CVEs

347,154 total · page 5874 of 6,944

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2012-4563	Google Web Toolkit	0.00	—	0.01	Nov 20, 2012	Cross-site scripting (XSS) vulnerability in Google Web Toolkit (GWT) 2.4 Beta and release candidates before 2.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4523	Radsecproxy Radsecproxy	0.00	—	0.02	Nov 20, 2012	radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof…
CVE-2012-4510	Cups Pk Helper Project Cups Pk Helper	0.00	—	0.01	Nov 20, 2012	cups-pk-helper before 0.2.3 does not properly wrap the (1) cupsGetFile and (2) cupsPutFile function calls, which allows user-assisted remote attackers to read or overwrite sensitive files using CUPS resources.
CVE-2012-4366	Belkin N900	0.03	—	0.05	Nov 20, 2012	Belkin wireless routers Surf N150 Model F7D1301v1, N900 Model F9K1104v1, N450 Model F9K1105V2, and N300 Model F7D2301v1 generate a predictable default WPA2-PSK passphrase based on eight digits of the WAN MAC address, which allows remote attackers to access the network by…
CVE-2012-3354	Dokuwiki Dokuwiki	0.00	—	0.01	Nov 20, 2012	doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter, which reveals the installation path in an error message.
CVE-2011-4612	Xiph.Org Icecast	0.00	—	0.02	Nov 20, 2012	icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc (error.log) via a crafted URL.
CVE-2012-5919	Havalite Havalite	0.03	—	0.02	Nov 19, 2012	Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) find or (2) replace fields to havalite/findReplace.php; (3) username parameter to havalite/hava_login.php, (4) the Edit…
CVE-2012-5918	Razorcms Razorcms	0.03	—	0.02	Nov 19, 2012	razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a directory.
CVE-2012-5854	Weechat Weechat	0.00	—	0.06	Nov 19, 2012	Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attackers to cause a denial of service (crash or hang) and possibly execute arbitrary code via crafted IRC colors that are not properly decoded.
CVE-2012-4541	Piwik Piwik	0.00	—	0.01	Nov 19, 2012	Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4423	Libvirt Libvirt	0.00	—	0.04	Nov 19, 2012	The virNetServerProgramDispatchCall function in libvirt before 0.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and segmentation fault) via an RPC call with (1) an event as the RPC number or (2) an RPC number whose value is in a "gap" in the…
CVE-2012-4233	Libreoffice Libreoffice	0.00	—	0.03	Nov 19, 2012	LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted (1) odt file to vcllo.dll, (2) ODG (Drawing document) file to svxcorelo.dll, (3) PolyPolygon record in…
CVE-2012-4225	Nvidia Unix Graphic Driver	0.00	—	0.00	Nov 19, 2012	NVIDIA UNIX graphics driver before 295.71 and before 304.32 allows local users to write to arbitrary physical memory locations and gain privileges by modifying the VGA window using /dev/nvidia0.
CVE-2011-5244	Tetex Tetex	0.00	—	0.03	Nov 19, 2012	Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code…
CVE-2011-2486	Nspluginwrapper Nspluginwrapper	0.00	—	0.02	Nov 19, 2012	nspluginwrapper before 1.4.4 does not properly provide access to NPNVprivateModeBool variable settings, which could prevent Firefox plugins from determining if they should run in Private Browsing mode and allow remote attackers to bypass intended access restrictions, as…
CVE-2011-0433	Tetex Tetex	0.00	—	0.04	Nov 19, 2012	Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted…
CVE-2012-4533	Viewvc Viewvc	0.00	—	0.03	Nov 19, 2012	Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via…
CVE-2012-4552	Steve J Baker Plib	0.04	—	0.10	Nov 18, 2012	Stack-based buffer overflow in the error function in ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to execute arbitrary code via a crafted 3d model file that triggers a long error message, as demonstrated by a .ase file.
CVE-2012-4520	Djangoproject Django	0.00	—	0.04	Nov 18, 2012	The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
CVE-2012-4433	Gegl Gegl	0.01	—	0.13	Nov 18, 2012	Multiple integer overflows in operations/external/ppm-load.c in GEGL (Generic Graphics Library) 0.2.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large (1) width or (2) height value in a Portable Pixel Map…
CVE-2012-4417	Gluster Glusterfs	0.00	—	0.00	Nov 18, 2012	GlusterFS 3.3.0, as used in Red Hat Storage server 2.0, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
CVE-2012-4950	Patterninsight Pattern Insight	0.00	—	0.01	Nov 18, 2012	Cross-site scripting (XSS) vulnerability in the Keyword Search page in the web interface in Pattern Insight 2.3 allows remote attackers to inject arbitrary web script or HTML via crafted characters that are not properly handled during construction of error messages.
