deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-1389
Published: 2012-01-19
Description: Multiple directory traversal vulnerabilities in the vendor daemon in Rational Common Licensing in Telelogic License Server 2.0, Rational License Server 7.x, and ibmratl in IBM Rational License Key Server (RLKS) 8.0 through 8.1.2 allow remote attackers to execute arbitrary code via vectors related to save, rename, and load operations on log files.  NOTE: this might overlap CVE-2011-4135.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://kb.flexerasoftware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=Q200975&sliceId=1; http://secunia.com/advisories/47522; http://secunia.com/advisories/47524
CVE: CVE-2011-4134
Published: 2012-01-19
Description: Heap-based buffer overflow in lmadmin in Flexera FlexNet Publisher 11.10 (aka FlexNet License Server Manager) allows remote attackers to execute arbitrary code via a crafted 0x2f packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://kb.flexerasoftware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=Q200980&sliceId=1; http://www.flexerasoftware.com/pl/12982.htm; http://www.securityfocus.com/bid/48927
CVE: CVE-2011-4135
Published: 2012-01-19
Description: Multiple directory traversal vulnerabilities in lmgrd in Flexera FlexNet Publisher 11.10 (aka FlexNet License Server Manager) allow remote attackers to execute arbitrary code via vectors related to save, rename, and load operations on log files.  NOTE: this might overlap CVE-2011-1389.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://kb.flexerasoftware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=Q200975&sliceId=1; http://secunia.com/advisories/45615; http://www.flexerasoftware.com/pl/13057.htm
CVE: CVE-2011-4374
Published: 2012-01-19
Description: Integer overflow in Adobe Reader 9.x before 9.4.6 on Linux allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-190
References: http://www.adobe.com/support/security/bulletins/apsb11-24.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14812; http://www.adobe.com/support/security/bulletins/apsb11-24.html
CVE: CVE-2012-0050
Published: 2012-01-19
Description: OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS applications, which allows remote attackers to cause a denial of service (crash) via unspecified vectors related to an out-of-bounds read.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4108.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc; http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03169289; http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
CVE: CVE-2012-0193
Published: 2012-01-20
Description: IBM WebSphere Application Server (WAS) 6.0 through 6.0.2.43, 6.1 before 6.1.0.43, 7.0 before 7.0.0.23, and 8.0 before 8.0.0.3 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/78321; http://www-01.ibm.com/support/docview.wss?uid=swg1PM53930; http://www-01.ibm.com/support/docview.wss?uid=swg21577532
CVE: CVE-2012-0895
Published: 2012-01-20
Description: Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/78271; http://packetstormsecurity.org/files/108631/countperday-downloadxss.txt; http://plugins.trac.wordpress.org/changeset/488883/count-per-day
CVE: CVE-2012-0896
Published: 2012-01-20
Description: Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/78270; http://packetstormsecurity.org/files/108631/countperday-downloadxss.txt; http://plugins.trac.wordpress.org/changeset/488883/count-per-day
CVE: CVE-2012-0897
Published: 2012-01-20
Description: Stack-based buffer overflow in the JPEG2000 plugin in IrfanView PlugIns before 4.33 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/78333; http://secunia.com/advisories/47360; http://www.irfanview.com/history_old.htm
CVE: CVE-2012-0898
Published: 2012-01-20
Description: Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dwn_file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/files/view/108711/wpmyeasybackup-traversal.txt; http://secunia.com/advisories/47594; https://exchange.xforce.ibmcloud.com/vulnerabilities/72404
CVE: CVE-2012-0899
Published: 2012-01-20
Description: Cross-site scripting (XSS) vulnerability in referencement/sites_inscription.php in Annuaire PHP allows remote attackers to inject arbitrary web script or HTML via the url parameter and possibly the nom parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/108719/annuaire-xss.txt; http://www.securityfocus.com/bid/51434; https://exchange.xforce.ibmcloud.com/vulnerabilities/72407
CVE: CVE-2012-0900
Published: 2012-01-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Beehive Forum 1.0.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) forum/register.php or (2) forum/logon.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0103.html; http://secunia.com/advisories/47595; http://www.darksecurity.de/advisories/SSCHADV2011-042.txt
CVE: CVE-2012-0901
Published: 2012-01-20
Description: Cross-site scripting (XSS) vulnerability in yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/108470/wpystap-xss.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/72271; http://packetstormsecurity.org/files/view/108470/wpystap-xss.txt
CVE: CVE-2012-0902
Published: 2012-01-20
Description: AirTies Air 4450 1.1.2.18 allows remote attackers to cause a denial of service (reboot) via a direct request to cgi-bin/loader.
