CVEs

347,154 total · page 5879 of 6,944

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2012-4498	Drupal Activism	0.00	—	0.02	Nov 2, 2012	The Activism module 6.x-2.x before 6.x-2.1 for Drupal does not properly restrict access to the "Campaign" content type, which might allow remote attackers to bypass access restrictions and possibly have other unspecified impact.
CVE-2012-4497	Drupal Elegant Theme	0.00	—	0.01	Nov 2, 2012	Cross-site scripting (XSS) vulnerability in the "3 slide gallery" in the Elegant Theme module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via a slide URL.
CVE-2012-4493	Drupal Better Revisions	0.00	—	0.01	Nov 2, 2012	Cross-site scripting (XSS) vulnerability in the administrative interface in the Better Revisions module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer better revisions" permission to inject arbitrary web script or HTML via unspecified…
CVE-2012-4487	Drupal Subuser	0.00	—	0.01	Nov 2, 2012	The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created.
CVE-2012-4486	Drupal Subuser	0.00	—	0.01	Nov 2, 2012	Cross-site request forgery (CSRF) vulnerability in the Subuser module before 6.x-1.8 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that switch the user to a subuser via unspecified vectors.
CVE-2012-5417	Cisco Systems, Inc. Prime Data Center Network Manager	0.00	—	0.03	Nov 2, 2012	Cisco Prime Data Center Network Manager (DCNM) before 6.1(1) does not properly restrict access to certain JBoss MainDeployer functionality, which allows remote attackers to execute arbitrary commands via JBoss Application Server Remote Method Invocation (RMI) services, aka Bug…
CVE-2012-5416	Cisco Systems, Inc. Unified Meetingplace	0.00	—	0.02	Nov 2, 2012	Buffer overflow in Cisco Unified MeetingPlace Web Conferencing before 7.1MR1 Patch 1, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 allows remote attackers to cause a denial of service (daemon hang) via unspecified parameters in a POST request, aka Bug ID CSCua66341.
CVE-2012-5705	Justin Dodge Hotblocks	0.00	—	0.01	Nov 1, 2012	Cross-site scripting (XSS) vulnerability in the settings page (admin/settings/hotblocks) in the Hotblocks module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with the "administer hotblocks" permission to inject arbitrary web script or HTML via the "block…
CVE-2012-5704	Justin Dodge Hotblocks	0.00	—	0.01	Nov 1, 2012	The Hotblocks module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with the "administer hotblocks" permission to cause a denial of service (infinite loop and time out) via a block that references itself.
CVE-2012-5687	TP-Link Tl Wr841n	0.08	—	0.69	Nov 1, 2012	Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13.9 build 120201 Rel.54965n and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to the help/ URI.
CVE-2012-5409	Siemens Foundation Sipass Integrated	0.04	—	0.16	Nov 1, 2012	AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data to any memory location and consequently execute arbitrary code via crafted…
CVE-2012-3026	GE Intelligent Platforms Proficy Real-Time Information Portal	0.00	—	0.05	Nov 1, 2012	rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a…
CVE-2012-3021	GE Intelligent Platforms Proficy Real-Time Information Portal	0.00	—	0.05	Nov 1, 2012	rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a…
CVE-2012-3010	GE Intelligent Platforms Proficy Real-Time Information Portal	0.00	—	0.05	Nov 1, 2012	rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a…
CVE-2012-4940	Gecad Technologies Mail Server	0.10	—	0.84	Oct 31, 2012	Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. (dot dot) in (1) the fileName parameter in a download action to source/loggin/page_log_dwn_file.hsp, or the…
CVE-2012-4939	SolarWinds Orion Network Performance Monitor	0.04	—	0.07	Oct 31, 2012	Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field.
CVE-2012-5671	Exim Exim	0.01	—	0.08	Oct 31, 2012	Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_verify," allows remote attackers to execute arbitrary code via…
CVE-2012-4544	Xen Xen	0.00	—	0.00	Oct 31, 2012	The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.
CVE-2012-4532	Joomla Joomla!	0.00	—	0.01	Oct 31, 2012	Cross-site scripting (XSS) vulnerability in modules/mod_languages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php. NOTE: some of these details are…
CVE-2012-4531	Joomla Joomla!	0.00	—	0.02	Oct 31, 2012	Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4500	Drupal Announcements	0.00	—	0.01	Oct 31, 2012	The Announcements module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the "access announcements" permission to bypass node access restrictions and possibly have other unspecified impact.
CVE-2012-4499	Drupal Email Field	0.00	—	0.01	Oct 31, 2012	The contact formatter page in the Email Field module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to email the stored address in the entity via unspecified vectors.