CVE-2012-4947	Agilefleet Fleetcommander Kiosk	0.00	—	0.02	Nov 18, 2012	Agile FleetCommander and FleetCommander Kiosk before 4.08 store database credentials in cleartext, which allows remote attackers to obtain sensitive information via requests to unspecified pages.
CVE-2012-4946	Agilefleet Fleetcommander Kiosk	0.00	—	0.01	Nov 18, 2012	Agile FleetCommander and FleetCommander Kiosk before 4.08 use an XOR format for password encryption, which makes it easier for context-dependent attackers to obtain sensitive information by reading a key file and the encrypted strings.
CVE-2012-4945	Agilefleet Fleetcommander Kiosk	0.00	—	0.02	Nov 18, 2012	Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection" issue.
CVE-2012-4944	Agilefleet Fleetcommander Kiosk	0.00	—	0.04	Nov 18, 2012	Multiple unrestricted file upload vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary code by uploading a file via an unspecified page.
CVE-2012-4943	Agilefleet Fleetcommander Kiosk	0.00	—	0.01	Nov 18, 2012	Multiple cross-site request forgery (CSRF) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to hijack the authentication of arbitrary users for requests that modify (1) passwords, (2) accounts, or (3) permissions.
CVE-2012-4942	Agilefleet Fleetcommander Kiosk	0.00	—	0.01	Nov 18, 2012	Multiple cross-site scripting (XSS) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to inject arbitrary web script or HTML via an arbitrary text field.
CVE-2012-4941	Agilefleet Fleetcommander Kiosk	0.00	—	0.01	Nov 18, 2012	Multiple SQL injection vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-4938	Patterninsight Pattern Insight	0.00	—	0.01	Nov 18, 2012	Cross-site scripting (XSS) vulnerability in the web interface in Pattern Insight 2.3 allows remote authenticated administrators to inject arbitrary web script or HTML via the banner message.
CVE-2012-4937	Patterninsight Pattern Insight	0.00	—	0.02	Nov 18, 2012	Session fixation vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack web sessions via a jsession_id cookie.
CVE-2012-4936	Patterninsight Pattern Insight	0.00	—	0.01	Nov 18, 2012	The web interface in Pattern Insight 2.3 allows remote attackers to conduct clickjacking attacks via a FRAME element.
CVE-2012-4935	Patterninsight Pattern Insight	0.00	—	0.01	Nov 18, 2012	Cross-site request forgery (CSRF) vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack the authentication of arbitrary users.
CVE-2012-4959	Novell File Reporter	0.09	—	0.71	Nov 18, 2012	Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to upload and execute files via a 130 /FSF/CMD request with a .. (dot dot) in a FILE element of an FSFUI record.
CVE-2012-4958	Novell File Reporter	0.09	—	0.74	Nov 18, 2012	Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a 126 /FSF/CMD request with a .. (dot dot) in a FILE element of an FSFUI record.
CVE-2012-4957	Novell File Reporter	0.08	—	0.68	Nov 18, 2012	Absolute path traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a /FSF/CMD request with a full pathname in a PATH element of an SRS record.
CVE-2012-4956	Novell File Reporter	0.06	—	0.38	Nov 18, 2012	Heap-based buffer overflow in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to execute arbitrary code via a large number of VOL elements in an SRS record.
CVE-2012-4575	Pgbouncer Pgbouncer	0.00	—	0.02	Nov 18, 2012	The add_database function in objects.c in the pgbouncer pooler 1.5.2 for PostgreSQL allows remote attackers to cause a denial of service (daemon outage) via a long database name in a request.
CVE-2012-5917	SnackAmp SnackAmp	0.03	—	0.03	Nov 17, 2012	SnackAmp 3.1.3 allows remote attackers to cause a denial of service (application crash) via a long string in an aiff file.
CVE-2012-5916	Neocrome Seditio	0.00	—	0.01	Nov 17, 2012	Neocrome Seditio build 161 allows remote attackers to obtain sensitive information via a direct request to (1) docs/new/seditio-createnew-160.sql, (2) docs/upgrade/sedito_convert_to_utf8.optional.sql, or (3) system/install/install.parser.sql.
