CVEs

347,108 total · page 5887 of 6,943

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2010-5278	Modx Revolution	0.04	—	0.17	Oct 7, 2012	Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter. NOTE: some of…
CVE-2010-5277	Drupal Views Bulk Operations	0.00	—	0.01	Oct 7, 2012	Unspecified vulnerability in the Views Bulk Operations module 6 before 6.x-1.10 for Drupal allows remote authenticated users with user management permissions to bypass intended access restrictions and delete anonymous users (user 0) via unspecified vectors.
CVE-2010-5276	Drupal Memcache	0.00	—	0.01	Oct 7, 2012	The Memcache module 5.x before 5.x-1.10 and 6.x before 6.x-1.6 for Drupal does not properly handle the $user object in memcache_admin, which might "lead to a role change not being recognized until the user logs in again."
CVE-2010-5275	Drupal Memcache	0.00	—	0.01	Oct 7, 2012	Cross-site scripting (XSS) vulnerability in memcache_admin in the Memcache module 5.x before 5.x-1.10 and 6.x before 6.x-1.6 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-3918	Google Android	0.03	—	0.01	Oct 7, 2012	The Zygote process in Android 4.0.3 and earlier accepts fork requests from processes with arbitrary UIDs, which allows remote attackers to cause a denial of service (reboot loop) via a crafted application.
CVE-2012-5306	Dlink Camera Stream Client ActiveX Control	0.04	—	0.12	Oct 6, 2012	Stack-based buffer overflow in the SelectDirectory method in DcsCliCtrl.dll in Camera Stream Client ActiveX Control, as used in D-Link DCS-5605 PTZ IP Network Camera, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long…
CVE-2012-5305	Directadmin Directadmin	0.00	—	0.01	Oct 6, 2012	Cross-site scripting (XSS) vulnerability in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allows remote attackers to inject arbitrary web script or HTML via the domain parameter.
CVE-2012-5304	YVS Image Gallery	0.00	—	0.01	Oct 6, 2012	Static code injection vulnerability in administration/install.php in YVS Image Gallery allows remote attackers to inject arbitrary PHP code into functions/db_connect.php via unspecified vectors. NOTE: this is only a vulnerability when the administrator does not follow…
CVE-2012-1618	PostgreSQL PostgreSQL	0.00	—	0.03	Oct 6, 2012	Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows…
CVE-2012-1634	Drupal Video Filter	0.00	—	0.01	Oct 6, 2012	Cross-site scripting (XSS) vulnerability in video_filter.codecs.inc in the Video Filter module 6.x-2.x and 7.x-2.x for Drupal allows remote attackers to inject arbitrary web script or HTML via the EMBEDLOOKUP parameter for Blip.tv links.
CVE-2012-1624	Lingotek Lingotek	0.00	—	0.01	Oct 6, 2012	Multiple cross-site scripting (XSS) vulnerabilities in the Lingotek module 6.x-1.x before 6.x-1.40 for Drupal allow remote authenticated users to inject arbitrary web script or HTML when (1) creating or (2) editing page content.
CVE-2012-1623	Drupal Registration codes	0.00	—	0.01	Oct 6, 2012	The Registration Codes module before 6.x-2.4 for Drupal does not restrict access to the registration code list, which might allow remote attackers to bypass intended registration restrictions.
CVE-2012-1565	Ez Ez Publish	0.00	—	0.02	Oct 6, 2012	Unspecified vulnerability in ez Publish 4.1.4, 4.2, 4.3, 4.4, 4.5, and 4.6 has unknown impact and attack vectors related to an insecure direct object reference.
CVE-2012-1564	YVS Image Gallery	0.00	—	0.01	Oct 6, 2012	Cross-site scripting (XSS) vulnerability in administration/create_album.php in YVS Image Gallery allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1153	Apprain Apprain	0.06	—	0.32	Oct 6, 2012	Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads…
CVE-2012-0987	Impresscms Impresscms	0.00	—	0.02	Oct 6, 2012	Directory traversal vulnerability in edituser.php in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the icmsConfigPlugins[sanitizer_plugins][] parameter.
