rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-5843 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-21T11:00:00.000Z
CVE-2012-5849 
Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) uid parameter in an add_friend action to ajax.php; id parameter in a (2) share_object, (3) add_to_fav, (4) rating, or (5) flag_object action to ajax.php; cid parameter in an (6) add_new_item, (7) remove_collection_item, (8) get_item, or (9) load_more_items action to ajax.php; (10) ci_id parameter in a get_item action to ajax.php; user parameter to (11) user_contacts.php or (12) view_channel.php; (13) pid parameter to view_page.php; (14) tid parameter to view_topic.php; or (15) v parameter to watch_video.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-14T14:00:00.000Z
CVE-2012-5851 
html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not consider all possible output contexts of reflected data, which makes it easier for remote attackers to bypass a cross-site scripting (XSS) protection mechanism via a crafted string, aka rdar problem 12019108.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-15T11:00:00.000Z
CVE-2012-5853 
SQL injection vulnerability in the "the_search_function" function in cardoza_ajax_search.php in the AJAX Post Search (cardoza-ajax-search) plugin before 1.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the srch_txt parameter in a "the_search_text" action to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-08T01:00:00.000Z
CVE-2012-5854 
Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attackers to cause a denial of service (crash or hang) and possibly execute arbitrary code via crafted IRC colors that are not properly decoded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-19T11:00:00.000Z
CVE-2012-5855 
The SHAddToRecentDocs function in VideoLAN VLC media player 2.0.4 and earlier might allow user-assisted attackers to cause a denial of service (crash) via a crafted file name that triggers an incorrect string-length calculation when the file is added to VLC.  NOTE: it is not clear whether this issue crosses privilege boundaries or whether it can be exploited without user interaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-10T19:00:00.000Z
CVE-2012-5856 
Cross-site scripting (XSS) vulnerability in the Uk Cookie (aka uk-cookie) plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T19:00:00.000Z
CVE-2012-5858 
Samsung Kies Air 2.1.207051 and 2.1.210161 relies on the IP address for authentication, which allows remote man-in-the-middle attackers to read arbitrary phone contents by spoofing or controlling the IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-03T21:00:00.000Z
CVE-2012-5859 
Samsung Kies Air 2.1.207051 and 2.1.210161 allows remote attackers to cause a denial of service (crash) via a crafted request to www/apps/KiesAir/jws/ssd.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-03T21:00:00.000Z
CVE-2012-5860 
Unspecified vulnerability on Oberthur ID-One COSMO 5.2, 5.2a, and 64 smart cards makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging the generation of non-compliant public keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-14T11:00:00.000Z
CVE-2012-5861 Sinapsi eSolar SQL Injection
These Sinapsi devices do not check the validity of the data before 
executing queries. By accessing the SQL table of certain pages that do 
not require authentication within the device, attackers can leak 
information from the device. This could allow the attacker to compromise
 confidentiality.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: Sinapsi
product: eSolar
default_status: unaffected
vendor: Sinapsi
product: eSolar DUO
default_status: unaffected
vendor: Sinapsi
product: eSolar Light
default_status: unaffected
Credits: lang: en
value: Roberto Paleari and Ivan Speziale identified vulnerabilities and released proof-of-concept (exploit) code for the Sinapsi eSolar Light Photovoltaic System Monitor without coordination with Sinapsi or ICS-CERT.
Published: 2012-11-23T11:00:00.000Z
CVE-2012-5862 Sinapsi eSolar Hard-Coded Password
These Sinapsi devices
store hard-coded passwords in the PHP file of the device. By using the 
hard-coded passwords in the device, attackers can log into the device 
with administrative privileges. This could allow the attacker to have 
unauthorized access.
Problem types: cwe_id: CWE-259
description: CWE-259
Affected products: vendor: Sinapsi
product: eSolar
default_status: unaffected
vendor: Sinapsi
product: eSolar DUO
default_status: unaffected
vendor: Sinapsi
product: eSolar Light
default_status: unaffected
Credits: lang: en
value: Roberto Paleari and Ivan Speziale identified vulnerabilities and released proof-of-concept (exploit) code for the Sinapsi eSolar Light Photovoltaic System Monitor without coordination with Sinapsi or ICS-CERT.