CVE-2012-5915	Neocrome Seditio	0.00	—	0.01	Nov 17, 2012	Neocrome Seditio build 161 and earlier allows remote attackers to obtain sensitive information via direct request to (1) view.php, (2) plugins/contact/lang/contact.en.lang.php, (3) system/lang/en/main.lang.php, (4) system/lang/en/message.lang.php, or (5)…
CVE-2012-5914	Neocrome Seditio	0.00	—	0.01	Nov 17, 2012	Multiple cross-site scripting (XSS) vulnerabilities in the sed_import function in system/functions.php in Neocrome Seditio build 160 and 161 allow remote attackers to inject arbitrary web script or HTML via the (1) newmsg or (2) rtext parameter. NOTE: some of these details are…
CVE-2012-5913	WordPress WordPress Integrator	0.04	—	0.09	Nov 17, 2012	Cross-site scripting (XSS) vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter to wp-login.php.
CVE-2012-5912	PicoPublisher PicoPublisher	0.03	—	0.02	Nov 17, 2012	Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) page.php or (2) single.php.
CVE-2012-5911	B2evolution B2evolution	0.00	—	0.01	Nov 17, 2012	Cross-site scripting (XSS) vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbitrary web script or HTML via the message body.
CVE-2012-5910	B2evolution B2evolution	0.00	—	0.01	Nov 17, 2012	SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter.
CVE-2012-5909	MyBB Mybb	0.03	—	0.01	Nov 17, 2012	SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditions[usergroup][] parameter in a search action to admin/index.php.
CVE-2012-5908	MyBB Mybb	0.03	—	0.02	Nov 17, 2012	Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to inject arbitrary web script or HTML via the conditions[usergroup][] parameter in a search action to admin/index.php.
CVE-2012-5907	Tomatocart Tomatocart	0.04	—	0.08	Nov 17, 2012	Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter in a "3" action.
CVE-2012-5906	Morequick Greenbrowser	0.00	—	0.01	Nov 17, 2012	Multiple cross-site scripting (XSS) vulnerabilities in GreenBrowser 6.1.0117 and 6.1.0216 allow remote attackers to inject arbitrary web script or HTML via (1) the URI in an about: page or (2) the last visited URL in the LastVisitWriteEn function in function.js.

CVE-2012-4563Nov 20, 2012
Google
Web Toolkit
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Google Web Toolkit (GWT) 2.4 Beta and release candidates before 2.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4523Nov 20, 2012
Radsecproxy
Radsecproxy
risk 0.00cvss —epss 0.02
radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof…
CVE-2012-4510Nov 20, 2012
Cups Pk Helper Project
Cups Pk Helper
risk 0.00cvss —epss 0.01
cups-pk-helper before 0.2.3 does not properly wrap the (1) cupsGetFile and (2) cupsPutFile function calls, which allows user-assisted remote attackers to read or overwrite sensitive files using CUPS resources.
CVE-2012-4366Nov 20, 2012
Belkin
N900
risk 0.03cvss —epss 0.05
Belkin wireless routers Surf N150 Model F7D1301v1, N900 Model F9K1104v1, N450 Model F9K1105V2, and N300 Model F7D2301v1 generate a predictable default WPA2-PSK passphrase based on eight digits of the WAN MAC address, which allows remote attackers to access the network by…
CVE-2012-3354Nov 20, 2012
Dokuwiki
Dokuwiki
risk 0.00cvss —epss 0.01
doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter, which reveals the installation path in an error message.
CVE-2011-4612Nov 20, 2012
Xiph.Org
Icecast
risk 0.00cvss —epss 0.02
icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc (error.log) via a crafted URL.
CVE-2012-5919Nov 19, 2012
Havalite
Havalite
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) find or (2) replace fields to havalite/findReplace.php; (3) username parameter to havalite/hava_login.php, (4) the Edit…
CVE-2012-5918Nov 19, 2012
Razorcms
Razorcms
risk 0.03cvss —epss 0.02
razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a directory.
CVE-2012-5854Nov 19, 2012
Weechat
Weechat
risk 0.00cvss —epss 0.06
Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attackers to cause a denial of service (crash or hang) and possibly execute arbitrary code via crafted IRC colors that are not properly decoded.