CVE-2012-4496	Drupal Custom Publishing Options	0.00	—	0.01	Oct 31, 2012	Cross-site scripting (XSS) vulnerability in the Custom Publishing Options module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users with the "administer nodes" permission to inject arbitrary web script or HTML via the status labels parameter.
CVE-2012-4495	Drupal Mime Mail	0.00	—	0.01	Oct 31, 2012	The Mime Mail module 6.x-1.x before 6.x-1.1 for Drupal does not properly restrict access to files outside Drupal's publish files directory, which allows remote authenticated users to send arbitrary files as attachments.
CVE-2012-4494	Drupal Shibboleth authentication module	0.00	—	0.01	Oct 31, 2012	The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users, which allows remote blocked users to access bypass intended access restrictions and possibly have other impacts by logging in.
CVE-2012-4492	Drupal Shorten URLs	0.00	—	0.01	Oct 31, 2012	Multiple cross-site scripting (XSS) vulnerabilities in the Shorten URLs module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors to the (1) report…
CVE-2012-4491	Drupal Monthly Archive by Node Type	0.00	—	0.01	Oct 31, 2012	The Monthly Archive by Node Type module 6.x for Drupal does not properly check permissions defined by node_access modules, which allows remote attackers to access restricted nodes via unspecified vectors.
CVE-2012-4490	Ricky Morse Excluded Users	0.00	—	0.01	Oct 31, 2012	Multiple cross-site scripting (XSS) vulnerabilities in the Excluded Users module 6.x-1.x before 6.x-1.1 for Drupal allow remote attackers to inject arbitrary web script or HTML via a (1) user name or (2) email address.
CVE-2012-4489	Drupal Secure Login	0.00	—	0.01	Oct 31, 2012	Open redirect vulnerability in the securelogin_secure_redirect function in the Secure Login module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter.
CVE-2012-4488	Drupal Location	0.00	—	0.01	Oct 31, 2012	The Location module 6.x before 6.x-3.2 and 7.x before 7.x-3.0-alpha1 for Drupal does not properly check user or node access permissions, which allows remote attackers to read node or user results via the location search page.
CVE-2012-4485	Drupal Gallery formatter	0.00	—	0.01	Oct 31, 2012	Multiple cross-site scripting (XSS) vulnerabilities in the galleryformatter_field_formatter_view functiuon in galleryformatter.tpl.php the Gallery formatter module before 7.x-1.2 for Drupal allow remote authenticated users with permissions to create a node or entity to inject…
CVE-2012-4484	Drupal Campaign Monitor	0.00	—	0.01	Oct 31, 2012	Cross-site scripting (XSS) vulnerability in the administrative interface in the Campaign Monitor module before 6.x-2.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this refers to an issue in an independently developed…
CVE-2012-4483	Drupal Commons	0.00	—	0.01	Oct 31, 2012	The commons_discussion_views_default_views function in modules/features/commons_discussion/commons_discussion.views_default.inc in the Drupal Commons module 6.x-2.x before 6.x-2.8 for Drupal does not properly enforce intended node access restrictions, which might allow remote…
CVE-2012-4482	Drupal Ubercart SecureTrading Payment Method	0.00	—	0.01	Oct 31, 2012	The Ubercart SecureTrading Payment Method module 6.x for Drupal does not properly verify payment notification information, which allows remote attackers to purchase an item without paying via unspecified vectors.
CVE-2012-2625	Xen Xen	0.00	—	0.01	Oct 31, 2012	The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service (memory consumption) via a large (1) bzip2 or (2) lzma compressed kernel image.
CVE-2012-5692	Invision Power Services Power Board	0.05	—	0.26	Oct 31, 2012	Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors.
CVE-2012-4934	Tomatocart Tomatocart	0.00	—	0.01	Oct 31, 2012	TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL.
CVE-2012-4610	EMC Corporation Avamar	0.00	—	0.01	Oct 31, 2012	EMC Avamar Client for VMware 6.1 stores the cleartext server root password on the proxy client, which might allow remote attackers to obtain sensitive information by leveraging "network access" to the proxy client.
CVE-2012-4547	AWStats Awstats	0.00	—	0.06	Oct 31, 2012	Unspecified vulnerability in awredir.pl in AWStats before 7.1 has unknown impact and attack vectors.
CVE-2012-0023	VideoLAN VLC media player	0.00	—	0.05	Oct 30, 2012	Double free vulnerability in the get_chunk_header function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TiVo (TY) file.
