CVEs

347,154 total · page 5880 of 6,944

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2012-5470	VideoLAN VLC media player	0.03	—	0.06	Oct 26, 2012	libpng_plugin in VideoLAN VLC media player 2.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted PNG file.
CVE-2012-4729	Wftpserver Wing FTP Server	0.00	—	0.02	Oct 26, 2012	Wing FTP Server before 4.1.1 allows remote authenticated users to cause a denial of service (daemon crash) via two zip commands.
CVE-2012-4501	Apache Cloudstack	0.01	—	0.08	Oct 26, 2012	Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
CVE-2012-4019	—	0.00	—	0.02	Oct 26, 2012	Cross-site scripting (XSS) vulnerability in tokyo_bbs.cgi in Come on Girls Interface (CGI) Tokyo BBS allows remote attackers to inject arbitrary web script or HTML via vectors related to the error page.
CVE-2011-5235	Mnogosearch Mnogosearch	0.00	—	0.02	Oct 25, 2012	SQL injection vulnerability in mnoGoSearch before 3.3.12 allows remote attackers to execute arbitrary SQL commands via the hostname in a hypertext link.
CVE-2011-5234	Scripte24shop Social Network Community	0.00	—	0.02	Oct 25, 2012	SQL injection vulnerability in user.php in Social Network Community 2 allows remote attackers to execute arbitrary SQL commands via the userId parameter.
CVE-2011-5233	IrfanView Irfanview	0.04	—	0.09	Oct 25, 2012	Heap-based buffer overflow in IrfanView before 4.32 allows remote attackers to execute arbitrary code via crafted "Rows Per Strip" and "Samples Per Pixel" values in a TIFF image file.
CVE-2011-5230	Seotoaster Seotoaster	0.03	—	0.02	Oct 25, 2012	Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/LoginModel.php in Seotoaster 1.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to sys/login/index or (2)…
CVE-2011-5229	Apprain Apprain	0.03	—	0.02	Oct 25, 2012	SQL injection vulnerability in quickstart/profile/index.php in the Forum module in appRain CMF 0.1.5 allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.
CVE-2011-5228	Apprain Apprain	0.03	—	0.04	Oct 25, 2012	Cross-site scripting (XSS) vulnerability in the Search module (quickstart/search) in appRain CMF 0.1.5 allows remote attackers to inject arbitrary web script or HTML via the ss parameter.
CVE-2011-5227	Enterasys Network Management Suite	0.09	—	0.77	Oct 25, 2012	Stack-based buffer overflow in the Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 allows remote attackers to execute arbitrary code via a long PRIO field in a message to UDP port 514.
CVE-2011-5226	WordPress Sentinel	0.00	—	0.01	Oct 25, 2012	Cross-site request forgery (CSRF) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to hijack the authentication of an administrator for requests that trigger snapshots.
CVE-2011-5225	WordPress Sentinel	0.00	—	0.02	Oct 25, 2012	Cross-site scripting (XSS) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVE-2011-5224	WordPress Sentinel	0.00	—	0.03	Oct 25, 2012	SQL injection vulnerability in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2011-5223	Cacti (software) Cacti	0.00	—	0.02	Oct 25, 2012	Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti before 0.8.7i allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2011-5222	Scripte24shop PHP Flirt Projekt	0.03	—	0.02	Oct 25, 2012	SQL injection vulnerability in rub2_w.php in PHP Flirt-Projekt 4.8 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the rub parameter.
CVE-2011-5221	Websvn Websvn	0.00	—	0.02	Oct 25, 2012	Cross-site scripting (XSS) vulnerability in the getLog function in svnlook.php in WebSVN before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to (1) comp.php, (2) diff.php, or (3) revision.php.
CVE-2011-5220	PHP SCMS PHP-SCMS	0.00	—	0.02	Oct 25, 2012	Cross-site scripting (XSS) vulnerability in templates/default/Admin/Login.html in PHP-SCMS 1.6.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter to index.php.