CVSS Score: 5.0 (MEDIUM)
References: http://www.exploit-db.com/exploits/18336; http://www.securityfocus.com/bid/51320; https://exchange.xforce.ibmcloud.com/vulnerabilities/72200
CVE: CVE-2012-0903
Published: 2012-01-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Desktop 7.1.2 b10978 allow remote attackers to inject arbitrary web script or HTML via the (1) Username or (2) MailBox Name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/108715/VL-378.txt; http://seclists.org/fulldisclosure/2012/Jan/244; http://www.securityfocus.com/bid/51436
CVE: CVE-2012-0904
Published: 2012-01-20
Description: VLC media player 1.1.11 allows remote attackers to cause a denial of service (crash) via a long string in an amr file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0033.html; http://www.exploit-db.com/exploits/18309; http://www.securityfocus.com/bid/51255
CVE: CVE-2012-0905
Published: 2012-01-20
Description: SQL injection vulnerability in deV!L'z Clanportal (DZCP) Gamebase addon allows remote attackers to execute arbitrary SQL commands via the gameid parameter in a detail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/47563; http://www.exploit-db.com/exploits/18385; https://exchange.xforce.ibmcloud.com/vulnerabilities/72452
CVE: CVE-2012-0906
Published: 2012-01-20
Description: SQL injection vulnerability in the Moviebase addon for deV!L'z Clanportal (DZCP) 1.5.5 allows remote attackers to execute arbitrary SQL commands via the id parameter in a showkat action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18386; https://exchange.xforce.ibmcloud.com/vulnerabilities/72453; http://www.exploit-db.com/exploits/18386
CVE: CVE-2012-0907
Published: 2012-01-20
Description: Directory traversal vulnerability in the web player in NeoAxis NeoAxis web player 1.4 and earlier allows user-assisted remote attackers to write arbitrary files via a .. (dot dot) in a filename in the neoaxis_web_application_win32.zip ZIP archive.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://aluigi.altervista.org/adv/neoaxis_1-adv.txt; http://osvdb.org/78311; https://exchange.xforce.ibmcloud.com/vulnerabilities/72427
CVE: CVE-2012-0192
Published: 2012-01-23
Description: Multiple integer overflows in vclmi.dll in the visual class library module in IBM Lotus Symphony before 3.0.1 might allow remote attackers to execute arbitrary code via an embedded (1) JPEG or (2) PNG image object in a Symphony document that triggers a heap-based buffer overflow, as demonstrated by a .doc file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://osvdb.org/78345; http://secunia.com/advisories/47245; http://www-01.ibm.com/support/docview.wss?uid=swg21578684
CVE: CVE-2011-3924
Published: 2012-01-24
Description: Use-after-free vulnerability in Google Chrome before 16.0.912.77 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOM selections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=106484; http://googlechromereleases.blogspot.com/2012/01/stable-channel-update_23.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3925
Published: 2012-01-24
Description: Use-after-free vulnerability in the Safe Browsing feature in Google Chrome before 16.0.912.75 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors related to a navigation entry and an interstitial page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=107182; http://googlechromereleases.blogspot.com/2012/01/stable-channel-update_23.html; http://secunia.com/advisories/47449
CVE: CVE-2011-3926
Published: 2012-01-24
Description: Heap-based buffer overflow in the tree builder in Google Chrome before 16.0.912.77 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://code.google.com/p/chromium/issues/detail?id=109556; http://googlechromereleases.blogspot.com/2012/01/stable-channel-update_23.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3927
Published: 2012-01-24
Description: Skia, as used in Google Chrome before 16.0.912.77, does not perform all required initialization of values, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665
References: http://code.google.com/p/chromium/issues/detail?id=108605; http://googlechromereleases.blogspot.com/2012/01/stable-channel-update_23.html; http://secunia.com/advisories/47694
CVE: CVE-2011-3928
Published: 2012-01-24
Description: Use-after-free vulnerability in Google Chrome before 16.0.912.77 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOM handling.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=108461; http://googlechromereleases.blogspot.com/2012/01/stable-channel-update_23.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html
CVE: CVE-2012-0313
Published: 2012-01-24
