deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-0459
Published: 2012-03-14
Description: The Cascading Style Sheets (CSS) implementation in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via dynamic modification of a keyframe followed by access to the cssText of the keyframe.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html; http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html; http://rhn.redhat.com/errata/RHSA-2012-0387.html
CVE: CVE-2012-0460
Published: 2012-03-14
Description: Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict write access to the window.fullScreen object, which allows remote attackers to spoof the user interface via a crafted web page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html; http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html; http://rhn.redhat.com/errata/RHSA-2012-0387.html
CVE: CVE-2012-0461
Published: 2012-03-14
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html; http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
CVE: CVE-2012-0462
Published: 2012-03-14
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html; http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
CVE: CVE-2012-0463
Published: 2012-03-14
Description: The nsWindow implementation in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 does not check the validity of an instance after event dispatching, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, as demonstrated by Mobile Firefox on Android.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html; http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
CVE: CVE-2012-0464
Published: 2012-03-14
Description: Use-after-free vulnerability in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote attackers to execute arbitrary code via vectors involving an empty argument to the array.join function in conjunction with the triggering of garbage collection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html; http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
CVE: CVE-2012-0353
Published: 2012-03-15
Description: The UDP inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.0 before 8.0(5.25), 8.1 before 8.1(2.50), 8.2 before 8.2(5.5), 8.3 before 8.3(2.22), 8.4 before 8.4(2.1), and 8.5 before 8.5(1.2) does not properly handle flows, which allows remote attackers to cause a denial of service (device reload) via a crafted series of (1) IPv4 or (2) IPv6 UDP packets, aka Bug ID CSCtq10441.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://osvdb.org/80043; http://secunia.com/advisories/48423; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120314-asa
CVE: CVE-2012-0354
Published: 2012-03-15
Description: The Threat Detection feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.0 through 8.2 before 8.2(5.20), 8.3 before 8.3(2.29), 8.4 before 8.4(3), 8.5 before 8.5(1.6), and 8.6 before 8.6(1.1) allows remote attackers to cause a denial of service (device reload) via (1) IPv4 or (2) IPv6 packets that trigger a shun event, aka Bug ID CSCtw35765.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://osvdb.org/80044; http://secunia.com/advisories/48423; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120314-asa
CVE: CVE-2012-0355
Published: 2012-03-15
Description: Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.4 before 8.4(2.11) and 8.5 before 8.5(1.4) allow remote attackers to cause a denial of service (device reload) via (1) IPv4 or (2) IPv6 packets that trigger syslog message 305006, aka Bug ID CSCts39634.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/80045; http://secunia.com/advisories/48423; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120314-asa
CVE: CVE-2012-0356
Published: 2012-03-15
Description: Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 7.0 through 7.2 before 7.2(5.7), 8.0 before 8.0(5.27), 8.1 before 8.1(2.53), 8.2 before 8.2(5.8), 8.3 before 8.3(2.25), 8.4 before 8.4(2.5), and 8.5 before 8.5(1.2) and the Firewall Services Module (FWSM) 3.1 and 3.2 before 3.2(23) and 4.0 and 4.1 before 4.1(8) in Cisco Catalyst 6500 series devices, when multicast routing is enabled, allow remote attackers to cause a denial of service (device reload) via a crafted IPv4 PIM message, aka Bug IDs CSCtr47517 and CSCtu97367.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/80041; http://secunia.com/advisories/48421; http://secunia.com/advisories/48423
CVE: CVE-2012-0358
Published: 2012-03-15