Published: 2012-11-23T11:00:00.000Z
CVE-2012-5863 Sinapsi eSolar OS Command Injection
These Sinapsi devices do not check for special elements in commands sent 
to the system. By accessing certain pages with administrative privileges
 that do not require authentication within the device, attackers can 
execute arbitrary, unexpected, or dangerous commands directly onto the 
operating system.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: Sinapsi
product: eSolar
default_status: unaffected
vendor: Sinapsi
product: eSolar DUO
default_status: unaffected
vendor: Sinapsi
product: eSolar Light
default_status: unaffected
Credits: lang: en
value: Roberto Paleari and Ivan Speziale identified vulnerabilities and released proof-of-concept (exploit) code for the Sinapsi eSolar Light Photovoltaic System Monitor without coordination with Sinapsi or ICS-CERT.
Published: 2012-11-23T11:00:00.000Z
CVE-2012-5864 Sinapsi eSolar Improper Authentication
These Sinapsi devices 
do not check if users that visit pages within the device have properly 
authenticated. By directly visiting the pages within the device, 
attackers can gain unauthorized access with administrative privileges.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: Sinapsi
product: eSolar
default_status: unaffected
vendor: Sinapsi
product: eSolar DUO
default_status: unaffected
vendor: Sinapsi
product: eSolar Light
default_status: unaffected
Credits: lang: en
value: Roberto Paleari and Ivan Speziale identified vulnerabilities and released proof-of-concept (exploit) code for the Sinapsi eSolar Light Photovoltaic System Monitor without coordination with Sinapsi or ICS-CERT.
Published: 2012-11-23T11:00:00.000Z
CVE-2012-5865 
SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated users to execute arbitrary SQL commands via the activityid parameter in a stats action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-20T15:00:00.000Z
CVE-2012-5866 
Cross-site scripting (XSS) vulnerability in include.php in Achievo 1.4.5 allows remote attackers to inject arbitrary web script or HTML via the field parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-20T15:00:00.000Z
CVE-2012-5867 
HT Editor 2.0.20 has a Remote Stack Buffer Overflow Vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-23T14:07:41.000Z
CVE-2012-5868 
WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-27T11:00:00.000Z
CVE-2012-5872 
ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2023-04-25T00:00:00.000Z
CVE-2012-5873 
ARC (aka ARC2) through 2011-12-01 allows reflected XSS via the end_point.php query parameter in an output=htmltab action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2023-04-25T00:00:00.000Z
CVE-2012-5874 
Multiple SQL injection vulnerabilities in the (1) update_whosonline_reg and (2) update_whosonline_guest functions in Elite Bulletin Board before 2.1.22 allow remote attackers to execute arbitrary SQL commands via the PATH_INFO to (a) checkuser.php, (b) groups.php, (c) index.php, (d) login.php, (e) quicklogin.php, (f) register.php, (g) Search.php, (h) viewboard.php, or (i) viewtopic.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-12T02:00:00.000Z
CVE-2012-5875 
Firefly Media Server 1.0.0.1359 allows remote attackers to cause a denial of service (NULL pointer dereference) via a (1) crafted Connection HTTP header; a return carriage control character in the (2) Accept Language header, (3) User-agent header, (4) Host header, or (5) protocol version; or a (6) crafted HTTP protocol version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-18T11:00:00.000Z
CVE-2012-5876 
Multiple off-by-one errors in NMMediaServerService.dll in Nero MediaHome 4.5.8.0 and earlier allow remote attackers to cause a denial of service (crash) via a long string in the (1) request line or (2) HTTP Referer header to TCP port 54444, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-30T14:00:00.000Z
CVE-2012-5877 
Nero MediaHome 4.5.8.0 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an HTTP header without a name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-30T14:00:00.000Z
CVE-2012-5878 
Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to frameworkgui/attachMobileModem.pl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-03T19:30:28.000Z
CVE-2012-5879 
An ActiveX control in McHealthCheck.dll in McAfee Virtual Technician (MVT) and ePO-MVT 6.5.0.2101 and earlier allows remote attackers to modify or create arbitrary files via a full pathname argument to the Save method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-28T23:00:00.000Z
CVE-2012-5881 
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to charts.swf, a similar issue to CVE-2010-4207.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-16T11:00:00.000Z
CVE-2012-5882 
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader.swf, a similar issue to CVE-2010-4208.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-16T11:00:00.000Z
CVE-2012-5883 
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or HTML via vectors related to swfstore.swf, a similar issue to CVE-2010-4209.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-16T11:00:00.000Z
CVE-2012-5884 
The User.get method in Bugzilla/WebService/User.pm in Bugzilla 4.3.2 allows remote attackers to obtain sensitive information about the saved searches of arbitrary users via an XMLRPC request or a JSONRPC request, a different vulnerability than CVE-2012-4198.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-16T11:00:00.000Z
