deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-3579
Published: 2011-09-30
Description: server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2011-09/0145.html; http://securityreason.com/securityalert/8404; http://securitytracker.com/id?1026093
CVE: CVE-2011-3580
Published: 2011-09-30
Description: IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to obtain configuration information via a direct request to the /server URI, which triggers a call to the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2011-09/0145.html; http://securityreason.com/securityalert/8404; http://securitytracker.com/id?1026093
CVE: CVE-2011-0552
Published: 2011-10-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the management console in Symantec IM Manager before 8.4.18 allow remote attackers to inject arbitrary web script or HTML via the (1) refreshRateSetting parameter to IMManager/Admin/IMAdminSystemDashboard.asp, the (2) nav or (3) menuitem parameter to IMManager/Admin/IMAdminTOC_simple.asp, or the (4) action parameter to IMManager/Admin/IMAdminEdituser.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/43157; http://securitytracker.com/id?1026130; http://www.securityfocus.com/bid/49739
CVE: CVE-2011-0553
Published: 2011-10-02
Description: SQL injection vulnerability in the management console in Symantec IM Manager before 8.4.18 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/43157; http://securitytracker.com/id?1026130; http://www.securityfocus.com/bid/49738
CVE: CVE-2011-0554
Published: 2011-10-02
Description: The management console in Symantec IM Manager before 8.4.18 allows remote attackers to execute arbitrary code via unspecified vectors, related to a "code injection issue."
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/43157; http://securitytracker.com/id?1026130; http://www.securityfocus.com/bid/49742
CVE: CVE-2011-2673
Published: 2011-10-02
Description: Cross-site scripting (XSS) vulnerability in BaserCMS before 1.6.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://basercms.net/patch/JVN09789751; http://jvn.jp/en/jp/JVN09789751/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000065
CVE: CVE-2011-2674
Published: 2011-10-02
Description: BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://basercms.net/patch/JVN09789751; http://jvn.jp/en/jp/JVN16617002/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000066
CVE: CVE-2011-2411
Published: 2011-10-02
Description: Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543; http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543
CVE: CVE-2011-3362
Published: 2011-10-02
Description: Integer signedness error in the decode_residual_block function in cavsdec.c in libavcodec in FFmpeg before 0.7.3 and 0.8.x before 0.8.2, and libav through 0.7.1, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Chinese AVS video (aka CAVS) file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=91d5da9321c52e8197fb14046ebb335f3e6ff4a0; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=c5cbda50793e311aa73489d12184ffd6761c9fbf; http://secunia.com/advisories/45532
CVE: CVE-2011-3371
Published: 2011-10-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) form_sent, (3) csrf_token, (4) req_confirm, or (5) delete parameter to delete.php, the (6) id, (7) form_sent, (8) csrf_token, (9) req_message, or (10) submit parameter to edit.php, the (11) action, (12) form_sent, (13) csrf_token, (14) req_email, or (15) request_pass parameter to login.php, the (16) email, (17) form_sent, (18) redirect_url, (19) csrf_token, (20) req_subject, (21) req_message, or (22) submit parameter to misc.php, the (23) action, (24) id, (25) form_sent, (26) csrf_token, (27) req_old_password, (28) req_new_password1, (29) req_new_password2, or (30) update parameter to profile.php, or the (31) action, (32) form_sent, (33) csrf_token, (34) req_username, (35) req_password1, (36) req_password2, (37) req_email1, (38) timezone, or (39) register parameter to register.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-09/0193.html; http://archives.neohapsis.com/archives/fulldisclosure/2011-09/0210.html; http://archives.neohapsis.com/archives/fulldisclosure/2011-09/0272.html
CVE: CVE-2011-3973
Published: 2011-10-02
Description: cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, related to the decode_residual_block, check_for_slice, and cavs_decode_frame functions, a different vulnerability than CVE-2011-3362.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=bd968d260aef322fb32e254a3de0d2036c57bd56; http://www.ffmpeg.org/releases/ffmpeg-0.7.5.changelog; http://www.ffmpeg.org/releases/ffmpeg-0.8.4.changelog
