rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-3888 
The login implementation in AirDroid 1.0.4 beta allows remote attackers to bypass a multiple-login protection mechanism by modifying a pass value within JSON data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-26T22:00:00.000Z
CVE-2012-3889 
The in_mod plugin in Winamp before 5.63 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a .IT file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2012-3890 
The in_mod plugin in Winamp before 5.63 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a .IT file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2012-3893 
The FlexVPN implementation in Cisco IOS 15.2 and 15.3 allows remote authenticated users to cause a denial of service (spoke crash) via spoke-to-spoke traffic, aka Bug ID CSCtz02622.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-16T10:00:00.000Z
CVE-2012-3895 
Cisco IOS 15.0 through 15.3 allows remote authenticated users to cause a denial of service (device crash) via an MVPNv6 update, aka Bug ID CSCty89224.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-16T10:00:00.000Z
CVE-2012-3899 
sensorApp on Cisco IPS 4200 series sensors 6.0, 6.2, and 7.0 does not properly allocate memory, which allows remote attackers to cause a denial of service (memory corruption and process crash, and traffic-inspection outage) via network traffic, aka Bug ID CSCtn23051.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-16T10:00:00.000Z
CVE-2012-3901 
The updateTime function in sensorApp on Cisco IPS 4200 series sensors 7.0 and 7.1 allows remote attackers to cause a denial of service (process crash and traffic-inspection outage) via network traffic, aka Bug ID CSCta96144.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-16T10:00:00.000Z
CVE-2012-3908 
Multiple cross-site request forgery (CSRF) vulnerabilities in the ISE Administrator user interface (aka the Apache Tomcat interface) on Cisco Identity Services Engine (ISE) 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the authentication of administrators, aka Bug ID CSCty46684.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-16T10:00:00.000Z
CVE-2012-3913 
The Cisco VC220 and VC240 cameras allow remote attackers to cause a denial of service (WebUI outage) via crafted packets, aka Bug IDs CSCtf73188, CSCtf88059, CSCtf87951, CSCtf87908, and CSCtf88019.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-31T19:00:00.000Z
CVE-2012-3915 
The DMVPN tunnel implementation in Cisco IOS 15.2 allows remote attackers to cause a denial of service (persistent IKE state) via a large volume of hub-to-spoke traffic, aka Bug ID CSCtq39602.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-16T10:00:00.000Z
CVE-2012-3918 
Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-23T10:00:00.000Z
CVE-2012-3919 
The Cisco Application Control Engine (ACE) module 3.0 for Cisco Catalyst switches and Cisco routers does not properly monitor Load Balancer (LB) queues, which allows remote attackers to cause a denial of service (incorrect memory access and module reboot) via application traffic, aka Bug ID CSCtw70879.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-16T10:00:00.000Z
CVE-2012-3923 
The SSLVPN implementation in Cisco IOS 12.4, 15.0, 15.1, and 15.2, when DTLS is not enabled, does not properly handle certain outbound ACL configurations, which allows remote authenticated users to cause a denial of service (device crash) via a session involving a PPP over ATM (PPPoA) interface, aka Bug ID CSCte41827.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-16T10:00:00.000Z
CVE-2012-3924 
The SSLVPN implementation in Cisco IOS 15.1 and 15.2, when DTLS is enabled, does not properly handle certain outbound ACL configurations, which allows remote authenticated users to cause a denial of service (device crash) via a session involving a PPP over ATM (PPPoA) interface, aka Bug ID CSCty97961.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-16T10:00:00.000Z
CVE-2012-3935 
Cisco Unified Presence (CUP) before 8.6(3) and Jabber Extensible Communications Platform (aka Jabber XCP) before 5.3 allow remote attackers to cause a denial of service (process crash) via a crafted XMPP stream header, aka Bug ID CSCtu32832.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-12T23:00:00.000Z
CVE-2012-3936 
Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCua40962.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T14:00:00.000Z
CVE-2012-3937 
Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72967.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T14:00:00.000Z
CVE-2012-3938 
Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz73583.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T14:00:00.000Z
CVE-2012-3939 
Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted WRF file, aka Bug ID CSCua61331.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T14:00:00.000Z
CVE-2012-3940 
Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72958.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T14:00:00.000Z
CVE-2012-3941 
Heap-based buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72850.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T14:00:00.000Z
CVE-2012-3946 
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-24T10:00:00.000Z
CVE-2012-3949 
The SIP implementation in Cisco Unified Communications Manager (CUCM) 6.x and 7.x before 7.1(5b)su5, 8.x before 8.5(1)su4, and 8.6 before 8.6(2a)su1; Cisco IOS 12.2 through 12.4 and 15.0 through 15.2; and Cisco IOS XE 3.3.xSG before 3.3.1SG, 3.4.xS, and 3.5.xS allows remote attackers to cause a denial of service (service crash or device reload) via a crafted SIP message containing an SDP session description, aka Bug IDs CSCtw66721, CSCtj33003, and CSCtw84664.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-27T00:00:00.000Z
CVE-2012-3950 
The Intrusion Prevention System (IPS) feature in Cisco IOS 12.3 through 12.4 and 15.0 through 15.2, in certain configurations of enabled categories and missing signatures, allows remote attackers to cause a denial of service (device reload) via DNS packets, aka Bug ID CSCtw55976.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-27T00:00:00.000Z
CVE-2012-3951 
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-31T10:00:00.000Z
CVE-2012-3952 
Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-12T00:00:00.000Z
CVE-2012-3953 
SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-12T00:00:00.000Z
CVE-2012-3954 
Multiple memory leaks in ISC DHCP 4.1.x and 4.2.x before 4.2.4-P1 and 4.1-ESV before 4.1-ESV-R6 allow remote attackers to cause a denial of service (memory consumption) by sending many requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T10:00:00.000Z
CVE-2012-3955 
ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before 4.2.4-P2 allows remote attackers to cause a denial of service (daemon crash) in opportunistic circumstances by establishing an IPv6 lease in an environment where the lease expiration time is later reduced.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-14T10:00:00.000Z
CVE-2012-3956 
Use-after-free vulnerability in the MediaStreamGraphThreadRunnable::Run function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3957 
Heap-based buffer overflow in the nsBlockFrame::MarkLineDirty function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3958 
Use-after-free vulnerability in the nsHTMLEditRules::DeleteNonTableElements function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3959 
Use-after-free vulnerability in the nsRangeUpdater::SelAdjDeleteNode function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3960 
Use-after-free vulnerability in the mozSpellChecker::SetCurrentDictionary function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3961 
Use-after-free vulnerability in the RangeData implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3962 
Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly iterate through the characters in a text run, which allows remote attackers to execute arbitrary code via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3963 
Use-after-free vulnerability in the js::gc::MapAllocToTraceKind function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3964 
Use-after-free vulnerability in the gfxTextRun::GetUserData function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3965 
Mozilla Firefox before 15.0 does not properly restrict navigation to the about:newtab page, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers creation of a new tab and then a new window.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3966 
Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a negative height value in a BMP image within a .ICO file, related to (1) improper handling of the transparency bitmask by the nsICODecoder component and (2) improper processing of the alpha channel by the nsBMPDecoder component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3967 
The WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 on Linux, when a large number of sampler uniforms are used, does not properly interact with Mesa drivers, which allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3968 
Use-after-free vulnerability in the WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via vectors related to deletion of a fragment shader by its accessor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3969 
Integer overflow in the nsSVGFEMorphologyElement::Filter function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via a crafted SVG filter that triggers an incorrect sum calculation, leading to a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3970 
Use-after-free vulnerability in the nsTArray_base::Length function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving movement of a requiredFeatures attribute from one SVG document to another.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3971 
Summer Institute of Linguistics (SIL) Graphite 2, as used in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the (1) Silf::readClassMap and (2) Pass::readPass functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3972 
The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3973 
The debugger in the developer-tools subsystem in Mozilla Firefox before 15.0, when remote debugging is disabled, does not properly restrict access to the remote-debugging service, which allows remote attackers to execute arbitrary code by leveraging the presence of the HTTPMonitor extension and connecting to that service through the HTTPMonitor port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3974 
Untrusted search path vulnerability in the installer in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, and Thunderbird ESR 10.x before 10.0.7 on Windows allows local users to gain privileges via a Trojan horse executable file in a root directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3975 
The DOMParser component in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 loads subresources during parsing of text/html data within an extension, which allows remote attackers to obtain sensitive information by providing crafted data to privileged extension code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3976 
Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly handle onLocationChange events during navigation between different https sites, which allows remote attackers to spoof the X.509 certificate information in the address bar via a crafted web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3978 
The nsLocation::CheckURL function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 does not properly follow the security model of the location object, which allows remote attackers to bypass intended content-loading restrictions or possibly have unspecified other impact via vectors involving chrome code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3979 
Mozilla Firefox before 15.0 on Android does not properly implement unspecified callers of the __android_log_print function, which allows remote attackers to execute arbitrary code via a crafted web page that calls the JavaScript dump function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3980 
The web console in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, and Thunderbird ESR 10.x before 10.0.7 allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that injects this code and triggers an eval operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T10:00:00.000Z
CVE-2012-3981 
Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not restrict the characters in a username, which might allow remote attackers to inject data into an LDAP directory via a crafted login attempt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-04T10:00:00.000Z
CVE-2012-3982 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-3983 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-3984 
Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly handle navigation away from a web page that has a SELECT element's menu active, which allows remote attackers to spoof page content via vectors involving absolute positioning and scrolling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-3985 
Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly implement the HTML5 Same Origin Policy, which allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging initial-origin access after document.domain has been set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-3986 
Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict calls to DOMWindowUtils (aka nsDOMWindowUtils) methods, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z