CVE-2012-5885 
The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T19:00:00.000Z
CVE-2012-5886 
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T19:00:00.000Z
CVE-2012-5887 
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T19:00:00.000Z
CVE-2012-5888 
Cross-site scripting (XSS) vulnerability in Basic SEO Features (seo_basics) extension before 0.8.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5889 
Cross-site scripting (XSS) vulnerability in the powermail extension before 1.6.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5890 
The Front End User Registration (sr_feuser_register) extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passwords via the (1) edit perspective or (2) autologin feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5891 
Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an add action, (2) change user passwords via a change action, or (3) delete a user via a delete action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5892 
Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the configuration database via a direct request for data/havalite.db3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5893 
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading a file with a .php;.gif extension, then accessing it via a direct request to the file in tmp/files/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5894 
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the postId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5895 
Multiple unspecified vulnerabilities in iRODS before 3.1 have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5896 
The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Add method, which allows remote attackers to execute arbitrary code via a memory address in the first argument, related to an "uninitialized pointer."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5897 
The (1) SimpleTree and (2) ReportTree classes in the ARDoc ActiveX control (ARDoc.dll) in Quest InTrust 10.4.0.853 and earlier do not properly implement the SaveToFile method, which allows remote attackers to write or overwrite arbitrary files via the bstrFileName argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5898 
Cross-site request forgery (CSRF) vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administrators for requests that change account settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5899 
Cross-site scripting (XSS) vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers to inject arbitrary web script or HTML via the OTR_HEADS[] parameter in an edit action. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5900 
Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL commands via the (1) OB_ID parameter in a single action to admin/action/objects.php, (2) AREA_ID parameter in a single action to admin/action/areas.php, or (3) start parameter in a show action to admin/action/pdf.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5901 
DFLabs PTK 1.0.5 stores data files with predictable names under the web document root with insufficient access control, which allows remote attackers to read logs, images, or reports via a direct request to the file in the (1) log, (2) images, or (3) report directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5902 
Cross-site scripting (XSS) vulnerability in ptk/lib/modal_bookmark.php in DFLabs PTK 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the arg4 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5903 
Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the scheduled parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5904 
Heap-based buffer overflow in IrfanView before 4.33 allows remote attackers to execute arbitrary code via a crafted RLE compressed bitmap file such as a DIB, RLE, or BMP image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5905 
Buffer overflow in KnFTPd 1.0.0 allows remote authenticated users to cause a denial of service (crash) via a long string in a FEAT command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5906 
Multiple cross-site scripting (XSS) vulnerabilities in GreenBrowser 6.1.0117 and 6.1.0216 allow remote attackers to inject arbitrary web script or HTML via (1) the URI in an about: page or (2) the last visited URL in the LastVisitWriteEn function in function.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5907 
Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter in a "3" action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5908 
Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to inject arbitrary web script or HTML via the conditions[usergroup][] parameter in a search action to admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5909 
SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditions[usergroup][] parameter in a search action to admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5910 
SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5911 
Cross-site scripting (XSS) vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbitrary web script or HTML via the message body.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5912 
Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) page.php or (2) single.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z
CVE-2012-5913 
Cross-site scripting (XSS) vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter to wp-login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-17T21:00:00.000Z