unspecified vectors that trigger caching of a user record.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33916; http://openwall.com/lists/oss-security/2012/07/17/1; http://secunia.com/advisories/49890
CVE: CVE-2012-3389
Published: 2012-07-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in mod/lti/typessettings.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) lti_typename or (2) lti_toolurl parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31692; http://openwall.com/lists/oss-security/2012/07/17/1; http://secunia.com/advisories/49890
CVE: CVE-2012-3390
Published: 2012-07-23
Description: lib/filelib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly restrict file access after a block has been hidden, which allows remote authenticated users to obtain sensitive information by reading a file that is embedded in a block.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=c58c05ad4f22c6ee1e136a7d4caaddd809a7134d; http://openwall.com/lists/oss-security/2012/07/17/1; http://secunia.com/advisories/49890
CVE: CVE-2012-3391
Published: 2012-07-23
Description: mod/forum/rsslib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly implement the requirement for posting before reading a Q&A forum, which allows remote authenticated users to bypass intended access restrictions by leveraging the student role and reading the RSS feed for a forum.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=refs%2Fheads%2FMOODLE_22_STABLE&st=commit&s=MDL-32199; http://openwall.com/lists/oss-security/2012/07/17/1; http://secunia.com/advisories/49890
CVE: CVE-2012-3392
Published: 2012-07-23
Description: mod/forum/unsubscribeall.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not consider whether a forum is optional, which allows remote authenticated users to bypass forum-subscription requirements by leveraging the student role and unsubscribing from all forums.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-16
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=refs%2Fheads%2FMOODLE_22_STABLE&st=commit&s=MDL-31460; http://openwall.com/lists/oss-security/2012/07/17/1; http://secunia.com/advisories/49890
CVE: CVE-2012-3393
Published: 2012-07-23
Description: Cross-site scripting (XSS) vulnerability in repository/lib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 allows remote authenticated administrators to inject arbitrary web script or HTML by renaming a repository.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=refs%2Fheads%2FMOODLE_22_STABLE&st=commit&s=MDL-33808; http://openwall.com/lists/oss-security/2012/07/17/1; http://secunia.com/advisories/49890
CVE: CVE-2012-3394
Published: 2012-07-23
Description: auth/ldap/ntlmsso_attempt.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 redirects users from an https LDAP login URL to an http URL, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=9d8d2ee6192e8b7ebb6713bd6215e06f94e2a9f7; http://openwall.com/lists/oss-security/2012/07/17/1; http://secunia.com/advisories/49890
CVE: CVE-2012-3395
Published: 2012-07-23
Description: SQL injection vulnerability in mod/feedback/complete.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to execute arbitrary SQL commands via crafted form data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=9d8d2ee6192e8b7ebb6713bd6215e06f94e2a9f7&st=commit&s=MDL-27675; http://openwall.com/lists/oss-security/2012/07/17/1; http://secunia.com/advisories/49890
CVE: CVE-2012-3396
Published: 2012-07-23
Description: Cross-site scripting (XSS) vulnerability in cohort/edit_form.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the idnumber field.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2365.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34045; http://openwall.com/lists/oss-security/2012/07/17/1; http://secunia.com/advisories/49890
CVE: CVE-2012-3397
Published: 2012-07-23
Description: lib/modinfolib.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 does not check for a group-membership requirement when determining whether an activity is unavailable or hidden, which allows remote authenticated users to bypass intended access restrictions by selecting an activity that is configured for a group of other users.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33466; http://openwall.com/lists/oss-security/2012/07/17/1; http://secunia.com/advisories/49890
CVE: CVE-2012-3398
Published: 2012-07-23
Description: Algorithmic complexity vulnerability in Moodle 1.9.x before 1.9.19, 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to cause a denial of service (CPU consumption) by using the advanced-search feature on a database activity that has many records.
CVSS Score: 4.0 (MEDIUM)
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=refs%2Fheads%2FMOODLE_22_STABLE&st=commit&s=MDL-32126; http://openwall.com/lists/oss-security/2012/07/17/1; http://secunia.com/advisories/49890
CVE: CVE-2012-4048
Published: 2012-07-24
Description: The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted packet, as demonstrated by a usbmon dump.
