rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-2202 
Directory traversal vulnerability in javatester_init.php in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2.8 and IBM ISS Proventia Network Mail Security System allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the template parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-27T10:00:00.000Z
CVE-2012-2203 
IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, uses the PKCS #12 file format for certificate objects without enforcing file integrity, which makes it easier for remote attackers to spoof SSL servers via vectors involving insertion of an arbitrary root Certification Authority (CA) certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-08T10:00:00.000Z
CVE-2012-2204 
InfoSphere Guardium aix_ktap module: DoS
Problem types: description: denial of service
Affected products: vendor: InfoSphere
product: Guardium
Published: 2020-02-10T15:34:15.000Z
CVE-2012-2205 
Cross-site scripting (XSS) vulnerability in IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a workspace query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-17T20:00:00.000Z
CVE-2012-2206 
The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadata=fteSamplesUser field to the /transfer URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-17T10:00:00.000Z
CVE-2012-2208 
Directory traversal vulnerability in upgrade.php in Piwigo before 2.3.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T22:00:00.000Z
CVE-2012-2209 
Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) section parameter in the configuration module, (2) installstatus parameter in the languages_new module, or (3) theme parameter in the theme module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T22:00:00.000Z
CVE-2012-2210 
The Sony Bravia TV KDL-32CX525 allows remote attackers to cause a denial of service (configuration outage or device crash) via a flood of TCP SYN packets, as demonstrated by hping, a related issue to CVE-1999-0116.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-11T10:00:00.000Z
CVE-2012-2211 
Cross-site scripting (XSS) vulnerability in phpgwapi/inc/common_functions_inc.php in eGroupware before 1.8.004.20120405 allows remote attackers to inject arbitrary web script or HTML via the menuaction parameter to etemplate/process_exec.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-22T11:00:00.000Z
CVE-2012-2212 
McAfee Web Gateway 7.0 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header.  NOTE: this issue might not be reproducible, because the researcher did not provide configuration details for the vulnerable system, and the observed behavior might be consistent with a configuration that was (perhaps inadvertently) designed to allow access based on Host HTTP headers
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-28T10:00:00.000Z
CVE-2012-2213 
Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header.  NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and the observed behavior is consistent with a squid.conf file that was (perhaps inadvertently) designed to allow access based on a "req_header Host" acl regex that matches www.uol.com.br
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-28T10:00:00.000Z
CVE-2012-2214 
proxy.c in libpurple in Pidgin before 2.10.4 does not properly handle canceled SOCKS5 connection attempts, which allows user-assisted remote authenticated users to cause a denial of service (application crash) via a sequence of XMPP file-transfer requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T19:00:00.000Z
CVE-2012-2215 
Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-09T21:00:00.000Z
CVE-2012-2217 
The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-01T14:00:00.000Z
CVE-2012-2223 
The xplat agent in Novell ZENworks Configuration Management (ZCM) 10.3.x before 10.3.4 and 11.x before 11.2 enables the HTTP TRACE method, which might make it easier for remote attackers to conduct cross-site tracing (XST) attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-11T10:00:00.000Z
CVE-2012-2224 
Xunlei Thunder before 7.2.6 allows remote attackers to execute arbitrary code via a crafted file, related to a "DLL injection vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-11T10:00:00.000Z
CVE-2012-2225 
360zip 1.93beta allows remote attackers to execute arbitrary code via vectors related to file browsing and file extraction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-11T10:00:00.000Z
CVE-2012-2226 
Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by uploading a malicious file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T20:23:36.000Z
CVE-2012-2227 
Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the default_lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T18:00:00.000Z
CVE-2012-2230 
Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskcontroller.cfg, which allows remote authenticated users to impersonate arbitrary user accounts via unspecified vectors, a different vulnerability than CVE-2012-1574.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-12T10:00:00.000Z
CVE-2012-2234 
Cross-site scripting (XSS) vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an add_new_user action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-22T01:00:00.000Z
CVE-2012-2235 
Cross-site scripting (XSS) vulnerability in Support Incident Tracker (SiT!) 3.65 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to index.php, which is not properly handled in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-27T19:00:00.000Z