CVE-2012-4663	Cisco Systems, Inc. Cisco Adaptive Security Appliance	0.00	—	0.02	Oct 29, 2012	The DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.25), 8.4 before 8.4(2.5), and 8.5 before 8.5(1.13) and the Firewall Services…
CVE-2012-4662	Cisco Systems, Inc. Cisco Adaptive Security Appliance	0.00	—	0.02	Oct 29, 2012	The DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.25), 8.4 before 8.4(2.5), and 8.5 before 8.5(1.13) and the Firewall Services…
CVE-2012-4661	Cisco Systems, Inc. Cisco Adaptive Security Appliance	0.00	—	0.04	Oct 29, 2012	Stack-based buffer overflow in the DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.34), 8.4 before 8.4(4.4), 8.5 before 8.5(1.13),…
CVE-2012-4660	Cisco Systems, Inc. Cisco Adaptive Security Appliance	0.00	—	0.02	Oct 29, 2012	The SIP inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.2 before 8.2(5.17), 8.3 before 8.3(2.28), 8.4 before 8.4(2.13), 8.5 before 8.5(1.4), and 8.6…
CVE-2012-4659	Cisco Systems, Inc. Cisco Adaptive Security Appliance	0.00	—	0.03	Oct 29, 2012	The AAA functionality in the IPv4 SSL VPN implementations on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.2 before 8.2(5.30) and 8.3 before 8.3(2.34) allows remote…
CVE-2012-4643	Cisco Systems, Inc. Cisco Adaptive Security Appliance	0.00	—	0.02	Oct 29, 2012	The DHCP server on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 7.0 before 7.2(5.8), 7.1 before 7.2(5.8), 7.2 before 7.2(5.8), 8.0 before 8.0(5.28), 8.1 before 8.1(2.56),…
CVE-2012-4196	Mozilla Corporation Firefox	0.00	—	0.03	Oct 29, 2012	Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy and read the Location object via a prototype property-injection…
CVE-2012-4195	Mozilla Corporation Firefox	0.00	—	0.02	Oct 29, 2012	The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value,…
CVE-2012-4194	Mozilla Corporation Firefox	0.00	—	0.03	Oct 29, 2012	Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 do not prevent use of the valueOf method to shadow the location object (aka window.location), which makes it easier for…
CVE-2012-4447	LibTIFF Libtiff	0.01	—	0.07	Oct 28, 2012	Heap-based buffer overflow in tif_pixarlog.c in LibTIFF before 4.0.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted TIFF image using the PixarLog Compression format.

CVE-2012-4498Nov 2, 2012
Drupal
Activism
risk 0.00cvss —epss 0.02
The Activism module 6.x-2.x before 6.x-2.1 for Drupal does not properly restrict access to the "Campaign" content type, which might allow remote attackers to bypass access restrictions and possibly have other unspecified impact.
CVE-2012-4497Nov 2, 2012
Drupal
Elegant Theme
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the "3 slide gallery" in the Elegant Theme module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via a slide URL.
CVE-2012-4493Nov 2, 2012
Drupal
Better Revisions
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the administrative interface in the Better Revisions module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer better revisions" permission to inject arbitrary web script or HTML via unspecified…
CVE-2012-4487Nov 2, 2012
Drupal
Subuser
risk 0.00cvss —epss 0.01
The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created.
CVE-2012-4486Nov 2, 2012
Drupal
Subuser
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in the Subuser module before 6.x-1.8 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that switch the user to a subuser via unspecified vectors.
CVE-2012-5417Nov 2, 2012
Cisco Systems, Inc.
Prime Data Center Network Manager
risk 0.00cvss —epss 0.03
Cisco Prime Data Center Network Manager (DCNM) before 6.1(1) does not properly restrict access to certain JBoss MainDeployer functionality, which allows remote attackers to execute arbitrary commands via JBoss Application Server Remote Method Invocation (RMI) services, aka Bug…
CVE-2012-5416Nov 2, 2012
Cisco Systems, Inc.
Unified Meetingplace
risk 0.00cvss —epss 0.02
Buffer overflow in Cisco Unified MeetingPlace Web Conferencing before 7.1MR1 Patch 1, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 allows remote attackers to cause a denial of service (daemon hang) via unspecified parameters in a POST request, aka Bug ID CSCua66341.
CVE-2012-5705Nov 1, 2012
Justin Dodge
Hotblocks
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the settings page (admin/settings/hotblocks) in the Hotblocks module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with the "administer hotblocks" permission to inject arbitrary web script or HTML via the "block…
CVE-2012-5704Nov 1, 2012
Justin Dodge
Hotblocks
risk 0.00cvss —epss 0.01
The Hotblocks module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with the "administer hotblocks" permission to cause a denial of service (infinite loop and time out) via a block that references itself.