Description: Buffer overflow in the Cisco Port Forwarder ActiveX control in cscopf.ocx, as distributed through the Clientless VPN feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.0 through 7.2 before 7.2(5.6), 8.0 before 8.0(5.26), 8.1 before 8.1(2.53), 8.2 before 8.2(5.18), 8.3 before 8.3(2.28), 8.2 before 8.4(2.16), and 8.6 before 8.6(1.1), allows remote attackers to execute arbitrary code via unspecified vectors, aka Bug ID CSCtr00165.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120314-asaclient; http://www.kb.cert.org/vuls/id/339177; http://www.securitytracker.com/id?1026799
CVE: CVE-2012-0398
Published: 2012-03-15
Description: EMC Documentum eRoom before 7.4.4 does not properly validate session cookies, which allows remote attackers to hijack or replay sessions via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0057.html; http://archives.neohapsis.com/archives/bugtraq/2012-03/0057.html
CVE: CVE-2012-0404
Published: 2012-03-15
Description: Cross-site scripting (XSS) vulnerability in EMC Documentum eRoom before 7.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0057.html; http://archives.neohapsis.com/archives/bugtraq/2012-03/0057.html
CVE: CVE-2011-4939
Published: 2012-03-15
Description: The pidgin_conv_chat_rename_user function in gtkconv.c in Pidgin before 2.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by changing a nickname while in an XMPP chat room.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://developer.pidgin.im/ticket/14392; http://developer.pidgin.im/viewmtn/revision/diff/10ead4688e3af4132d454fa3bc[PII_REDACTED]51c9/with/d1d77da56217f3a083e1d459bef054db9f1d5699/pidgin/gtkconv.c; http://developer.pidgin.im/viewmtn/revision/info/d1d77da56217f3a083e1d459bef054db9f1d5699
CVE: CVE-2012-1178
Published: 2012-03-15
Description: The msn_oim_report_to_user function in oim.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.2 allows remote servers to cause a denial of service (application crash) via an OIM message that lacks UTF-8 encoding.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://developer.pidgin.im/ticket/14884; http://developer.pidgin.im/viewmtn/revision/diff/60f8379d0a610538cf42e0dd9ab1436c8b9308cd/with/3053d6a37cc6d8774aba7607b992a4408216adcd/libpurple/protocols/msn/oim.c; http://developer.pidgin.im/viewmtn/revision/info/3053d6a37cc6d8774aba7607b992a4408216adcd
CVE: CVE-2012-1165
Published: 2012-03-15
Description: The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message, a different vulnerability than CVE-2006-7250.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://cvs.openssl.org/chngview?cn=22252; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077086.html
CVE: CVE-2012-1481
Published: 2012-03-15
Description: Unspecified vulnerability in the Textdroid (com.app.android.textdroid) application 2.5.2 for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/80168; http://www.securityfocus.com/bid/52490; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1481-vulnerability-in-Textdroid.html
CVE: CVE-2012-1482
Published: 2012-03-15
Description: Unspecified vulnerability in the TouchPal Contacts (com.cootek.smartdialer) application 3.3.1 and 4.0.1 for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/80169; http://www.securityfocus.com/bid/52491; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1482-vulnerability-in-TouchPalContacts.html
CVE: CVE-2012-1483
Published: 2012-03-15
Description: Unspecified vulnerability in the Message Forwarder (com.gmail.zbnetium) application 1.12.20110409.1 for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/80170; http://www.securityfocus.com/bid/52492; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1483-vulnerability-in-MessageForwarder.html
CVE: CVE-2012-1484
Published: 2012-03-15
Description: Unspecified vulnerability in the WaliSMS CN (cn.com.wali.walisms) application 2.9.2 and 3.7.0 for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/80171; http://www.securityfocus.com/bid/52495; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1484-vulnerability-in-WaliSMSCN.html
CVE: CVE-2012-1485
Published: 2012-03-15
Description: Unspecified vulnerability in the NetFront Life Browser (com.access_company.android.nflifebrowser.lite) application 2.2.0 and 2.3.0 for Android has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/80172; http://secunia.com/advisories/48557; http://www.securityfocus.com/bid/52480
CVE: CVE-2012-0229
Published: 2012-03-15
Description: The Data Archiver service in GE Intelligent Platforms Proficy Historian 4.5 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted session on TCP port 14000 to (1) ihDataArchiver.exe or (2) ihDataArchiver_x64.exe.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/48369; http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB14767; http://www.securityfocus.com/bid/52437