CVE-2011-5219	Mpdf Mpdf	0.04	—	0.09	Oct 25, 2012	Directory traversal vulnerability in examples/show_code.php in mPDF 5.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVE-2011-5218	Neubivljiv Dota Openstats	0.03	—	0.02	Oct 25, 2012	SQL injection vulnerability in DotA OpenStats 1.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVE-2011-5217	Hitachi Jp1\/serverconductor\/deploymentmanager	0.00	—	0.03	Oct 25, 2012	Directory traversal vulnerability in the PXE Mtftp service in Hitachi JP1/ServerConductor/DeploymentManager before 08-55 Japanese and before 08-51 English allows remote attackers to read arbitrary files via unknown vectors.
CVE-2011-5216	WordPress WordPress	0.00	—	0.02	Oct 25, 2012	SQL injection vulnerability in ajax.php in SCORM Cloud For WordPress plugin before 1.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the active parameter. NOTE: some of these details are obtained from third party information.
CVE-2011-5215	2daybiz Video Community Portal Script	0.00	—	0.02	Oct 25, 2012	SQL injection vulnerability in index.php in Video Community Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2011-5214	Browsercrm Browsercrm	0.03	—	0.05	Oct 25, 2012	Multiple cross-site scripting (XSS) vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) modules/admin/admin_module_index.php, or (3) modules/calendar/customise_calendar_times.php;…
CVE-2011-5213	Browsercrm Browsercrm	0.03	—	0.02	Oct 25, 2012	Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login[username] parameter to index.php, (2) parent_id parameter to modules/Documents/version_list.php, or (3) contact_id parameter to…
CVE-2012-3941	Cisco Systems, Inc. Webex Recording Format Player	0.00	—	0.05	Oct 25, 2012	Heap-based buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72850.
CVE-2012-3940	Cisco Systems, Inc. Webex Recording Format Player	0.00	—	0.05	Oct 25, 2012	Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72958.
CVE-2012-3939	Cisco Systems, Inc. Webex Recording Format Player	0.00	—	0.05	Oct 25, 2012	Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted WRF file, aka Bug ID CSCua61331.
CVE-2012-3938	Cisco Systems, Inc. Webex Recording Format Player	0.00	—	0.05	Oct 25, 2012	Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz73583.
CVE-2012-3937	Cisco Systems, Inc. Webex Recording Format Player	0.00	—	0.05	Oct 25, 2012	Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72967.
CVE-2012-3936	Cisco Systems, Inc. Webex Recording Format Player	0.00	—	0.05	Oct 25, 2012	Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCua40962.
CVE-2012-5672	Microsoft Office	0.04	—	0.13	Oct 25, 2012	Microsoft Excel Viewer (aka Xlview.exe) and Excel in Microsoft Office 2007 (aka Office 12) allow remote attackers to cause a denial of service (read access violation and application crash) via a crafted spreadsheet file, as demonstrated by a .xls file with battery voltage data.
CVE-2012-5368	PhpMyAdmin phpMyAdmin	0.00	—	0.01	Oct 25, 2012	phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
CVE-2012-5339	PhpMyAdmin phpMyAdmin	0.00	—	0.01	Oct 25, 2012	Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger.
CVE-2012-3506	Apache Ofbiz	0.01	—	0.07	Oct 25, 2012	Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.
CVE-2012-5456	Zoner Zoner Antivirus Free	0.00	—	0.01	Oct 24, 2012	The Zoner AntiVirus Free application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, as…
CVE-2012-5388	WordPress White Label CMS	0.03	—	0.04	Oct 24, 2012	Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a…
CVE-2012-5387	WordPress White Label CMS	0.03	—	0.03	Oct 24, 2012	Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms_o_developer_name…
CVE-2012-5302	TIBCO Software Formvine	0.00	—	0.02	Oct 24, 2012	The server in TIBCO Formvine 3.1.x and 3.2.x before 3.2.1 does not properly implement access control, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
CVE-2012-5273	Adobe Inc. Shockwave Player	0.01	—	0.09	Oct 23, 2012	Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4173, CVE-2012-4174, and CVE-2012-4175.