CVE-2012-2236 
SQL injection vulnerability in users.php in PHP Gift Registry 1.5.5 allows remote authenticated users to execute arbitrary SQL commands via the userid parameter in an edit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-20T10:00:00.000Z
CVE-2012-2237 
Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript innerHTML as used when generating login forms, (2) links or (3) resources URLs, and (4) the Display name in a user profile.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Mahara
product: Mahara
Published: 2019-11-13T18:57:55.000Z
CVE-2012-2238 
trytond 2.4: ModelView.button fails to validate authorization
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: tryton
product: trytond
Published: 2019-11-21T13:47:31.000Z
CVE-2012-2239 
Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-24T20:00:00.000Z
CVE-2012-2240 
scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to "arguments to external commands."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T00:00:00.000Z
CVE-2012-2241 
scripts/dget.pl in devscripts before 2.12.3 allows remote attackers to delete arbitrary files via a crafted (1) .dsc or (2) .changes file, probably related to a NULL byte in a filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T00:00:00.000Z
CVE-2012-2242 
scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to "arguments to external commands" that are not properly escaped, a different vulnerability than CVE-2012-2240.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T00:00:00.000Z
CVE-2012-2243 
Cross-site scripting (XSS) vulnerability in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to inject arbitrary web script or HTML by uploading an XML file with the xhtml extension, which is rendered inline as script.  NOTE: this can be leveraged with CVE-2012-2244 to execute arbitrary code without authentication, as demonstrated by modifying the clamav path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-24T20:00:00.000Z
CVE-2012-2244 
Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote authenticated administrators to execute arbitrary programs by modifying the path to clamav.  NOTE: this can be exploited without authentication by leveraging CVE-2012-2243.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-24T20:00:00.000Z
CVE-2012-2246 
Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to conduct clickjacking attacks to delete arbitrary users and bypass CSRF protection via account/delete.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-24T20:00:00.000Z
CVE-2012-2247 
Cross-site scripting (XSS) vulnerability in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to artefact/file/ and a crafted SVG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-24T20:00:00.000Z
CVE-2012-2248 
An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable.
Problem types: description: PATH set in dhclient
Affected products: vendor: isc-dhcp
product: isc-dhcp
Published: 2019-11-27T17:40:34.000Z
CVE-2012-2249 
Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-03T02:00:00.000Z
CVE-2012-2250 
Tor before 0.2.3.24-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) by performing link protocol negotiation incorrectly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-03T02:00:00.000Z
CVE-2012-2251 
rssh 2.3.2, as used by Debian, Fedora, and others, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via a (1) "-e" or (2) "--" command line option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-11T01:00:00.000Z
CVE-2012-2252 
Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-11T01:00:00.000Z
CVE-2012-2253 
Cross-site scripting (XSS) vulnerability in group/members.php in Mahara 1.5.x before 1.5.7 and 1.6.x before 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-24T20:00:00.000Z
CVE-2012-2267 
master.exe in the SNMP Master Agent in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to cause a denial of service (daemon crash) by establishing and closing a port-705 TCP connection, a different vulnerability than CVE-2012-1923.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-17T01:00:00.000Z
CVE-2012-2268 
master.exe in the SNMP Master Agent in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to cause a denial of service (unhandled exception and daemon crash) via a crafted Open-PDU request that triggers incorrect DisplayString processing, a different vulnerability than CVE-2012-1923.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-17T01:00:00.000Z
CVE-2012-2269 
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary field to apps/contacts/ajax/addcard.php, (2) the parameter parameter to apps/contacts/ajax/addproperty.php, (3) the name parameter to apps/contacts/ajax/createaddressbook, (4) the file parameter to files/download.php, or the (5) name, (6) user, or (7) redirect_url parameter to files/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-20T10:00:00.000Z
CVE-2012-2270 
Open redirect vulnerability in index.php (aka the Login Page) in ownCloud before 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-20T10:00:00.000Z
CVE-2012-2271 
Buffer overflow in the InitLicenKeys function in a certain ActiveX control in SkinCrafter3_vs2005.dll in SkinCrafter 3.0 allows remote attackers to execute arbitrary code via a long string in the first argument (aka the reg_name argument).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-21T20:00:00.000Z
CVE-2012-2273 
