rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-5212 
SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the (1) user name or (2) password field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-22T23:00:00.000Z
CVE-2011-5213 
Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login[username] parameter to index.php, (2) parent_id parameter to modules/Documents/version_list.php, or (3) contact_id parameter to modules/Documents/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5214 
Multiple cross-site scripting (XSS) vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) modules/admin/admin_module_index.php, or (3) modules/calendar/customise_calendar_times.php; login[] parameter to (4) index.php or (5) pub/clients.php; or framed parameter to (6) licence/index.php or (7) licence/view.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5215 
SQL injection vulnerability in index.php in Video Community Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5216 
SQL injection vulnerability in ajax.php in SCORM Cloud For WordPress plugin before 1.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the active parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5217 
Directory traversal vulnerability in the PXE Mtftp service in Hitachi JP1/ServerConductor/DeploymentManager before 08-55 Japanese and before 08-51 English allows remote attackers to read arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5218 
SQL injection vulnerability in DotA OpenStats 1.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5219 
Directory traversal vulnerability in examples/show_code.php in mPDF 5.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5220 
Cross-site scripting (XSS) vulnerability in templates/default/Admin/Login.html in PHP-SCMS 1.6.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5221 
Cross-site scripting (XSS) vulnerability in the getLog function in svnlook.php in WebSVN before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to (1) comp.php, (2) diff.php, or (3) revision.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5222 
SQL injection vulnerability in rub2_w.php in PHP Flirt-Projekt 4.8 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the rub parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5223 
Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti before 0.8.7i allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5224 
SQL injection vulnerability in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5225 
Cross-site scripting (XSS) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5226 
Cross-site request forgery (CSRF) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to hijack the authentication of an administrator for requests that trigger snapshots.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5227 
Stack-based buffer overflow in the Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 allows remote attackers to execute arbitrary code via a long PRIO field in a message to UDP port 514.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5228 
Cross-site scripting (XSS) vulnerability in the Search module (quickstart/search) in appRain CMF 0.1.5 allows remote attackers to inject arbitrary web script or HTML via the ss parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5229 
SQL injection vulnerability in quickstart/profile/index.php in the Forum module in appRain CMF 0.1.5 allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5230 
Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/LoginModel.php in Seotoaster 1.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to sys/login/index or (2) memberLoginName parameter to sys/login/member.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5233 
Heap-based buffer overflow in IrfanView before 4.32 allows remote attackers to execute arbitrary code via crafted "Rows Per Strip" and "Samples Per Pixel" values in a TIFF image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5234 
SQL injection vulnerability in user.php in Social Network Community 2 allows remote attackers to execute arbitrary SQL commands via the userId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5235 
SQL injection vulnerability in mnoGoSearch before 3.3.12 allows remote attackers to execute arbitrary SQL commands via the hostname in a hypertext link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T17:00:00.000Z
CVE-2011-5236 
Moneris eSelectPlus 2.03 PHP API does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-06T11:00:00.000Z
CVE-2011-5237 
PayPal WPS ToolKit does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-06T11:00:00.000Z
CVE-2011-5238 
google-checkout-php-sample-code before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-06T11:00:00.000Z
CVE-2011-5239 
CiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-06T11:00:00.000Z
CVE-2011-5240 
Magento 1.5 and 1.6.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-06T11:00:00.000Z
CVE-2011-5241 
Services_Twitter 0.6.3 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-06T11:00:00.000Z
CVE-2011-5242 
tmhOAuth before 0.61 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-06T11:00:00.000Z
CVE-2011-5243 
TwitterOAuth does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-06T11:00:00.000Z
CVE-2011-5244 
Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, different vulnerabilities than CVE-2010-2642 and CVE-2011-0433.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-19T11:00:00.000Z
CVE-2011-5245 
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-23T20:00:00.000Z
CVE-2011-5247 
Snare for Linux before 1.7.0 has password disclosure because the rendered page contains the field RemotePassword.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T22:35:27.000Z
CVE-2011-5249 
Cross-site scripting (XSS) vulnerability in the events page in the System iNtrusion Analysis and Reporting Environment (SNARE) for Linux agent before 1.7.0 allows remote attackers to inject arbitrary web script or HTML via a logged shell command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T19:00:00.000Z
CVE-2011-5250 
Snare for Linux before 1.7.0 has CSRF in the web interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T22:38:43.000Z
CVE-2011-5251 
Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter in a lostpw action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-31T20:00:00.000Z
CVE-2011-5252 
Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the ReturnUrl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-12T02:00:00.000Z
CVE-2011-5253 
Dl Download Ticket Service 0.3 through 0.9 allows remote attackers to login as an arbitrary user by supplying an authorization header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-12T02:00:00.000Z
CVE-2011-5254 
Unspecified vulnerability in the Connections plugin before 0.7.1.6 for WordPress has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-12T02:00:00.000Z
CVE-2011-5255 
Multiple cross-site scripting (XSS) vulnerabilities in admin/login in X3 CMS 0.4.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, (2) username, or (3) password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-31T02:00:00.000Z
CVE-2011-5256 