CVE: CVE-2011-3974
Published: 2011-10-02
Description: Integer signedness error in the decode_residual_inter function in cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, a different vulnerability than CVE-2011-3362.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=bd968d260aef322fb32e254a3de0d2036c57bd56; http://www.ffmpeg.org/releases/ffmpeg-0.7.5.changelog; http://www.ffmpeg.org/releases/ffmpeg-0.8.4.changelog
CVE: CVE-2011-3975
Published: 2011-10-03
Description: A certain HTC update for Android 2.3.4 build GRJ22, when the Sense interface is used on the HTC EVO 3D, EVO 4G, ThunderBolt, and unspecified other devices, provides the HtcLoggers.apk application, which allows user-assisted remote attackers to obtain a list of telephone numbers from a log, and other sensitive information, by leveraging the android.permission.INTERNET application permission and establishing TCP sessions to 127.0.0.1 on port 65511 and a second port.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://news.cnet.com/8301-1035_3-20114556-94/; http://www.androidpolice.com/2011/10/01/massive-security-vulnerability-in-htc-android-devices-evo-3d-4g-thunderbolt-others-exposes-phone-numbers-gps-sms-emails-addresses-much-more/; http://www.securityfocus.com/bid/49916
CVE: CVE-2011-0939
Published: 2011-10-03
Description: Unspecified vulnerability in Cisco IOS 12.4, 15.0, and 15.1, and IOS XE 2.5.x through 3.2.x, allows remote attackers to cause a denial of service (device reload) via a crafted SIP message, aka Bug ID CSCth03022.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24127; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d5a.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24127
CVE: CVE-2011-0944
Published: 2011-10-03
Description: Cisco IOS 12.4, 15.0, and 15.1 allows remote attackers to cause a denial of service (device reload) via malformed IPv6 packets, aka Bug ID CSCtj41194.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24131; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d59.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24131
CVE: CVE-2011-0945
Published: 2011-10-03
Description: Memory leak in the Data-link switching (aka DLSw) feature in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xS before 3.1.3S and 3.2.xS before 3.2.1S, when implemented over Fast Sequence Transport (FST), allows remote attackers to cause a denial of service (memory consumption and device reload or hang) via a crafted IP protocol 91 packet, aka Bug ID CSCth69364.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24116; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d4e.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24116
CVE: CVE-2011-0946
Published: 2011-10-03
Description: The NAT implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xSG, allows remote attackers to cause a denial of service (device reload or hang) via malformed NetMeeting Directory (aka Internet Locator Service or ILS) LDAP traffic, aka Bug ID CSCtd10712.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24117; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d4d.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24117
CVE: CVE-2011-2072
Published: 2011-10-03
Description: Memory leak in Cisco IOS 12.4, 15.0, and 15.1, Cisco IOS XE 2.5.x through 3.2.x, and Cisco Unified Communications Manager (CUCM) 6.x and 7.x before 7.1(5b)su4, 8.x before 8.5(1)su2, and 8.6 before 8.6(1) allows remote attackers to cause a denial of service (memory consumption and device reload or process failure) via a malformed SIP message, aka Bug IDs CSCtl86047 and CSCto88686.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110928-cucm; http://tools.cisco.com/security/center/viewAlert.x?alertId=24129; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d58.shtml
CVE: CVE-2011-3270
Published: 2011-10-03
Description: Unspecified vulnerability in Cisco IOS 12.2SB before 12.2(33)SB10 and 15.0S before 15.0(1)S3a on Cisco 10000 series routers allows remote attackers to cause a denial of service (device reload) via a sequence of crafted ICMP packets, aka Bug ID CSCtk62453.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24114; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d50.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24114
CVE: CVE-2011-3271
Published: 2011-10-03
Description: Unspecified vulnerability in the Smart Install functionality in Cisco IOS 12.2 and 15.1 allows remote attackers to execute arbitrary code or cause a denial of service (device crash) via crafted TCP packets to port 4786, aka Bug ID CSCto10165.