Description: Cross-site scripting (XSS) vulnerability in glucose 2 before stage 6.2 allows remote attackers to inject arbitrary web script or HTML via an RSS feed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://glucose.jp/release/19; http://jvn.jp/en/jp/JVN65869891/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000008
CVE: CVE-2012-0285
Published: 2012-01-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in Stoneware webNetwork before 6.0.8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://infosec42.blogspot.com/2012/01/cve-2012-0285-and-cve-2012-0286.html; http://www.stone-ware.com/support/techdocs/kb/d1960/sb_6_0_8.pdf; http://www.stone-ware.com/swql.jsp?kb=d1960
CVE: CVE-2012-0286
Published: 2012-01-24
Description: Cross-site request forgery (CSRF) vulnerability in Stoneware webNetwork before 6.0.8.0 allows remote attackers to hijack the authentication of unspecified victims for requests that modify user accounts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://infosec42.blogspot.com/2012/01/cve-2012-0285-and-cve-2012-0286.html; http://www.stone-ware.com/support/techdocs/kb/d1960/sb_6_0_8.pdf; http://www.stone-ware.com/swql.jsp?kb=d1960
CVE: CVE-2012-0912
Published: 2012-01-24
Description: SQL injection vulnerability in Stoneware webNetwork before 6.0.8.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.stone-ware.com/support/techdocs/kb/d1960/sb_6_0_8.pdf; http://www.stone-ware.com/swql.jsp?kb=d1960; http://www.stone-ware.com/support/techdocs/kb/d1960/sb_6_0_8.pdf
CVE: CVE-2012-0040
Published: 2012-01-24
Description: Cross-site scripting (XSS) vulnerability in modules/core/www/no_cookie.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the retryURL parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://code.google.com/p/simplesamlphp/issues/detail?id=468; http://osvdb.org/78254; http://secunia.com/advisories/47491
CVE: CVE-2012-0069
Published: 2012-01-24
Description: SQL injection vulnerability in ajax.php in Batavi before 1.2.1 allows remote attackers to execute arbitrary SQL commands via the boxToReload parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/78362; http://secunia.com/advisories/47582; http://voxel.dl.sourceforge.net/project/batavi/README.txt
CVE: CVE-2012-0389
Published: 2012-01-24
Description: Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4.26 and earlier, 5.x before 5.53, and 6.x before 6.03 allows remote attackers to inject arbitrary web script or HTML via the Username parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0090.html; http://osvdb.org/78242; http://secunia.com/advisories/47518
CVE: CVE-2012-0790
Published: 2012-01-24
Description: Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2.4.2, 2.6.6, and other versions before 2.6.7 allows remote attackers to inject arbitrary web script or HTML via the displaymode parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/188/45/; http://oss.oetiker.ch/smokeping/pub/CHANGES; http://secunia.com/advisories/47678
CVE: CVE-2012-0791
Published: 2012-01-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/47580; http://secunia.com/advisories/47592; http://www.debian.org/security/2012/dsa-2485
CVE: CVE-2012-0908
Published: 2012-01-24
Description: Cross-site scripting (XSS) vulnerability in logout.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the link_href parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://code.google.com/p/simplesamlphp/issues/detail?id=468; http://osvdb.org/78255; http://secunia.com/advisories/47491
CVE: CVE-2012-0909
Published: 2012-01-24
Description: Cross-site scripting (XSS) vulnerability in Horde_Form in Horde Groupware Webmail Edition before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to email verification.  NOTE: Some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/47592; http://www.horde.org/apps/webmail/docs/CHANGES; http://www.horde.org/apps/webmail/docs/RELEASE_NOTES
CVE: CVE-2012-0913
Published: 2012-01-24
Description: SQL injection vulnerability in checklogin.aspx in ICloudCenter ICTimeAttendance 1.0 allows remote attackers to execute arbitrary SQL commands via the passw parameter.  NOTE: Some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/78444; http://secunia.com/advisories/47660; http://www.exploit-db.com/exploits/18394
CVE: CVE-2012-0914
Published: 2012-01-24
Description: Cross-site scripting (XSS) vulnerability in display_renderers/panels_renderer_editor.class.php in the admin view in the Panels module 6.x-2.x before 6.x-3.10 and 7.x-3.x before 7.x-3.0 for Drupal allows remote authenticated users with certain privileges to inject arbitrary web script or HTML via the Region title.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1409436; http://drupal.org/node/1409446; http://drupal.org/node/1409448
CVE: CVE-2012-0915
Published: 2012-01-24