Cross-site scripting (XSS) vulnerability in the tooltips in LimeSurvey before 1.91+ Build 11379-20111116, when viewing survey results, allows remote attackers to inject arbitrary web script or HTML via unknown parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-12T20:00:00.000Z
CVE-2011-5257 
Multiple cross-site scripting (XSS) vulnerabilities in the Classipress theme before 3.1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) twitter_id parameter related to the Twitter widget and (2) facebook_id parameter related to the Facebook widget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-12T20:00:00.000Z
CVE-2011-5258 
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the (1) uniqcode or (2) isAdmin parameter to index.php; or the (3) PATH_INFO to lib/controllers/centralcontroller.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-12T20:00:00.000Z
CVE-2011-5259 
SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-12T20:00:00.000Z
CVE-2011-5260 
Cross-site scripting (XSS) vulnerability in SAP/BW/DOC/METADATA in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-12T20:00:00.000Z
CVE-2011-5261 
Cross-site scripting (XSS) vulnerability in serverreport.cgi in Axis M10 Series Network Cameras M1054 firmware 5.21 and earlier allows remote attackers to inject arbitrary web script or HTML via the pageTitle parameter to admin/showReport.shtml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-12T20:00:00.000Z
CVE-2011-5262 
SQL injection vulnerability in prodpage.cfm in SonicWALL Aventail allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-12T20:00:00.000Z
CVE-2011-5263 
Cross-site scripting (XSS) vulnerability in RetrieveMailExamples in SAP NetWeaver 7.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the server parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-12T20:00:00.000Z
CVE-2011-5264 
Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup plugin before 0.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xml_or_all parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-12T20:00:00.000Z
CVE-2011-5265 
Cross-site scripting (XSS) vulnerability in cached_image.php in the Featurific For WordPress plugin 1.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the snum parameter.  NOTE: this has been disputed by a third party.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-12T20:00:00.000Z
CVE-2011-5266 
Imperva SecureSphere Web Application Firewall (WAF) before 12-august-2010 allows SQL injection filter bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T22:43:52.000Z
CVE-2011-5267 
Multiple cross-site scripting (XSS) vulnerabilities in spell-check-savedicts.php in the SpellChecker module in Xinha, as used in WikiWig 5.01 and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the (1) to_p_dict or (2) to_r_list parameter.  NOTE: this issue might be related to the htmlarea plugin and CVE-2013-5670.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T18:00:00.000Z
CVE-2011-5268 
connection.c in Bip before 0.8.9 does not properly close sockets, which allows remote attackers to cause a denial of service (file descriptor consumption and crash) via multiple failed SSL handshakes, a different vulnerability than CVE-2013-4550.  NOTE: this issue was SPLIT from CVE-2013-4550 because it is a different type of issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-24T19:00:00.000Z
CVE-2011-5269 
Cross-site scripting (XSS) vulnerability in ProjectForge before 3.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a validation message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T11:00:00.000Z
CVE-2011-5270 
wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T01:00:00.000Z
CVE-2011-5271 
Pacemaker before 1.1.6 configure script creates temporary files insecurely
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T13:12:09.000Z
CVE-2011-5272 
SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the vps_note parameter to dtcadmin/logPushlet.php.  NOTE: this issue was originally part of CVE-2011-3197, but that ID was SPLIT due to different researchers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T19:00:00.000Z
CVE-2011-5273 
Directory traversal vulnerability in shared/package-installer in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the pkg parameter in a do_install action to dtc/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T19:00:00.000Z
CVE-2011-5274 
The drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkg_directory parameter in a do_install action to dtc/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T19:00:00.000Z
CVE-2011-5275 
The install script in Domain Technologie Control (DTC) before 0.34.1 gives sudo permissions for chrootuid to the dtc user, which makes it easier for context-dependent users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T19:00:00.000Z
CVE-2011-5276 
SQL injection vulnerability in the drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote authenticated users to execute arbitrary SQL commands via the database_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T19:00:00.000Z
CVE-2011-5277 
Multiple SQL injection vulnerabilities in signature.php in the Advanced Forum Signatures (aka afsignatures) plugin 2.0.4 for MyBB allow remote attackers to execute arbitrary SQL commands via the (1) afs_type, (2) afs_background, (3) afs_showonline, (4) afs_bar_left, (5) afs_bar_center, (6) afs_full_line1, (7) afs_full_line2, (8) afs_full_line3, (9) afs_full_line4, (10) afs_full_line5, or (11) afs_full_line6 parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-08T14:00:00.000Z
CVE-2011-5278 
SQL injection vulnerability in signature.php in Advanced Forum Signatures plugin (aka afsignatures) 2.0.4 for MyBB allows remote attackers to execute arbitrary SQL commands via the afs_bar_right parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-08T14:00:00.000Z
CVE-2011-5279 
CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Windows 2000 allows remote attackers to modify arbitrary uppercase environment variables via a \n (newline) character in an HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-23T20:00:00.000Z
CVE-2011-5280 
Multiple stack-based buffer overflows in BOINC 6.13.x allow remote attackers to cause a denial of service (crash) via a long trickle-up to (1) client/cs_trickle.cpp or (2) db/db_base.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T15:00:00.000Z
CVE-2011-5282 
mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled.
Problem types: description: data leak
Affected products: vendor: mIRC
product: mIRC
Published: 2020-01-21T15:05:30.000Z
CVE-2011-5283 
Cross-site scripting (XSS) vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to inject arbitrary web script or HTML via the IP parameter in a Run action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-31T22:00:00.000Z
CVE-2011-5284 
Cross-site request forgery (CSRF) vulnerability in the web management interface in httpd/cgi-bin/shutdown.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to hijack the authentication of administrators for requests that perform a reboot via a request to cgi-bin/shutdown.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-31T22:00:00.000Z