CVE-2012-4541Nov 19, 2012
Piwik
Piwik
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4423Nov 19, 2012
Libvirt
Libvirt
risk 0.00cvss —epss 0.04
The virNetServerProgramDispatchCall function in libvirt before 0.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and segmentation fault) via an RPC call with (1) an event as the RPC number or (2) an RPC number whose value is in a "gap" in the…
CVE-2012-4233Nov 19, 2012
Libreoffice
Libreoffice
risk 0.00cvss —epss 0.03
LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted (1) odt file to vcllo.dll, (2) ODG (Drawing document) file to svxcorelo.dll, (3) PolyPolygon record in…
CVE-2012-4225Nov 19, 2012
Nvidia
Unix Graphic Driver
risk 0.00cvss —epss 0.00
NVIDIA UNIX graphics driver before 295.71 and before 304.32 allows local users to write to arbitrary physical memory locations and gain privileges by modifying the VGA window using /dev/nvidia0.
CVE-2011-5244Nov 19, 2012
Tetex
Tetex
risk 0.00cvss —epss 0.03
Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code…
CVE-2011-2486Nov 19, 2012
Nspluginwrapper
Nspluginwrapper
risk 0.00cvss —epss 0.02
nspluginwrapper before 1.4.4 does not properly provide access to NPNVprivateModeBool variable settings, which could prevent Firefox plugins from determining if they should run in Private Browsing mode and allow remote attackers to bypass intended access restrictions, as…
CVE-2011-0433Nov 19, 2012
Tetex
Tetex
risk 0.00cvss —epss 0.04
Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted…
CVE-2012-4533Nov 19, 2012
Viewvc
Viewvc
risk 0.00cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via…
CVE-2012-4552Nov 18, 2012
Steve J Baker
Plib
risk 0.04cvss —epss 0.10
Stack-based buffer overflow in the error function in ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to execute arbitrary code via a crafted 3d model file that triggers a long error message, as demonstrated by a .ase file.
CVE-2012-4520Nov 18, 2012
Djangoproject
Django
risk 0.00cvss —epss 0.04
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
CVE-2012-4433Nov 18, 2012
Gegl
Gegl
risk 0.01cvss —epss 0.13
Multiple integer overflows in operations/external/ppm-load.c in GEGL (Generic Graphics Library) 0.2.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large (1) width or (2) height value in a Portable Pixel Map…
CVE-2012-4417Nov 18, 2012
Gluster
Glusterfs
risk 0.00cvss —epss 0.00
GlusterFS 3.3.0, as used in Red Hat Storage server 2.0, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
CVE-2012-4950Nov 18, 2012
Patterninsight
Pattern Insight
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Keyword Search page in the web interface in Pattern Insight 2.3 allows remote attackers to inject arbitrary web script or HTML via crafted characters that are not properly handled during construction of error messages.
CVE-2012-4947Nov 18, 2012
Agilefleet
Fleetcommander Kiosk
risk 0.00cvss —epss 0.02
Agile FleetCommander and FleetCommander Kiosk before 4.08 store database credentials in cleartext, which allows remote attackers to obtain sensitive information via requests to unspecified pages.
CVE-2012-4946Nov 18, 2012
Agilefleet
Fleetcommander Kiosk
risk 0.00cvss —epss 0.01
Agile FleetCommander and FleetCommander Kiosk before 4.08 use an XOR format for password encryption, which makes it easier for context-dependent attackers to obtain sensitive information by reading a key file and the encrypted strings.
CVE-2012-4945Nov 18, 2012
Agilefleet
Fleetcommander Kiosk
risk 0.00cvss —epss 0.02
Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection" issue.
CVE-2012-4944Nov 18, 2012
Agilefleet
Fleetcommander Kiosk
risk 0.00cvss —epss 0.04
Multiple unrestricted file upload vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary code by uploading a file via an unspecified page.
CVE-2012-4943Nov 18, 2012
Agilefleet
Fleetcommander Kiosk
risk 0.00cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to hijack the authentication of arbitrary users for requests that modify (1) passwords, (2) accounts, or (3) permissions.
CVE-2012-4942Nov 18, 2012
Agilefleet
Fleetcommander Kiosk
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to inject arbitrary web script or HTML via an arbitrary text field.
CVE-2012-4941Nov 18, 2012
Agilefleet
Fleetcommander Kiosk
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-4938Nov 18, 2012
Patterninsight
Pattern Insight
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the web interface in Pattern Insight 2.3 allows remote authenticated administrators to inject arbitrary web script or HTML via the banner message.