CVE: CVE-2012-0230
Published: 2012-03-15
Description: PRRDS.exe in the Proficy Remote Data Service in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TCP session on port 12299.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/48415; http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB14766; http://www.securityfocus.com/bid/52434
CVE: CVE-2012-0231
Published: 2012-03-15
Description: PRLicenseMgr.exe in the Proficy Server License Manager in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TCP session on port 12401.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/48415; http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB14766; http://www.securityfocus.com/bid/52434
CVE: CVE-2012-0232
Published: 2012-03-15
Description: Directory traversal vulnerability in rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6, 3.0, 3.0 SP1, and 3.5 allows remote attackers to modify the configuration via crafted strings.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB14768; http://www.securityfocus.com/bid/52439; http://www.us-cert.gov/control_systems/pdf/ICSA-12-032-03.pdf
CVE: CVE-2012-1508
Published: 2012-03-16
Description: The XPDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to gain guest OS privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0071.html; http://osvdb.org/80115; http://secunia.com/advisories/48378
CVE: CVE-2012-1509
Published: 2012-03-16
Description: Buffer overflow in the XPDM display driver in VMware View before 4.6.1 allows guest OS users to gain guest OS privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0071.html; http://osvdb.org/80116; http://secunia.com/advisories/48379
CVE: CVE-2012-1510
Published: 2012-03-16
Description: Buffer overflow in the WDDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to gain guest OS privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0071.html; http://osvdb.org/80117; http://secunia.com/advisories/48378
CVE: CVE-2012-1511
Published: 2012-03-16
Description: Cross-site scripting (XSS) vulnerability in View Manager Portal in VMware View before 4.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-03/0071.html; http://osvdb.org/80118; http://secunia.com/advisories/48379
CVE: CVE-2012-1512
Published: 2012-03-16
Description: Cross-site scripting (XSS) vulnerability in the internal browser in vSphere Client in VMware vSphere 4.1 before Update 2 and 5.0 before Update 1 allows remote attackers to inject arbitrary web script or HTML via a crafted log-file entry.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/80119; http://secunia.com/advisories/48387; http://www.securityfocus.com/bid/52525
CVE: CVE-2012-1513
Published: 2012-03-16
Description: The Web Configuration tool in VMware vCenter Orchestrator (vCO) 4.0 before Update 4, 4.1 before Update 2, and 4.2 before Update 1 places the vCenter Server password in an HTML document, which allows remote authenticated administrators to obtain sensitive information by reading this document.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/80120; http://secunia.com/advisories/48408; http://www.securityfocus.com/bid/52525
CVE: CVE-2012-1514
Published: 2012-03-16
Description: Cross-site request forgery (CSRF) vulnerability in VMware vShield Manager (vSM) 1.0.1 before Update 2 and 4.1.0 before Update 2 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/80121; http://secunia.com/advisories/48409; http://www.securityfocus.com/bid/52525
CVE: CVE-2012-0293
Published: 2012-03-17
Description: Multiple SQL injection vulnerabilities in Symantec Altiris WISE Package Studio before 8.0MR1 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/80201; http://www.securityfocus.com/bid/52392; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120314_00
CVE: CVE-2012-0326
Published: 2012-03-17
Description: The twicca application 0.7.0 through 0.9.30 for Android does not properly restrict the use of network privileges, which allows remote attackers to read media files on an SD card via a crafted application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN31860555/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000024; http://osvdb.org/80106
CVE: CVE-2012-1264
Published: 2012-03-18
Description: Unspecified vulnerability in Gretech GOM Media Player before 2.1.37.5091 allows remote attackers to execute arbitrary code via a crafted AVI file.