CVSS Score: 10.0 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24115; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d4f.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24115
CVE: CVE-2011-3272
Published: 2011-10-03
Description: The IP Service Level Agreement (IP SLA) functionality in Cisco IOS 15.1, and IOS XE 2.1.x through 3.3.x, allows remote attackers to cause a denial of service (memory corruption and device reload) via malformed IP SLA packets, aka Bug ID CSCtk67073.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24122; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d4c.shtml; http://www.securitytracker.com/id?1026120
CVE: CVE-2011-3273
Published: 2011-10-03
Description: Memory leak in Cisco IOS 15.0 through 15.1, when IPS or Zone-Based Firewall (aka ZBFW) is configured, allows remote attackers to cause a denial of service (memory consumption or device crash) via vectors that trigger many session creation flows, aka Bug ID CSCti79848.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24123; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d57.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24123
CVE: CVE-2011-3274
Published: 2011-10-03
Description: Unspecified vulnerability in Cisco IOS 12.2SRE before 12.2(33)SRE4, 15.0, and 15.1, and IOS XE 2.1.x through 3.3.x, when an MPLS domain is configured, allows remote attackers to cause a denial of service (device crash) via a crafted IPv6 packet, related to an expired MPLS TTL, aka Bug ID CSCto07919.
CVSS Score: 6.1 (MEDIUM)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24125; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d52.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24125
CVE: CVE-2011-3275
Published: 2011-10-03
Description: Memory leak in Cisco IOS 12.4, 15.0, and 15.1, and IOS XE 2.5.x through 3.2.x, allows remote attackers to cause a denial of service (memory consumption) via a crafted SIP message, aka Bug ID CSCti48504.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24130; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d5a.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24130
CVE: CVE-2011-3276
Published: 2011-10-03
Description: Unspecified vulnerability in the NAT implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xSG, allows remote attackers to cause a denial of service (device reload or hang) by sending crafted SIP packets to TCP port 5060, aka Bug ID CSCso02147.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24118; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d4d.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24118
CVE: CVE-2011-3277
Published: 2011-10-03
Description: Unspecified vulnerability in the NAT implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xSG, allows remote attackers to cause a denial of service (device reload) by sending crafted H.323 packets to TCP port 1720, aka Bug ID CSCth11006.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24119; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d4d.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24119
CVE: CVE-2011-3278
Published: 2011-10-03
Description: Unspecified vulnerability in the NAT implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xSG, allows remote attackers to cause a denial of service (device reload) by sending crafted SIP packets to UDP port 5060, aka Bug ID CSCti48483.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24120; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d4d.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24120
CVE: CVE-2011-3279
Published: 2011-10-03
Description: The provider-edge MPLS NAT implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xSG, allows remote attackers to cause a denial of service (device reload) via a malformed SIP packet to UDP port 5060, aka Bug ID CSCti98219.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24121; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d4d.shtml; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13781
CVE: CVE-2011-3280
Published: 2011-10-03
Description: Memory leak in the NAT implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xSG, allows remote attackers to cause a denial of service (memory consumption or device reload) by sending crafted SIP packets to UDP port 5060, aka Bug ID CSCtj04672.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24120; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d4d.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24120
CVE: CVE-2011-3281
Published: 2011-10-03
Description: Unspecified vulnerability in Cisco IOS 15.0 through 15.1, in certain HTTP Layer 7 Application Control and Inspection configurations, allows remote attackers to cause a denial of service (device reload or hang) via a crafted HTTP packet, aka Bug ID CSCto68554.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24124; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d57.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24124
CVE: CVE-2011-3282
Published: 2011-10-03