CVE-2012-5687Nov 1, 2012
TP-Link
Tl Wr841n
risk 0.08cvss —epss 0.69
Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13.9 build 120201 Rel.54965n and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to the help/ URI.
CVE-2012-5409Nov 1, 2012
Siemens Foundation
Sipass Integrated
risk 0.04cvss —epss 0.16
AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data to any memory location and consequently execute arbitrary code via crafted…
CVE-2012-3026Nov 1, 2012
GE Intelligent Platforms
Proficy Real-Time Information Portal
risk 0.00cvss —epss 0.05
rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a…
CVE-2012-3021Nov 1, 2012
GE Intelligent Platforms
Proficy Real-Time Information Portal
risk 0.00cvss —epss 0.05
rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a…
CVE-2012-3010Nov 1, 2012
GE Intelligent Platforms
Proficy Real-Time Information Portal
risk 0.00cvss —epss 0.05
rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a…
CVE-2012-4940Oct 31, 2012
Gecad Technologies
Mail Server
risk 0.10cvss —epss 0.84
Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. (dot dot) in (1) the fileName parameter in a download action to source/loggin/page_log_dwn_file.hsp, or the…
CVE-2012-4939Oct 31, 2012
SolarWinds
Orion Network Performance Monitor
risk 0.04cvss —epss 0.07
Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field.
CVE-2012-5671Oct 31, 2012
Exim
Exim
risk 0.01cvss —epss 0.08
Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_verify," allows remote attackers to execute arbitrary code via…
CVE-2012-4544Oct 31, 2012
Xen
Xen
risk 0.00cvss —epss 0.00
The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.
CVE-2012-4532Oct 31, 2012
Joomla
Joomla!
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in modules/mod_languages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php. NOTE: some of these details are…
CVE-2012-4531Oct 31, 2012
Joomla
Joomla!
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4500Oct 31, 2012
Drupal
Announcements
risk 0.00cvss —epss 0.01
The Announcements module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the "access announcements" permission to bypass node access restrictions and possibly have other unspecified impact.
CVE-2012-4499Oct 31, 2012
Drupal
Email Field
risk 0.00cvss —epss 0.01
The contact formatter page in the Email Field module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to email the stored address in the entity via unspecified vectors.
CVE-2012-4496Oct 31, 2012
Drupal
Custom Publishing Options
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Custom Publishing Options module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users with the "administer nodes" permission to inject arbitrary web script or HTML via the status labels parameter.
CVE-2012-4495Oct 31, 2012
Drupal
Mime Mail
risk 0.00cvss —epss 0.01
The Mime Mail module 6.x-1.x before 6.x-1.1 for Drupal does not properly restrict access to files outside Drupal's publish files directory, which allows remote authenticated users to send arbitrary files as attachments.
CVE-2012-4494Oct 31, 2012
Drupal
Shibboleth authentication module
risk 0.00cvss —epss 0.01
The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users, which allows remote blocked users to access bypass intended access restrictions and possibly have other impacts by logging in.
CVE-2012-4492Oct 31, 2012
Drupal
Shorten URLs
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the Shorten URLs module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors to the (1) report…
CVE-2012-4491Oct 31, 2012
Drupal
Monthly Archive by Node Type
risk 0.00cvss —epss 0.01
The Monthly Archive by Node Type module 6.x for Drupal does not properly check permissions defined by node_access modules, which allows remote attackers to access restricted nodes via unspecified vectors.
CVE-2012-4490Oct 31, 2012
Ricky Morse
Excluded Users
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the Excluded Users module 6.x-1.x before 6.x-1.1 for Drupal allow remote attackers to inject arbitrary web script or HTML via a (1) user name or (2) email address.
CVE-2012-4489Oct 31, 2012
Drupal
Secure Login
risk 0.00cvss —epss 0.01
Open redirect vulnerability in the securelogin_secure_redirect function in the Secure Login module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter.
CVE-2012-4488Oct 31, 2012
Drupal
Location
risk 0.00cvss —epss 0.01
The Location module 6.x before 6.x-3.2 and 7.x before 7.x-3.0-alpha1 for Drupal does not properly check user or node access permissions, which allows remote attackers to read node or user results via the location search page.
