rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-4361 
MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-08T11:00:00.000Z
CVE-2011-4362 
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-24T19:00:00.000Z
CVE-2011-4363 
ProcessTable.pm in the Proc::ProcessTable module 0.45 for Perl, when TTY information caching is enabled, allows local users to overwrite arbitrary files via a symlink attack on /tmp/TTYDEVS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-07T21:00:00.000Z
CVE-2011-4364 
Buffer overflow in the Sierra VMD decoder in libavcodec in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9 and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VMD file, related to corrupted streams.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T20:00:00.000Z
CVE-2011-4367 
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-19T14:00:00.000Z
CVE-2011-4368 
Cross-site scripting (XSS) vulnerability in Remote Development Services (RDS) in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T11:00:00.000Z
CVE-2011-4369 
Unspecified vulnerability in the PRC component in Adobe Reader and Acrobat 9.x before 9.4.7 on Windows, Adobe Reader and Acrobat 9.x through 9.4.6 on Mac OS X, Adobe Reader and Acrobat 10.x through 10.1.1 on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T19:00:00.000Z
CVE-2011-4370 
Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-4372 and CVE-2011-4373.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-10T21:00:00.000Z
CVE-2011-4371 
Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-10T21:00:00.000Z
CVE-2011-4372 
Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-4370 and CVE-2011-4373.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-10T21:00:00.000Z
CVE-2011-4373 
Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-4370 and CVE-2011-4372.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-10T21:00:00.000Z
CVE-2011-4374 
Integer overflow in Adobe Reader 9.x before 9.4.6 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-19T19:00:00.000Z
CVE-2011-4403 
Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-24T14:00:00.000Z
CVE-2011-4404 
The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-19T02:00:00.000Z
CVE-2011-4405 
The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to execute arbitrary code via a man-in-the-middle (MITM) attack that modifies packages or repositories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-29T17:00:00.000Z
CVE-2011-4406 
The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges when changing language settings, which allows local users to modify arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-16T18:00:00.000Z
CVE-2011-4407 
ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T00:00:00.000Z
CVE-2011-4408 
The Single Sign On Client (ubuntu-sso-client) for Ubuntu 11.04 and 11.10 does not properly validate SSL certificates when using HTTPS, which allows remote attackers to spoof a server and modify or read sensitive data via a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-16T00:00:00.000Z
CVE-2011-4409 
The Ubuntu One Client for Ubuntu 10.04 LTS, 11.04, 11.10, and 12.04 LTS does not properly validate SSL certificates, which allows remote attackers to spoof a server and modify or read sensitive information via a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-16T00:00:00.000Z
CVE-2011-4415 
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-08T11:00:00.000Z
CVE-2011-4431 
Directory traversal vulnerability in main.php in Merethis Centreon before 2.3.2 allows remote authenticated users to execute arbitrary commands via a .. (dot dot) in the command_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-10T00:00:00.000Z
CVE-2011-4432 
www/include/configuration/nconfigObject/contact/DB-Func.php in Merethis Centreon before 2.3.2 does not use a salt during calculation of a password hash, which makes it easier for context-dependent attackers to determine cleartext passwords via a rainbow-table approach.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-10T00:00:00.000Z
CVE-2011-4434 
Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 do not properly enforce AppLocker rules, which allows local users to bypass intended access restrictions via a (1) macro or (2) scripting feature in an application, as demonstrated by Microsoft Office applications and the SANDBOX_INERT and LOAD_IGNORE_CODE_AUTHZ_LEVEL flags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-11T21:00:00.000Z
CVE-2011-4435 
The web-server component in the Consolidation and Analysis Engine (CAE) Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not prevent directory browsing, which allows remote attackers to obtain sensitive information via HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-11T21:00:00.000Z
CVE-2011-4436 
Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface on the Dell KACE K2000 System Deployment Appliance allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-12T00:00:00.000Z
CVE-2011-4447 
The "encrypt wallet" feature in wxBitcoin and bitcoind 0.4.x before 0.4.1, and 0.5.0rc, does not properly interact with the deletion functionality of BSDDB, which allows context-dependent attackers to obtain unencrypted private keys from Bitcoin wallet files by bypassing the BSDDB interface and reading entries that are marked for deletion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-06T16:00:00.000Z
CVE-2011-4448 
SQL injection vulnerability in actions/usersettings/usersettings.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to execute arbitrary SQL commands via the default_comment_display parameter in an update action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T20:00:00.000Z
CVE-2011-4449 
actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by placing this code in a file whose name has multiple extensions, as demonstrated by a (1) .mm or (2) .vpp file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T20:00:00.000Z
CVE-2011-4450 
Directory traversal vulnerability in handlers/files.xml/files.xml.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to read or delete arbitrary files via a non-initial .. (dot dot) in the file parameter, as demonstrated by the /../../wikka.config.php pathname in a download action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T20:00:00.000Z
CVE-2011-4451 
libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam_logging option is enabled, allows remote attackers to write arbitrary PHP code to the spamlog_path file via the User-Agent HTTP header in an addcomment request.  NOTE: the vendor disputes this issue because the rendering of the spamlog_path file never uses the PHP interpreter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T20:00:00.000Z
CVE-2011-4452 
Cross-site request forgery (CSRF) vulnerability in the AdminUsers component in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to hijack the authentication of administrators for requests that remove arbitrary user accounts via a delete operation, as demonstrated by an {{image}} action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T20:00:00.000Z
CVE-2011-4453 
The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP create_function function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-22T15:00:00.000Z
CVE-2011-4454 
Multiple cross-site scripting vulnerabilities in Tiki 8.0 RC1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) tiki-remind_password.php, (2) tiki-index.php, (3) tiki-login_scr.php, or (4) tiki-index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-20T18:57:55.000Z
CVE-2011-4455 
Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) tiki-admin_system.php, (2) tiki-pagehistory.php, (3) tiki-removepage.php, or (4) tiki-rename_page.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-20T18:57:57.000Z
CVE-2011-4457 
OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-17T23:00:00.000Z
CVE-2011-4458 
Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and CVE-2011-5093.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-04T19:00:00.000Z
CVE-2011-4459 
Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a group membership.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-04T19:00:00.000Z
CVE-2011-4460 
SQL injection vulnerability in Best Practical Solutions RT 2.x and 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to execute arbitrary SQL commands by leveraging access to a privileged account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-04T19:00:00.000Z
CVE-2011-4461 
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T01:00:00.000Z
CVE-2011-4462 
Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T01:00:00.000Z
CVE-2011-4465 
Cross-site scripting (XSS) vulnerability in IBM Lotus Mobile Connect (LMC) 6.1.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to a hidden redirect URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-19T02:00:00.000Z
CVE-2011-4486 
Cisco Unified Communications Manager (CUCM) with software 6.x and 7.x before 7.1(5b)su5, 8.0 before 8.0(3a)su3, and 8.5 and 8.6 before 8.6(2a)su1 and Cisco Business Edition 3000 with software before 8.6.3 and 5000 and 6000 with software before 8.6(2a)su1 allow remote attackers to cause a denial of service (device reload) via a crafted SCCP registration, aka Bug ID CSCtu73538.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-01T01:00:00.000Z
CVE-2011-4487 
SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) with software 6.x and 7.x before 7.1(5b)su5, 8.0 before 8.0(3a)su3, and 8.5 and 8.6 before 8.6(2a)su1 and Cisco Business Edition 3000 with software before 8.6.3 and 5000 and 6000 with software before 8.6(2a)su1 allows remote attackers to execute arbitrary SQL commands via a crafted SCCP registration, aka Bug ID CSCtu73538.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-01T01:00:00.000Z
CVE-2011-4496 
Buffer overflow in Aviosoft DTV Player 1.0.1.2 allows remote attackers to execute arbitrary code via a crafted .plf (aka playlist) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-21T11:00:00.000Z
CVE-2011-4497 
QIS_wizard.htm on the ASUS RT-N56U router with firmware before 1.0.1.4o allows remote attackers to obtain the administrator password via a flag=detect request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-21T11:00:00.000Z
CVE-2011-4498 
Cross-site request forgery (CSRF) vulnerability in the web console in Zenprise Device Manager 6.x through 6.1.8 allows remote attackers to hijack the authentication of administrators for requests that wipe mobile devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-21T11:00:00.000Z
CVE-2011-4499 
The UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS v1 through v3 with firmware before 4.71.1, and WRT54GS v4 with firmware before 1.06.1 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-22T11:00:00.000Z
CVE-2011-4500 
The UPnP IGD implementation on the Cisco Linksys WRT54GX with firmware 2.00.05, when UPnP is enabled, configures the SOAP server to listen on the WAN port, which allows remote attackers to administer the firewall via SOAP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-22T11:00:00.000Z
CVE-2011-4501 
The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-22T11:00:00.000Z
CVE-2011-4502 
The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-22T11:00:00.000Z
CVE-2011-4503 
The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-22T11:00:00.000Z
CVE-2011-4504 
The UPnP IGD implementation in the Pseudo ICS UPnP software on the ZyXEL P-330W allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-22T11:00:00.000Z
CVE-2011-4505 
The UPnP IGD implementation on SpeedTouch 5x6 devices with firmware before 6.2.29 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-22T11:00:00.000Z
CVE-2011-4506 
The UPnP IGD implementation on the Thomson (aka Technicolor) TG585 with firmware 7.x before 7.4.3.2 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-22T11:00:00.000Z
CVE-2011-4507 
The D-Link DIR-685 router, when certain WPA and WPA2 configurations are used, does not maintain an encrypted wireless network during transfer of a large amount of network traffic, which allows remote attackers to obtain sensitive information or bypass authentication via a Wi-Fi device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-22T11:00:00.000Z
CVE-2011-4508 
The HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime generates predictable authentication tokens for cookies, which makes it easier for remote attackers to bypass authentication via a crafted cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-03T20:00:00.000Z
CVE-2011-4509 
The HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime has an improperly selected default password for the administrator account, which makes it easier for remote attackers to obtain access via a brute-force approach involving many HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-03T20:00:00.000Z
CVE-2011-4510 
Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-4511.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-03T20:00:00.000Z