rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-4295 
The moodle_enrol_external:role_assign function in enrol/externallib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not have an authorization check, which allows remote authenticated users to gain privileges by making a role assignment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-16T10:00:00.000Z
CVE-2011-4296 
lib/db/access.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 assigns incorrect capabilities to the course-creator role, which allows remote authenticated users to modify course filters by leveraging this role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-16T10:00:00.000Z
CVE-2011-4297 
comment/lib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not properly restrict comment capabilities, which allows remote attackers to post a comment by leveraging the guest role and operating on a front-page activity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-16T10:00:00.000Z
CVE-2011-4298 
Multiple cross-site request forgery (CSRF) vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2011-4299 
Cross-site scripting (XSS) vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2011-4300 
The file_browser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2011-4301 
The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the values of constant fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2011-4302 
mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value of the openssl_verify function, which allows remote attackers to bypass validation via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2011-4303 
lib/db/upgrade.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not set the correct registration_hubs.secret value during installation, which allows remote attackers to bypass intended access restrictions by leveraging the hubs feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2011-4304 
The chat functionality in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to discover the name of any user via a beep operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2011-4305 
message/refresh.php in Moodle 1.9.x before 1.9.14 allows remote authenticated users to cause a denial of service (infinite request loop) via a URL that specifies a zero wait time for message refreshing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2011-4306 
Cross-site scripting (XSS) vulnerability in course/editsection.html in Moodle 1.9.x before 1.9.14 allows remote authenticated users to inject arbitrary web script or HTML via crafted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2011-4307 
Cross-site scripting (XSS) vulnerability in mod/wiki/lang/en/wiki.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the section parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2011-4308 
mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2011-4309 
Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended access restrictions and perform global searches by leveraging the guest role and making a direct request to a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-11T10:00:00.000Z
CVE-2011-4310 
The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.
Problem types: description: Other
Affected products: vendor: The CMS Made Simple Foundation
product: CMSMS
Published: 2019-11-26T22:57:43.000Z
CVE-2011-4311 
ResourceSpace before 4.2.2833 does not properly validate access keys, which allows remote attackers to bypass intended resource restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-19T02:00:00.000Z
CVE-2011-4312 
Multiple cross-site scripting (XSS) vulnerabilities in the commenting system in Review Board before 1.5.7 and 1.6.x before 1.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) diff viewer or (2) screenshot component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-24T02:00:00.000Z
CVE-2011-4313 
query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-29T17:00:00.000Z
CVE-2011-4314 
message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-27T15:00:00.000Z
CVE-2011-4315 
Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T20:00:00.000Z
CVE-2011-4316 
Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, in certain unspecified conditions, does not lock the desktop screen between SPICE sessions, which allows local users with access to a virtual machine to gain access to other users' desktop sessions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-04T22:00:00.000Z
CVE-2011-4317 
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-30T02:00:00.000Z
CVE-2011-4318 
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-07T01:00:00.000Z
CVE-2011-4319 
Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-28T11:00:00.000Z
CVE-2011-4320 
The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service (infinite loop) via a stanza with a publish tag that lacks a node attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-18T00:00:00.000Z
CVE-2011-4321 
The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-23T18:00:00.000Z
CVE-2011-4322 
websitebaker prior to and including 2.8.1 has an authentication error in backup module.
Problem types: description: authentication error
Affected products: vendor: websitebaker
product: websitebaker
Published: 2020-01-21T14:57:47.000Z
CVE-2011-4324 
The encode_share_access function in fs/nfs/nfs4xdr.c in the Linux kernel before 2.6.29 allows local users to cause a denial of service (BUG and system crash) by using the mknod system call with a pathname on an NFSv4 filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T23:00:00.000Z
CVE-2011-4325 
The NFS implementation in Linux kernel before 2.6.31-rc6 calls certain functions without properly initializing certain data, which allows local users to cause a denial of service (NULL pointer dereference and O_DIRECT oops), as demonstrated using diotest4 from LTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-27T15:00:00.000Z
CVE-2011-4326 
The udp6_ufo_fragment function in net/ipv6/udp.c in the Linux kernel before 2.6.39, when a certain UDP Fragmentation Offload (UFO) configuration is enabled, allows remote attackers to cause a denial of service (system crash) by sending fragmented IPv6 UDP packets to a bridge device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-17T10:00:00.000Z
CVE-2011-4327 
ssh-keysign.c in ssh-keysign in OpenSSH before 5.8p2 on certain platforms executes ssh-rand-helper with unintended open file descriptors, which allows local users to obtain sensitive key information via the ptrace system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-03T02:00:00.000Z
CVE-2011-4328 
plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp, which allows local users to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-16T00:00:00.000Z
CVE-2011-4329 
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter in a setup action to admin/company.php, or the PATH_INFO to (2) admin/security_other.php, (3) admin/events.php, or (4) admin/user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-28T11:00:00.000Z
CVE-2011-4330 
Stack-based buffer overflow in the hfs_mac2asc function in fs/hfs/trans.c in the Linux kernel 2.6 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via an HFS image with a crafted len field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-27T15:00:00.000Z
CVE-2011-4332 
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.6.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-23T18:00:00.000Z
CVE-2011-4333 
Multiple cross-site scripting (XSS) vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) from parameter to index.php or the (2) page_no parameter to recentchanges.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-23T18:00:00.000Z
CVE-2011-4334 
edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated users to upload arbitrary PHP files via a PHP file with a .gif extension in the userfile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-23T18:00:00.000Z
CVE-2011-4335 
Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php in a (1) teachers.html or (2) teachers/ action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-28T11:00:00.000Z
CVE-2011-4336 
Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php.