CVSS Score: 9.3 (HIGH)
References: http://gom.gomtv.com/gomIntro.html?type=4; https://exchange.xforce.ibmcloud.com/vulnerabilities/74121; http://gom.gomtv.com/gomIntro.html?type=4
CVE: CVE-2012-1774
Published: 2012-03-18
Description: Unspecified vulnerability in the Open URL feature in Gretech GOM Media Player before 2.1.39.5101 has unknown impact and attack vectors, a different vulnerability than CVE-2007-5779 and CVE-2012-1264.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/80203; http://player.gomlab.com/eng/download/; https://exchange.xforce.ibmcloud.com/vulnerabilities/74120
CVE: CVE-2012-1775
Published: 2012-03-19
Description: Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code via a crafted MMS:// stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=vlc/vlc-2.0.git%3Ba=commit%3Bh=11a95cce96fffdbaba1be6034d7b[PII_REDACTED]1c; http://www.exploit-db.com/exploits/18825; http://www.securityfocus.com/bid/52550
CVE: CVE-2012-1776
Published: 2012-03-19
Description: Multiple heap-based buffer overflows in VideoLAN VLC media player before 2.0.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Real RTSP stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/80189; http://www.securityfocus.com/bid/52550; http://www.videolan.org/security/sa1202.html
CVE: CVE-2009-5112
Published: 2012-03-19
Description: wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to obtain the installation path via a crafted request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://websecurity.com.ua/2628/; https://exchange.xforce.ibmcloud.com/vulnerabilities/74320; http://websecurity.com.ua/2628/
CVE: CVE-2009-5113
Published: 2012-03-19
Description: Cross-site scripting (XSS) vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the DOC parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://websecurity.com.ua/2628/; https://exchange.xforce.ibmcloud.com/vulnerabilities/74184; http://websecurity.com.ua/2628/
CVE: CVE-2009-5114
Published: 2012-03-19
Description: Directory traversal vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the DOC parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://websecurity.com.ua/2628/; https://exchange.xforce.ibmcloud.com/vulnerabilities/74321; http://websecurity.com.ua/2628/
CVE: CVE-2010-5086
Published: 2012-03-19
Description: Directory traversal vulnerability in wiki/rankings.php in Bitweaver 2.7 and 2.8.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the style parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://cross-site-scripting.blogspot.com/2010/07/bit-weaver-27-local-file-inclusion.html; http://secunia.com/advisories/40432; http://www.exploit-db.com/exploits/18530
CVE: CVE-2011-5082
Published: 2012-03-19
Description: Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka Coupon Code field).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/47954; http://www.primothemes.com/forums/viewtopic.php?f=4&t=16173#p56982; http://www.securityfocus.com/bid/51997
CVE: CVE-2011-5083
Published: 2012-03-19
Description: Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a file with an executable PHP extension, then accessing it via a direct request to the file in an unspecified directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://cxsecurity.com/issue/WLB[PII_REDACTED]; http://vigilance.fr/vulnerability/Dotclear-file-upload-via-swfupload-swf-11396; http://www.exploit-db.com/exploits/18529
CVE: CVE-2012-1297
Published: 2012-03-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete users via a delete action in the user module, (2) delete news via a delete action in the news module, or (3) delete newsletters via a delete action in the newsletters module.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://ivanobinetti.blogspot.com/2012/02/contaocms-fka-typolight-211-csrf-delete.html; http://packetstormsecurity.org/files/110214/ContaoCMS-2.11.0-Cross-Site-Request-Forgery.html; http://secunia.com/advisories/48180
CVE: CVE-2012-1778
Published: 2012-03-19
Description: SQL injection vulnerability in artykul_print.php in CreateVision CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18525; https://exchange.xforce.ibmcloud.com/vulnerabilities/73483; http://www.exploit-db.com/exploits/18525
CVE: CVE-2012-1779
Published: 2012-03-19
Description: Cross-site scripting (XSS) vulnerability in IDevSpot idev-BusinessDirectory 3.0 allows remote attackers to inject arbitrary web script or HTML via the SEARCH parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/79636; http://packetstormsecurity.org/files/110212/idev-BusinessDirectory-3.0-Cross-Site-Scripting.html; http://secunia.com/advisories/48173