CVSS Score: 3.3 (LOW)
CWE: CWE-94
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=680056; http://lists.opensuse.org/opensuse-updates/2012-08/msg00000.html; http://secunia.com/advisories/49971
CVE: CVE-2012-4049
Published: 2012-07-24
Description: epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet.
CVSS Score: 2.9 (LOW)
CWE: CWE-94
References: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-nfs.c?r1=43576&r2=43575&pathrev=43576; http://anonsvn.wireshark.org/viewvc?view=revision&revision=43576; http://lists.opensuse.org/opensuse-updates/2012-08/msg00000.html
CVE: CVE-2012-4050
Published: 2012-07-24
Description: Multiple unspecified vulnerabilities in Google Chrome OS before 21.0.1180.50 on the Cr-48 and Samsung Series 5 and 5 550 Chromebook platforms, and the Samsung Chromebox Series 3, have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2012/07/beta-channel-update-for-chrome-os.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/77191; http://googlechromereleases.blogspot.com/2012/07/beta-channel-update-for-chrome-os.html
CVE: CVE-2012-2194
Published: 2012-07-25
Description: Directory traversal vulnerability in the SQLJ.DB2_INSTALL_JAR stored procedure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to replace JAR files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/49919; http://www-01.ibm.com/support/docview.wss?uid=swg1IC84019; http://www-01.ibm.com/support/docview.wss?uid=swg1IC84711
CVE: CVE-2012-2196
Published: 2012-07-25
Description: IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to read arbitrary XML files via the (1) GET_WRAP_CFG_C or (2) GET_WRAP_CFG_C2 stored procedure.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/49919; http://www-01.ibm.com/support/docview.wss?uid=swg1IC84614; http://www-01.ibm.com/support/docview.wss?uid=swg1IC84712
CVE: CVE-2012-2197
Published: 2012-07-25
Description: Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote authenticated users to execute arbitrary code by leveraging certain CONNECT and EXECUTE privileges.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/49919; http://www-01.ibm.com/support/docview.wss?uid=swg1IC84555; http://www-01.ibm.com/support/docview.wss?uid=swg1IC84752
CVE: CVE-2012-2646
Published: 2012-07-25
Description: The Sleipnir Mobile application before 2.1.0 and Sleipnir Mobile Black Edition application before 2.1.0 for Android do not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN88643450/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000071; https://play.google.com/store/apps/details?id=jp.co.fenrir.android.sleipnir
CVE: CVE-2012-3570
Published: 2012-07-25
Description: Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and daemon exit) via a crafted client identifier parameter.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2012-08/msg00030.html; http://security.gentoo.org/glsa/glsa-201301-06.xml; http://www.mandriva.com/security/advisories?name=MDVSA-2012:115
CVE: CVE-2012-3571
Published: 2012-07-25
Description: ISC DHCP 4.1.2 through 4.2.4 and 4.1-ESV before 4.1-ESV-R6 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed client identifier.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.opensuse.org/opensuse-updates/2012-08/msg00030.html; http://rhn.redhat.com/errata/RHSA-2012-1140.html
CVE: CVE-2012-3817
Published: 2012-07-25
Description: ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) by sending many queries.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html; http://lists.opensuse.org/opensuse-updates/2012-08/msg00013.html; http://lists.opensuse.org/opensuse-updates/2012-08/msg00015.html
CVE: CVE-2012-3868
Published: 2012-07-25
Description: Race condition in the ns_client structure management in ISC BIND 9.9.x before 9.9.1-P2 allows remote attackers to cause a denial of service (memory consumption or process exit) via a large volume of TCP queries.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://www.slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.536004; https://kb.isc.org/article/AA-00730; http://www.slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.536004
CVE: CVE-2012-3954
Published: 2012-07-25
Description: Multiple memory leaks in ISC DHCP 4.1.x and 4.2.x before 4.2.4-P1 and 4.1-ESV before 4.1-ESV-R6 allow remote attackers to cause a denial of service (memory consumption) by sending many requests.