Problem types: description: XSS
Affected products: vendor: Tiki
product: Wiki CMS Groupware
Published: 2020-01-15T13:48:01.000Z
CVE-2011-4337 
Static code injection vulnerability in translate.php in Support Incident Tracker (aka SiT!) 3.45 through 3.65 allows remote attackers to inject arbitrary PHP code into an executable language file in the i18n directory via the lang variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T11:00:00.000Z
CVE-2011-4338 
Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password.
Problem types: description: authorization error
Affected products: vendor: shaman
product: shaman
Published: 2020-02-12T18:11:17.000Z
CVE-2011-4339 
ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4340 
Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author privileges to inject arbitrary web script or HTML via (1) the profile parameter to extensions/profiledevkit/content/content.profile.php, as demonstrated via requests to (a) the default URI, (b) about/, or (c) drafts/; or (2) the filter parameter in symphony/lib/core/class.symphony.php, as demonstrated via requests to (d) symphony/publish/comments or (e) symphony/publish/images.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-12T22:00:00.000Z
CVE-2011-4341 
Multiple SQL injection vulnerabilities in symphony/content/content.publish.php in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author permissions to execute arbitrary SQL commands via the filter parameter to (1) symphony/publish/comments or (2) symphony/publish/images.  NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks via error messages.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-12T22:00:00.000Z
CVE-2011-4342 
PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the wpabs parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-08T18:00:00.000Z
CVE-2011-4343 
Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-08T21:00:00.000Z
CVE-2011-4344 
Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-01T11:00:00.000Z
CVE-2011-4345 
Cross-site scripting (XSS) vulnerability in Namazu before 2.0.21, when Internet Explorer 6 or 7 is used, allows remote attackers to inject arbitrary web script or HTML via a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-30T02:00:00.000Z
CVE-2011-4346 
Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-10T17:00:00.000Z
CVE-2011-4347 
The kvm_vm_ioctl_assign_device function in virt/kvm/assigned-dev.c in the KVM subsystem in the Linux kernel before 3.1.10 does not verify permission to access PCI configuration space and BAR resources, which allows host OS users to assign PCI devices and cause a denial of service (host OS crash) via a KVM_ASSIGN_PCI_DEVICE operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-08T10:00:00.000Z
CVE-2011-4348 
Race condition in the sctp_rcv function in net/sctp/input.c in the Linux kernel before 2.6.29 allows remote attackers to cause a denial of service (system hang) via SCTP packets.  NOTE: in some environments, this issue exists because of an incomplete fix for CVE-2011-2482.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-08T10:00:00.000Z
CVE-2011-4349 
Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices and (a) device id, (b) property, or (c) profile id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-10T17:00:00.000Z
CVE-2011-4350 
Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to obtain content of arbitrary local files via specially-crafted URL request.
Problem types: description: Directory Traversal (Local File Inclusion)
Affected products: vendor: yaws
product: yaws
Published: 2019-11-26T04:49:52.000Z
CVE-2011-4351 
Buffer overflow in FFmpeg before 0.5.6, 0.6.x before 0.6.4, 0.7.x before 0.7.8, and 0.8.x before 0.8.8 allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-09T11:00:00.000Z
CVE-2011-4352 
Integer overflow in the vp3_dequant function in the VP3 decoder (vp3.c) in libavcodec in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VP3 stream, which triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T20:00:00.000Z
CVE-2011-4353 
The (1) av_image_fill_pointers, (2) vp5_parse_coeff, and (3) vp6_parse_coeff functions in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allow remote attackers to cause a denial of service (out-of-bounds read) via a crafted VP5 or VP6 stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T20:00:00.000Z
CVE-2011-4354 
crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-27T00:00:00.000Z
CVE-2011-4355 
GNU Project Debugger (GDB) before 7.5, when .debug_gdb_scripts is defined, automatically loads certain files from the current working directory, which allows local users to gain privileges via crafted files such as Python scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-04T21:00:00.000Z
CVE-2011-4356 
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-05T11:00:00.000Z
CVE-2011-4357 
Format string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit (neo_cgi) module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers that are not properly handled when creating CGI error messages using the cgi_error API function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-10T17:00:00.000Z
CVE-2011-4358 
Unspecified vulnerability in Oracle GlassFish Enterprise Server 3.0.1 and 3.1.1 allows remote attackers to affect confidentiality and integrity, related to JSF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-17T22:00:00.000Z
CVE-2011-4360 
MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-08T11:00:00.000Z