CVE-2012-4485Oct 31, 2012
Drupal
Gallery formatter
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the galleryformatter_field_formatter_view functiuon in galleryformatter.tpl.php the Gallery formatter module before 7.x-1.2 for Drupal allow remote authenticated users with permissions to create a node or entity to inject…
CVE-2012-4484Oct 31, 2012
Drupal
Campaign Monitor
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the administrative interface in the Campaign Monitor module before 6.x-2.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this refers to an issue in an independently developed…
CVE-2012-4483Oct 31, 2012
Drupal
Commons
risk 0.00cvss —epss 0.01
The commons_discussion_views_default_views function in modules/features/commons_discussion/commons_discussion.views_default.inc in the Drupal Commons module 6.x-2.x before 6.x-2.8 for Drupal does not properly enforce intended node access restrictions, which might allow remote…
CVE-2012-4482Oct 31, 2012
Drupal
Ubercart SecureTrading Payment Method
risk 0.00cvss —epss 0.01
The Ubercart SecureTrading Payment Method module 6.x for Drupal does not properly verify payment notification information, which allows remote attackers to purchase an item without paying via unspecified vectors.
CVE-2012-2625Oct 31, 2012
Xen
Xen
risk 0.00cvss —epss 0.01
The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service (memory consumption) via a large (1) bzip2 or (2) lzma compressed kernel image.
CVE-2012-5692Oct 31, 2012
Invision Power Services
Power Board
risk 0.05cvss —epss 0.26
Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors.
CVE-2012-4934Oct 31, 2012
Tomatocart
Tomatocart
risk 0.00cvss —epss 0.01
TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL.
CVE-2012-4610Oct 31, 2012
EMC Corporation
Avamar
risk 0.00cvss —epss 0.01
EMC Avamar Client for VMware 6.1 stores the cleartext server root password on the proxy client, which might allow remote attackers to obtain sensitive information by leveraging "network access" to the proxy client.
CVE-2012-4547Oct 31, 2012
AWStats
Awstats
risk 0.00cvss —epss 0.06
Unspecified vulnerability in awredir.pl in AWStats before 7.1 has unknown impact and attack vectors.
CVE-2012-0023Oct 30, 2012
VideoLAN
VLC media player
risk 0.00cvss —epss 0.05
Double free vulnerability in the get_chunk_header function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TiVo (TY) file.
CVE-2012-4663Oct 29, 2012
Cisco Systems, Inc.
Cisco Adaptive Security Appliance
risk 0.00cvss —epss 0.02
The DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.25), 8.4 before 8.4(2.5), and 8.5 before 8.5(1.13) and the Firewall Services…
CVE-2012-4662Oct 29, 2012
Cisco Systems, Inc.
Cisco Adaptive Security Appliance
risk 0.00cvss —epss 0.02
The DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.25), 8.4 before 8.4(2.5), and 8.5 before 8.5(1.13) and the Firewall Services…
CVE-2012-4661Oct 29, 2012
Cisco Systems, Inc.
Cisco Adaptive Security Appliance
risk 0.00cvss —epss 0.04
Stack-based buffer overflow in the DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.34), 8.4 before 8.4(4.4), 8.5 before 8.5(1.13),…
CVE-2012-4660Oct 29, 2012
Cisco Systems, Inc.
Cisco Adaptive Security Appliance
risk 0.00cvss —epss 0.02
The SIP inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.2 before 8.2(5.17), 8.3 before 8.3(2.28), 8.4 before 8.4(2.13), 8.5 before 8.5(1.4), and 8.6…
CVE-2012-4659Oct 29, 2012
Cisco Systems, Inc.
Cisco Adaptive Security Appliance
risk 0.00cvss —epss 0.03
The AAA functionality in the IPv4 SSL VPN implementations on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.2 before 8.2(5.30) and 8.3 before 8.3(2.34) allows remote…
CVE-2012-4643Oct 29, 2012
Cisco Systems, Inc.
Cisco Adaptive Security Appliance
risk 0.00cvss —epss 0.02
The DHCP server on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 7.0 before 7.2(5.8), 7.1 before 7.2(5.8), 7.2 before 7.2(5.8), 8.0 before 8.0(5.28), 8.1 before 8.1(2.56),…
CVE-2012-4196Oct 29, 2012
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.03
Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy and read the Location object via a prototype property-injection…
CVE-2012-4195Oct 29, 2012
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.02
The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value,…
CVE-2012-4194Oct 29, 2012
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.03
Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 do not prevent use of the valueOf method to shadow the location object (aka window.location), which makes it easier for…
CVE-2012-4447Oct 28, 2012
LibTIFF
Libtiff
risk 0.01cvss —epss 0.07
Heap-based buffer overflow in tif_pixarlog.c in LibTIFF before 4.0.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted TIFF image using the PixarLog Compression format.