Description: Integer signedness error in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via crafted dimensions of a skin file, leading to a heap-based buffer overflow, as demonstrated using a BMP image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/47314; http://www.securityfocus.com/bid/51585; http://secunia.com/advisories/47314
CVE: CVE-2012-0916
Published: 2012-01-24
Description: Heap-based buffer overflow in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via a crafted image in a chat message, as demonstrated using a PNG file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/47314; http://www.securityfocus.com/bid/51585; http://secunia.com/advisories/47314
CVE: CVE-2012-0917
Published: 2012-01-24
Description: Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Analyzer 02-01, 02-51 through 02-51-01, and 02-53 through 02-53-02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/78221; http://secunia.com/advisories/47467; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-001/index.html
CVE: CVE-2012-0918
Published: 2012-01-24
Description: Unspecified vulnerability in Hitachi COBOL2002 Net Developer, Net Server Suite, and Net Client Suite 01-00, 01-01 through 01-01-/D, 01-02 through 01-02-/F, 01-03 through 01-03-/F, 02-00 through 02-00-/D, 02-01 through 02-01-/C, and possibly other versions before 02-01-/D allows remote attackers to execute arbitrary code via unknown attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/47612; http://secunia.com/advisories/47643; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-002/index.html
CVE: CVE-2012-0919
Published: 2012-01-24
Description: Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 through 03-00-04, and possibly other versions before 03-00-06, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/78215; http://secunia.com/advisories/47490; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-001/index.html
CVE: CVE-2011-4697
Published: 2012-01-25
Description: The Xiaomi MiTalk Messenger (com.xiaomi.channel) application before 2.1.320 for Android does not properly protect data, which allows remote attackers to read or modify messaging information via a crafted application.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4697-vulnerability-in-MiTalk.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4697-vulnerability-in-MiTalk.html
CVE: CVE-2011-4698
Published: 2012-01-25
Description: The AndroidAppTools Easy Filter (com.phoneblocker.android) application 1.1 and 1.2 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and call records via a crafted application.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4698-vulnerability-in-EasyFilter.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4698-vulnerability-in-EasyFilter.html
CVE: CVE-2011-4699
Published: 2012-01-25
Description: The Ubermedia Twidroyd Legacy (com.twidroydlegacy) application 4.3.11 for Android does not properly protect data, which allows remote attackers to read or modify Twitter information via a crafted application.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4699-vulnerability-in-Twidroyd.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4699-vulnerability-in-Twidroyd.html
CVE: CVE-2011-4700
Published: 2012-01-25
Description: The UberMedia UberSocial (com.twidroid) application 7.x before 7.2.4 for Android does not properly protect data, which allows remote attackers to read or modify Twitter information via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4700-vulnerability-in-UberSocial.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4700-vulnerability-in-UberSocial.html
CVE: CVE-2011-4701
Published: 2012-01-25
Description: The CallConfirm (jp.gr.java_conf.ofnhwx.callconfirm) application 2.0.0 for Android does not properly protect data, which allows remote attackers to read or modify allow/block lists via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4701-vulnerability-in-CallConfirm.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4701-vulnerability-in-CallConfirm.html
CVE: CVE-2011-4702
Published: 2012-01-25
Description: The Nimbuzz (com.nimbuzz) application 2.0.8 and 2.0.10 for Android does not properly protect data, which allows remote attackers to read or modify a contact list via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4702-vulnerability-in-Nimbuzz.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4702-vulnerability-in-Nimbuzz.html
CVE: CVE-2011-4703
Published: 2012-01-25
Description: The Limit My Call (com.limited.call.view) application 2.11 for Android does not properly protect data, which allows remote attackers to read or modify call logs and a contact list via a crafted application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4703-vulnerability-in-LimitMyCall.html; http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2011-4703-vulnerability-in-LimitMyCall.html