CVE-2012-4937Nov 18, 2012
Patterninsight
Pattern Insight
risk 0.00cvss —epss 0.02
Session fixation vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack web sessions via a jsession_id cookie.
CVE-2012-4936Nov 18, 2012
Patterninsight
Pattern Insight
risk 0.00cvss —epss 0.01
The web interface in Pattern Insight 2.3 allows remote attackers to conduct clickjacking attacks via a FRAME element.
CVE-2012-4935Nov 18, 2012
Patterninsight
Pattern Insight
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack the authentication of arbitrary users.
CVE-2012-4959Nov 18, 2012
Novell
File Reporter
risk 0.09cvss —epss 0.71
Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to upload and execute files via a 130 /FSF/CMD request with a .. (dot dot) in a FILE element of an FSFUI record.
CVE-2012-4958Nov 18, 2012
Novell
File Reporter
risk 0.09cvss —epss 0.74
Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a 126 /FSF/CMD request with a .. (dot dot) in a FILE element of an FSFUI record.
CVE-2012-4957Nov 18, 2012
Novell
File Reporter
risk 0.08cvss —epss 0.68
Absolute path traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a /FSF/CMD request with a full pathname in a PATH element of an SRS record.
CVE-2012-4956Nov 18, 2012
Novell
File Reporter
risk 0.06cvss —epss 0.38
Heap-based buffer overflow in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to execute arbitrary code via a large number of VOL elements in an SRS record.
CVE-2012-4575Nov 18, 2012
Pgbouncer
Pgbouncer
risk 0.00cvss —epss 0.02
The add_database function in objects.c in the pgbouncer pooler 1.5.2 for PostgreSQL allows remote attackers to cause a denial of service (daemon outage) via a long database name in a request.
CVE-2012-5917Nov 17, 2012
SnackAmp
SnackAmp
risk 0.03cvss —epss 0.03
SnackAmp 3.1.3 allows remote attackers to cause a denial of service (application crash) via a long string in an aiff file.
CVE-2012-5916Nov 17, 2012
Neocrome
Seditio
risk 0.00cvss —epss 0.01
Neocrome Seditio build 161 allows remote attackers to obtain sensitive information via a direct request to (1) docs/new/seditio-createnew-160.sql, (2) docs/upgrade/sedito_convert_to_utf8.optional.sql, or (3) system/install/install.parser.sql.
CVE-2012-5915Nov 17, 2012
Neocrome
Seditio
risk 0.00cvss —epss 0.01
Neocrome Seditio build 161 and earlier allows remote attackers to obtain sensitive information via direct request to (1) view.php, (2) plugins/contact/lang/contact.en.lang.php, (3) system/lang/en/main.lang.php, (4) system/lang/en/message.lang.php, or (5)…
CVE-2012-5914Nov 17, 2012
Neocrome
Seditio
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the sed_import function in system/functions.php in Neocrome Seditio build 160 and 161 allow remote attackers to inject arbitrary web script or HTML via the (1) newmsg or (2) rtext parameter. NOTE: some of these details are…
CVE-2012-5913Nov 17, 2012
WordPress
WordPress Integrator
risk 0.04cvss —epss 0.09
Cross-site scripting (XSS) vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter to wp-login.php.
CVE-2012-5912Nov 17, 2012
PicoPublisher
PicoPublisher
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) page.php or (2) single.php.
CVE-2012-5911Nov 17, 2012
B2evolution
B2evolution
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbitrary web script or HTML via the message body.
CVE-2012-5910Nov 17, 2012
B2evolution
B2evolution
risk 0.00cvss —epss 0.01
SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter.
CVE-2012-5909Nov 17, 2012
MyBB
Mybb
risk 0.03cvss —epss 0.01
SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditions[usergroup][] parameter in a search action to admin/index.php.
CVE-2012-5908Nov 17, 2012
MyBB
Mybb
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to inject arbitrary web script or HTML via the conditions[usergroup][] parameter in a search action to admin/index.php.
CVE-2012-5907Nov 17, 2012
Tomatocart
Tomatocart
risk 0.04cvss —epss 0.08
Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter in a "3" action.
CVE-2012-5906Nov 17, 2012
Morequick
Greenbrowser
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in GreenBrowser 6.1.0117 and 6.1.0216 allow remote attackers to inject arbitrary web script or HTML via (1) the URI in an about: page or (2) the last visited URL in the LastVisitWriteEn function in function.js.