CVE-2012-4176	Adobe Inc. Shockwave Player	0.01	—	0.07	Oct 23, 2012	Array index error in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2012-4175	Adobe Inc. Shockwave Player	0.01	—	0.10	Oct 23, 2012	Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4173, CVE-2012-4174, and CVE-2012-5273.
CVE-2012-4174	Adobe Inc. Shockwave Player	0.01	—	0.10	Oct 23, 2012	Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4173, CVE-2012-4175, and CVE-2012-5273.
CVE-2012-4173	Adobe Inc. Shockwave Player	0.01	—	0.10	Oct 23, 2012	Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4174, CVE-2012-4175, and CVE-2012-5273.
CVE-2012-4172	Adobe Inc. Shockwave Player	0.01	—	0.10	Oct 23, 2012	Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4173, CVE-2012-4174, CVE-2012-4175, and CVE-2012-5273.
CVE-2012-5455	Joomla Joomla!	0.00	—	0.02	Oct 22, 2012	Cross-site scripting (XSS) vulnerability in the language search component in Joomla! before 3.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "typographical error."
CVE-2012-5454	Atutor Acontent	0.00	—	0.02	Oct 22, 2012	user/index_inline_editor_submit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary user passwords via a crafted request. NOTE: this might be due to an incomplete fix for CVE-2012-5168.
CVE-2012-5453	Atutor Acontent	0.03	—	0.03	Oct 22, 2012	SQL injection vulnerability in user/index_inline_editor_submit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167.
CVE-2012-5452	Subrion CMS	0.03	—	0.05	Oct 22, 2012	Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) multi_title parameter to blocks/add/; (2) cost, (3) days, or (4) title[en] parameter to plans/add/; (5) name or (6) title[en]…
CVE-2012-5169	Atutor Acontent	0.00	—	0.02	Oct 22, 2012	Multiple cross-site scripting (XSS) vulnerabilities in file_manager/preview_top.php in ATutor AContent before 1.2-2 allow remote attackers to inject arbitrary web script or HTML via the (1) pathext, (2) popup, (3) framed, or (4) file parameter.

CVE-2012-5470Oct 26, 2012
VideoLAN
VLC media player
risk 0.03cvss —epss 0.06
libpng_plugin in VideoLAN VLC media player 2.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted PNG file.
CVE-2012-4729Oct 26, 2012
Wftpserver
Wing FTP Server
risk 0.00cvss —epss 0.02
Wing FTP Server before 4.1.1 allows remote authenticated users to cause a denial of service (daemon crash) via two zip commands.
CVE-2012-4501Oct 26, 2012
Apache
Cloudstack
risk 0.01cvss —epss 0.08
Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
CVE-2012-4019Oct 26, 2012
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in tokyo_bbs.cgi in Come on Girls Interface (CGI) Tokyo BBS allows remote attackers to inject arbitrary web script or HTML via vectors related to the error page.
CVE-2011-5235Oct 25, 2012
Mnogosearch
Mnogosearch
risk 0.00cvss —epss 0.02
SQL injection vulnerability in mnoGoSearch before 3.3.12 allows remote attackers to execute arbitrary SQL commands via the hostname in a hypertext link.
CVE-2011-5234Oct 25, 2012
Scripte24shop
Social Network Community
risk 0.00cvss —epss 0.02
SQL injection vulnerability in user.php in Social Network Community 2 allows remote attackers to execute arbitrary SQL commands via the userId parameter.
CVE-2011-5233Oct 25, 2012
IrfanView
Irfanview
risk 0.04cvss —epss 0.09
Heap-based buffer overflow in IrfanView before 4.32 allows remote attackers to execute arbitrary code via crafted "Rows Per Strip" and "Samples Per Pixel" values in a TIFF image file.
CVE-2011-5230Oct 25, 2012
Seotoaster
Seotoaster
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/LoginModel.php in Seotoaster 1.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to sys/login/index or (2)…
CVE-2011-5229Oct 25, 2012
Apprain
Apprain
risk 0.03cvss —epss 0.02
SQL injection vulnerability in quickstart/profile/index.php in the Forum module in appRain CMF 0.1.5 allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.