Comodo Internet Security before 5.10.228257.2253 on Windows 7 x64 allows local users to cause a denial of service (system crash) via a crafted 32-bit Portable Executable (PE) file with a kernel ImageBase value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-20T01:00:00.000Z
CVE-2012-2274 
Cross-site scripting (XSS) vulnerability in pivotx/ajaxhelper.php in PivotX 2.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-13T23:00:00.000Z
CVE-2012-2275 
Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-15T17:00:00.000Z
CVE-2012-2276 
The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via input data that (1) lacks FIPS fields or (2) has an invalid version number.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-14T22:00:00.000Z
CVE-2012-2277 
The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote attackers to cause a denial of service (pvcontrol.exe process hang) via \n (line feed) characters in the Id fields of many "batch begin untethered" commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-14T22:00:00.000Z
CVE-2012-2278 
Multiple cross-site scripting (XSS) vulnerabilities in the (1) Self-Service Console and (2) Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-13T21:00:00.000Z
CVE-2012-2279 
Open redirect vulnerability in the Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-13T21:00:00.000Z
CVE-2012-2280 
EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 do not properly use frames, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "Cross frame scripting vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-13T21:00:00.000Z
CVE-2012-2281 
EMC RSA Access Manager Server 6.x before 6.1 SP4 and RSA Access Manager Agent do not properly validate session tokens after a logout, which might allow remote attackers to conduct replay attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-05T14:00:00.000Z
CVE-2012-2282 
EMC Celerra Network Server 6.x before 6.0.61.0, VNX 7.x before 7.0.53.2, and VNXe 2.0 and 2.1 before 2.1.3.19077 (aka MR1 SP3.2) and 2.2 before 2.2.0.19078 (aka MR2 SP0.2) do not properly implement NFS access control, which allows remote authenticated users to read or modify files via a (1) NFSv2, (2) NFSv3, or (3) NFSv4 request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-16T19:00:00.000Z
CVE-2012-2283 
The Iomega Home Media Network Hard Drive with EMC Lifeline firmware before 2.104, Home Media Network Hard Drive Cloud Edition with EMC Lifeline firmware before 3.2.3.15290, iConnect with EMC Lifeline firmware before 2.5.26.18966, and StorCenter with EMC Lifeline firmware before 2.0.18.23122, 2.1.x before 2.1.42.18967, and 3.x before 3.2.3.15290 allow remote authenticated users to read or modify data on arbitrary remote shares via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-16T10:00:00.000Z
CVE-2012-2284 
The (1) install and (2) upgrade processes in EMC NetWorker Module for Microsoft Applications (NMM) 2.2.1, 2.3 before build 122, and 2.4 before build 375, when Exchange Server is used, allow local users to read cleartext administrator credentials via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-18T17:00:00.000Z
CVE-2012-2285 
EMC Cloud Tiering Appliance (aka CTA, formerly FMA) 9.0 and earlier, and Cloud Tiering Appliance Virtual Edition (CTA/VE) 9.0 and earlier, allows remote attackers to obtain GUI administrative access by sending a crafted file during the authentication phase.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T22:00:00.000Z
CVE-2012-2286 
Unspecified vulnerability in EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 before SP3 P3 allows remote attackers to obtain sensitive information via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T21:00:00.000Z
CVE-2012-2287 
The authentication functionality in EMC RSA Authentication Agent 7.1 and RSA Authentication Client 3.5 on Windows XP and Windows Server 2003, when an unspecified configuration exists, allows remote authenticated users to bypass an intended token-authentication step, and establish a login session to a remote host, by leveraging Windows credentials for that host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-25T10:00:00.000Z
CVE-2012-2288 
Format string vulnerability in the nsrd RPC service in EMC NetWorker 7.6.3 and 7.6.4 before 7.6.4.1, and 8.0 before 8.0.0.1, allows remote attackers to execute arbitrary code via format string specifiers in a message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-04T10:00:00.000Z
CVE-2012-2289 
EMC ApplicationXtender Desktop before 6.5 SP2 and ApplicationXtender Web Access .NET before 6.5 SP2 allow remote attackers to upload files to any location, and possibly execute arbitrary code, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T01:00:00.000Z
CVE-2012-2290 
The client in EMC NetWorker Module for Microsoft Applications (NMM) 2.2.1, 2.3 before build 122, and 2.4 before build 375 allows remote attackers to execute arbitrary code by sending a crafted message over a TCP communication channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-18T17:00:00.000Z
CVE-2012-2291 
EMC Avamar Client 4.x, 5.x, and 6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x, 5.x, and 6.x for Oracle, uses world-writable permissions for cache directories, which allows local users to gain privileges via an unspecified symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-21T21:00:00.000Z
CVE-2012-2292 
The Silverlight cross-domain policy in EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x before 5.2SP1 does not restrict access to the Archer application, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-06T11:00:00.000Z