Description: Unspecified vulnerability in Cisco IOS 12.2SRE before 12.2(33)SRE4, 15.0, and 15.1, and IOS XE 2.1.x through 3.3.x, when an MPLS domain is configured, allows remote attackers to cause a denial of service (device reload) via an ICMPv6 packet, related to an expired MPLS TTL, aka Bug ID CSCtj30155.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=24126; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d52.shtml; http://tools.cisco.com/security/center/viewAlert.x?alertId=24126
CVE: CVE-2011-1572
Published: 2011-10-04
Description: Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. (dot dot) sequences in admin-defined commands.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://groups.google.com/group/gitolite/browse_thread/thread/797a93ec26e1dcbc?pli=1; http://seclists.org/oss-sec/2011/q2/197; http://seclists.org/oss-sec/2011/q2/209
CVE: CVE-2011-2894
Published: 2011-10-04
Description: Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-502
References: http://osvdb.org/75263; http://securityreason.com/securityalert/8405; http://www.redhat.com/support/errata/RHSA-2011-1334.html
CVE: CVE-2011-3354
Published: 2011-10-04
Description: The CtcpParser::packedReply method in core/ctcpparser.cpp in Quassel before 0.7.3 allows remote attackers to cause a denial of service (crash) via a crafted Client-To-Client Protocol (CTCP) request, as demonstrated in the wild in September 2011.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.quassel-irc.org/projects/quassel-irc/repository/revisions/da215fcb9cd3096a3e223c87577d5d4ab8f8518b/diff/src/core/ctcpparser.cpp; http://osvdb.org/75351; http://secunia.com/advisories/45970
CVE: CVE-2011-3976
Published: 2011-10-04
Description: Stack-based buffer overflow in AmmSoft ScriptFTP 3.3 allows remote FTP servers to execute arbitrary code via a long filename in a response to a LIST command, as demonstrated using (1) GETLIST or (2) GETFILE in a ScriptFTP script.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/46099; http://www.digital-echidna.org/2011/09/scriptftp-3-3-remote-buffer-overflow-exploit-0day/; http://www.exploit-db.com/exploits/17876
CVE: CVE-2011-3977
Published: 2011-10-04
Description: Unspecified vulnerability in nxconfigure.sh in NoMachine NX Node 3.x before 3.5.0-4 and NX Server 3.x before 3.5.0-5 allows local users to read arbitrary files via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://securityreason.com/securityalert/8406; http://www.nomachine.com/tr/view.php?id=TR08I02575; http://www.securityfocus.com/archive/1/519730/100/0/threaded
CVE: CVE-2011-3978
Published: 2011-10-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy.php in LightNEasy 3.2.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) commentemail, (2) commentmessage, or (3) commentname parameter in a sendcomment action for the news page.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/75262; http://secunia.com/advisories/45955; http://securityreason.com/securityalert/8407
CVE: CVE-2011-3979
Published: 2011-10-04
Description: Cross-site scripting (XSS) vulnerability in ztemp/view_compiled/Theme/theme_admin_setasdefault.php in the theme module in Zikula Application Framework 1.3.0 build 3168, 1.2.7, and probably other versions allows remote attackers to inject arbitrary web script or HTML via the themename parameter in the setasdefault action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://community.zikula.org/index.php?module=News&func=display&sid=3075; http://osvdb.org/75226; http://secunia.com/advisories/45884
CVE: CVE-2011-3980
Published: 2011-10-04
Description: Unspecified vulnerability in the Drag Drop Mass Upload (ameos_dragndropupload) extension 2.0.2 and earlier for TYPO3 allows remote attackers to upload arbitrary files via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2011-010/; http://www.securityfocus.com/bid/49516; https://exchange.xforce.ibmcloud.com/vulnerabilities/69694
CVE: CVE-2011-3981
Published: 2011-10-04
Description: PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://plugins.trac.wordpress.org/changeset/438959/allwebmenus-wordpress-menu-plugin/trunk/actions.php?old=408304&old_path=allwebmenus-wordpress-menu-plugin%2Ftrunk%2Factions.php; http://secunia.com/advisories/46068; http://www.exploit-db.com/exploits/17861
CVE: CVE-2011-2443
Published: 2011-10-04
Description: Multiple buffer overflows in Adobe Photoshop Elements 8.0 and earlier allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted (1) .grd or (2) .abr file, a related issue to CVE-2010-1296.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/8410; http://www.adobe.com/support/security/advisories/apsa11-03.html; http://www.exploit-db.com/exploits/17918/
CVE: CVE-2011-2876
Published: 2011-10-04
Description: Use-after-free vulnerability in Google Chrome before 14.0.835.202 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a text line box.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=93788; http://googlechromereleases.blogspot.com/2011/10/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14439