CVE-2011-5228Oct 25, 2012
Apprain
Apprain
risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in the Search module (quickstart/search) in appRain CMF 0.1.5 allows remote attackers to inject arbitrary web script or HTML via the ss parameter.
CVE-2011-5227Oct 25, 2012
Enterasys
Network Management Suite
risk 0.09cvss —epss 0.77
Stack-based buffer overflow in the Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 allows remote attackers to execute arbitrary code via a long PRIO field in a message to UDP port 514.
CVE-2011-5226Oct 25, 2012
WordPress
Sentinel
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to hijack the authentication of an administrator for requests that trigger snapshots.
CVE-2011-5225Oct 25, 2012
WordPress
Sentinel
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVE-2011-5224Oct 25, 2012
WordPress
Sentinel
risk 0.00cvss —epss 0.03
SQL injection vulnerability in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2011-5223Oct 25, 2012
Cacti (software)
Cacti
risk 0.00cvss —epss 0.02
Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti before 0.8.7i allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2011-5222Oct 25, 2012
Scripte24shop
PHP Flirt Projekt
risk 0.03cvss —epss 0.02
SQL injection vulnerability in rub2_w.php in PHP Flirt-Projekt 4.8 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the rub parameter.
CVE-2011-5221Oct 25, 2012
Websvn
Websvn
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the getLog function in svnlook.php in WebSVN before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to (1) comp.php, (2) diff.php, or (3) revision.php.
CVE-2011-5220Oct 25, 2012
PHP SCMS
PHP-SCMS
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in templates/default/Admin/Login.html in PHP-SCMS 1.6.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter to index.php.
CVE-2011-5219Oct 25, 2012
Mpdf
Mpdf
risk 0.04cvss —epss 0.09
Directory traversal vulnerability in examples/show_code.php in mPDF 5.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVE-2011-5218Oct 25, 2012
Neubivljiv
Dota Openstats
risk 0.03cvss —epss 0.02
SQL injection vulnerability in DotA OpenStats 1.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVE-2011-5217Oct 25, 2012
Hitachi
Jp1\/serverconductor\/deploymentmanager
risk 0.00cvss —epss 0.03
Directory traversal vulnerability in the PXE Mtftp service in Hitachi JP1/ServerConductor/DeploymentManager before 08-55 Japanese and before 08-51 English allows remote attackers to read arbitrary files via unknown vectors.
CVE-2011-5216Oct 25, 2012
WordPress
WordPress
risk 0.00cvss —epss 0.02
SQL injection vulnerability in ajax.php in SCORM Cloud For WordPress plugin before 1.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the active parameter. NOTE: some of these details are obtained from third party information.
CVE-2011-5215Oct 25, 2012
2daybiz
Video Community Portal Script
risk 0.00cvss —epss 0.02
SQL injection vulnerability in index.php in Video Community Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2011-5214Oct 25, 2012
Browsercrm
Browsercrm
risk 0.03cvss —epss 0.05
Multiple cross-site scripting (XSS) vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) modules/admin/admin_module_index.php, or (3) modules/calendar/customise_calendar_times.php;…
CVE-2011-5213Oct 25, 2012
Browsercrm
Browsercrm
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login[username] parameter to index.php, (2) parent_id parameter to modules/Documents/version_list.php, or (3) contact_id parameter to…
CVE-2012-3941Oct 25, 2012
Cisco Systems, Inc.
Webex Recording Format Player
risk 0.00cvss —epss 0.05
Heap-based buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72850.
CVE-2012-3940Oct 25, 2012
Cisco Systems, Inc.
Webex Recording Format Player
risk 0.00cvss —epss 0.05
Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72958.
CVE-2012-3939Oct 25, 2012
Cisco Systems, Inc.
Webex Recording Format Player
risk 0.00cvss —epss 0.05
Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted WRF file, aka Bug ID CSCua61331.
CVE-2012-3938Oct 25, 2012
Cisco Systems, Inc.
Webex Recording Format Player
risk 0.00cvss —epss 0.05
Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz73583.