CVE-2012-0986	Impresscms Impresscms	0.00	—	0.02	Oct 6, 2012	Multiple cross-site scripting (XSS) vulnerabilities in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) notifications.php, (2) modules/system/admin/images/browser.php, and (3)…
CVE-2012-0065	usbmuxd usbmuxd	0.00	—	0.01	Oct 6, 2012	Heap-based buffer overflow in the receive_packet function in libusbmuxd/libusbmuxd.c in usbmuxd 1.0.5 through 1.0.7 allows physically proximate attackers to execute arbitrary code via a long SerialNumber field in a property list.
CVE-2011-4932	Impresspages Impresspages CMS	0.00	—	0.04	Oct 6, 2012	Eval injection vulnerability in ip_cms/modules/standard/content_management/actions.php in ImpressPages CMS 1.0.12 and possibly other versons before 1.0.13 allows remote attackers to execute arbitrary code via the cm_group parameter.
CVE-2012-5303	Mw Wp Form Project Monkey	0.00	—	0.00	Oct 5, 2012	Monkey HTTP Daemon 0.9.3 might allow local users to overwrite arbitrary files via a symlink attack on a PID file, as demonstrated by a pathname different from the default /var/run/monkey.pid pathname.
CVE-2012-4442	Mw Wp Form Project Monkey	0.00	—	0.00	Oct 5, 2012	Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effective UID, which might allow local users to bypass intended file-read restrictions by leveraging a race condition in a file-permission check.
CVE-2012-1150	Python (programming language) Python	0.00	—	0.05	Oct 5, 2012	Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted…
CVE-2012-0845	Python (programming language) Python	0.00	—	0.05	Oct 5, 2012	SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of…
CVE-2012-5051	VMware Capacityiq	0.00	—	0.03	Oct 5, 2012	Directory traversal vulnerability in VMware CapacityIQ 1.5.x allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2012-5050	VMware Vcenter Operations	0.00	—	0.02	Oct 5, 2012	Cross-site scripting (XSS) vulnerability in the server in VMware vCenter Operations (aka vCOps) before 5.0.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4897	VMware Movie Decoder	0.00	—	0.00	Oct 5, 2012	Untrusted search path vulnerability in the installer in VMware Movie Decoder before 9.0 allows local users to gain privileges via a Trojan horse executable file in the installer directory.
CVE-2012-4443	Mw Wp Form Project Monkey	0.00	—	0.00	Oct 5, 2012	Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access.
CVE-2012-4896	Sumatrapdfreader Sumatrapdf	0.00	—	0.05	Oct 5, 2012	Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2012-4895.
CVE-2012-4895	Sumatrapdfreader Sumatrapdf	0.00	—	0.05	Oct 5, 2012	Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2012-4896.
CVE-2012-4894	Google Sketchup	0.00	—	0.05	Oct 5, 2012	Google SketchUp before 8.0.14346 (aka 8 Maintenance 3) allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted SKP file.
CVE-2012-4018	Final Beta Laboratory MyWebSearch	0.00	—	0.01	Oct 5, 2012	Cross-site scripting (XSS) vulnerability in Final Beta Laboratory MyWebSearch before 1.23 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.
CVE-2012-5301	Cerberus FTP Server	0.00	—	0.01	Oct 4, 2012	The default configuration of Cerberus FTP Server before 5.0.4.0 supports the DES cipher for SSH sessions, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and performing a brute-force attack on the encrypted data.
CVE-2012-5240	Wireshark Wireshark	0.00	—	0.01	Oct 4, 2012	Buffer overflow in the dissect_tlv function in epan/dissectors/packet-ldp.c in the LDP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malformed packet.