CVSS Score: 3.3 (LOW)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-updates/2012-08/msg00030.html; http://rhn.redhat.com/errata/RHSA-2012-1141.html; http://security.gentoo.org/glsa/glsa-201301-06.xml
CVE: CVE-2005-4895
Published: 2012-07-25
Description: Multiple integer overflows in TCMalloc (tcmalloc.cc) in gperftools before 0.4 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://code.google.com/p/gperftools/source/browse/tags/perftools-0.4/ChangeLog; http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/; http://code.google.com/p/gperftools/source/browse/tags/perftools-0.4/ChangeLog
CVE: CVE-2006-7252
Published: 2012-07-25
Description: Integer overflow in the calloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which triggers a memory allocation of one byte.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/; http://svnweb.freebsd.org/base?view=revision&revision=161263; http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/
CVE: CVE-2007-6754
Published: 2012-07-25
Description: The ipalloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD does not properly allocate memory, which makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, related to "integer rounding and overflow" errors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/; http://svnweb.freebsd.org/base?view=revision&revision=167872; http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/
CVE: CVE-2012-0678
Published: 2012-07-25
Description: Cross-site scripting (XSS) vulnerability in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML via a feed:// URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html; http://support.apple.com/kb/HT5400; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2012-0679
Published: 2012-07-25
Description: Apple Safari before 6.0 allows remote attackers to read arbitrary files via a feed:// URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html; http://support.apple.com/kb/HT5400; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2012-0680
Published: 2012-07-25
Description: Apple Safari before 6.0 does not properly handle the autocomplete attribute of a password input element, which allows remote attackers to bypass authentication by leveraging an unattended workstation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://support.apple.com/kb/HT5400
CVE: CVE-2012-2673
Published: 2012-07-25
Description: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/; http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082926.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082988.html
CVE: CVE-2012-2674
Published: 2012-07-25
Description: Multiple integer overflows in the (1) chk_malloc, (2) leak_malloc, and (3) leak_memalign functions in libc/bionic/malloc_debug_leak.c in Bionic (libc) for Android, when libc.debug.malloc is set, make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/; http://www.openwall.com/lists/oss-security/2012/06/05/1; http://www.openwall.com/lists/oss-security/2012/06/07/13
CVE: CVE-2012-2675
Published: 2012-07-25
Description: Multiple integer overflows in the (1) CallMalloc (malloc) and (2) nedpcalloc (calloc) functions in nedmalloc (nedmalloc.c) before 1.10 beta2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/; http://www.openwall.com/lists/oss-security/2012/06/05/1; http://www.openwall.com/lists/oss-security/2012/06/07/13
CVE: CVE-2012-2676
Published: 2012-07-25
Description: Multiple integer overflows in the (1) malloc and (2) calloc functions in Hoard before 3.9 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows on implementing code via a large size value, which causes less memory to be allocated than expected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/; http://www.openwall.com/lists/oss-security/2012/06/05/1; http://www.openwall.com/lists/oss-security/2012/06/07/13
CVE: CVE-2012-2677
Published: 2012-07-25
Description: Integer overflow in the ordered_malloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large memory chunk size value, which causes less memory to be allocated than expected.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/; http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083416.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082977.html
CVE: CVE-2012-2760
Published: 2012-07-25
Description: mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-05/0235.html; http://packetstormsecurity.org/files/112991/Mod_Auth_OpenID-Session-Stealing.html; http://secunia.com/advisories/49247
CVE: CVE-2012-3650
Published: 2012-07-25
Description: WebKit in Apple Safari before 6.0 accesses uninitialized memory locations during the rendering of SVG images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://support.apple.com/kb/HT5400
CVE: CVE-2012-3689
Published: 2012-07-25
Description: WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to bypass the Same Origin Policy via a crafted web site.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html; http://support.apple.com/kb/HT5400; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2012-3690
Published: 2012-07-25
Description: WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to read arbitrary files via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html; http://support.apple.com/kb/HT5400; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2012-3691
Published: 2012-07-25
Description: WebKit in Apple Safari before 6.0 does not properly handle Cascading Style Sheets (CSS) property values, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://support.apple.com/kb/HT5400
CVE: CVE-2012-3693
Published: 2012-07-25
Description: Incomplete blacklist vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, by leveraging the availability of IDN support and Unicode fonts to construct unspecified homoglyphs.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://support.apple.com/kb/HT5400
CVE: CVE-2012-3694
Published: 2012-07-25
Description: WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to obtain sensitive information about full pathnames via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html; http://support.apple.com/kb/HT5400; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html