CVE-2012-3937Oct 25, 2012
Cisco Systems, Inc.
Webex Recording Format Player
risk 0.00cvss —epss 0.05
Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72967.
CVE-2012-3936Oct 25, 2012
Cisco Systems, Inc.
Webex Recording Format Player
risk 0.00cvss —epss 0.05
Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCua40962.
CVE-2012-5672Oct 25, 2012
Microsoft
Office
risk 0.04cvss —epss 0.13
Microsoft Excel Viewer (aka Xlview.exe) and Excel in Microsoft Office 2007 (aka Office 12) allow remote attackers to cause a denial of service (read access violation and application crash) via a crafted spreadsheet file, as demonstrated by a .xls file with battery voltage data.
CVE-2012-5368Oct 25, 2012
PhpMyAdmin
phpMyAdmin
risk 0.00cvss —epss 0.01
phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
CVE-2012-5339Oct 25, 2012
PhpMyAdmin
phpMyAdmin
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger.
CVE-2012-3506Oct 25, 2012
Apache
Ofbiz
risk 0.01cvss —epss 0.07
Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.
CVE-2012-5456Oct 24, 2012
Zoner
Zoner Antivirus Free
risk 0.00cvss —epss 0.01
The Zoner AntiVirus Free application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, as…
CVE-2012-5388Oct 24, 2012
WordPress
White Label CMS
risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a…
CVE-2012-5387Oct 24, 2012
WordPress
White Label CMS
risk 0.03cvss —epss 0.03
Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms_o_developer_name…
CVE-2012-5302Oct 24, 2012
TIBCO Software
Formvine
risk 0.00cvss —epss 0.02
The server in TIBCO Formvine 3.1.x and 3.2.x before 3.2.1 does not properly implement access control, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
CVE-2012-5273Oct 23, 2012
Adobe Inc.
Shockwave Player
risk 0.01cvss —epss 0.09
Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4173, CVE-2012-4174, and CVE-2012-4175.
CVE-2012-4176Oct 23, 2012
Adobe Inc.
Shockwave Player
risk 0.01cvss —epss 0.07
Array index error in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2012-4175Oct 23, 2012
Adobe Inc.
Shockwave Player
risk 0.01cvss —epss 0.10
Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4173, CVE-2012-4174, and CVE-2012-5273.
CVE-2012-4174Oct 23, 2012
Adobe Inc.
Shockwave Player
risk 0.01cvss —epss 0.10
Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4173, CVE-2012-4175, and CVE-2012-5273.
CVE-2012-4173Oct 23, 2012
Adobe Inc.
Shockwave Player
risk 0.01cvss —epss 0.10
Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4174, CVE-2012-4175, and CVE-2012-5273.
CVE-2012-4172Oct 23, 2012
Adobe Inc.
Shockwave Player
risk 0.01cvss —epss 0.10
Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4173, CVE-2012-4174, CVE-2012-4175, and CVE-2012-5273.
CVE-2012-5455Oct 22, 2012
Joomla
Joomla!
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the language search component in Joomla! before 3.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "typographical error."
CVE-2012-5454Oct 22, 2012
Atutor
Acontent
risk 0.00cvss —epss 0.02
user/index_inline_editor_submit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary user passwords via a crafted request. NOTE: this might be due to an incomplete fix for CVE-2012-5168.
CVE-2012-5453Oct 22, 2012
Atutor
Acontent
risk 0.03cvss —epss 0.03
SQL injection vulnerability in user/index_inline_editor_submit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167.
CVE-2012-5452Oct 22, 2012
Subrion
CMS
risk 0.03cvss —epss 0.05
Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) multi_title parameter to blocks/add/; (2) cost, (3) days, or (4) title[en] parameter to plans/add/; (5) name or (6) title[en]…
CVE-2012-5169Oct 22, 2012
Atutor
Acontent
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in file_manager/preview_top.php in ATutor AContent before 1.2-2 allow remote attackers to inject arbitrary web script or HTML via the (1) pathext, (2) popup, (3) framed, or (4) file parameter.