CVE-2012-5238	Wireshark Wireshark	0.00	—	0.01	Oct 4, 2012	epan/dissectors/packet-ppp.c in the PPP dissector in Wireshark 1.8.x before 1.8.3 uses incorrect OUI data structures during the decoding of (1) PPP and (2) LCP data, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a…
CVE-2012-5237	Wireshark Wireshark	0.00	—	0.01	Oct 4, 2012	The dissect_hsrp function in epan/dissectors/packet-hsrp.c in the HSRP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
CVE-2012-2999	Cerberus FTP Server	0.00	—	0.01	Oct 4, 2012	Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in Cerberus FTP Server before 5.0.5.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user account or (2) reconfigure the state of the FTP service,…
CVE-2012-5300	Mystorexpress Tienda Virtual	0.00	—	0.01	Oct 4, 2012	SQL injection vulnerability in art_catalogo.php in MyStore Xpress Tienda Virtual 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2012-5299	Mavili Guestbook Project Mavili Guestbook	0.00	—	0.02	Oct 4, 2012	Mavili Guestbook, as released in November 2007, allows remote attackers to edit, delete, and approve arbitrary messages via a direct request to (1) edit.asp, (2) delete.asp, or (3) approve.asp.
CVE-2012-5298	Mavili Guestbook Project Mavili Guestbook	0.00	—	0.01	Oct 4, 2012	Mavili Guestbook, as released in November 2007, stores guestbook.mdb under the web root with insufficient access control, which allows remote attackers to read the database via a direct request.
CVE-2012-5297	Mavili Guestbook Project Mavili Guestbook	0.00	—	0.01	Oct 4, 2012	SQL injection vulnerability in edit.asp in Mavili Guestbook, as released in November 2007, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2012-5296	Mavili Guestbook Project Mavili Guestbook	0.00	—	0.01	Oct 4, 2012	Multiple cross-site scripting (XSS) vulnerabilities in Mavili Guestbook, as released in November 2007, allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) approve.asp, (2) delete.asp, (3) edit.asp, or (4) edit2.asp.
CVE-2012-5295	Fusetalk. Fusetalk	0.03	—	0.02	Oct 4, 2012	Cross-site scripting (XSS) vulnerability in login.cfm in FuseTalk Forums 3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the windowed parameter.
CVE-2012-5294	Mystorexpress Tienda Virtual	0.03	—	0.01	Oct 4, 2012	SQL injection vulnerability in art_detalle.php in MyStore Xpress Tienda Virtual allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2011-5207	Thecartpress Thecartpress	0.00	—	0.05	Oct 4, 2012	Cross-site scripting (XSS) vulnerability in admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31 allows remote attackers to inject arbitrary web script or HTML via the tcp_name_post_XXXXX parameter.
CVE-2011-5206	Rapidleech Rapidleech	0.00	—	0.01	Oct 4, 2012	Cross-site scripting (XSS) vulnerability in notes.php in Rapidleech before 2.3 rev42 SVN r399 allows remote attackers to inject arbitrary web script or HTML via the notes parameter.
CVE-2011-5205	Rapidleech Rapidleech	0.00	—	0.01	Oct 4, 2012	Cross-site scripting (XSS) vulnerability in audl.php in Rapidleech 2.3 rev42 SVN r358, rev43 SVN r397, and earlier allows remote attackers to inject arbitrary web script or HTML via the links parameter.
CVE-2011-5204	Akiva Webboard	0.03	—	0.01	Oct 4, 2012	Akiva WebBoard 8.x stores passwords in plaintext, which allows local users to obtain sensitive information by reading from the database.
CVE-2011-5203	Akiva Webboard	0.03	—	0.01	Oct 4, 2012	SQL injection vulnerability in WB/Default.asp in Akiva WebBoard before 8 SR 1 allows remote attackers to execute arbitrary SQL commands via the name parameter. NOTE: some of these details are obtained from third party information.
CVE-2012-5293	Redgraphic Sapid CMS	0.03	—	0.03	Oct 4, 2012	Multiple PHP remote file inclusion vulnerabilities in SAPID CMS 1.2.3 Stable allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[root_path] parameter to usr/extensions/get_tree.inc.php or (2) root_path parameter to…
CVE-2012-5292	Atar2b Atar2b CMS	0.03	—	0.01	Oct 4, 2012	Multiple SQL injection vulnerabilities in Atar2b CMS 4.0.1 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) gallery_e.php, (2) pageE.php, or (3) pageH.php.

CVE-2010-5278Oct 7, 2012
Modx
Revolution
risk 0.04cvss —epss 0.17
Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter. NOTE: some of…
CVE-2010-5277Oct 7, 2012
Drupal
Views Bulk Operations
risk 0.00cvss —epss 0.01
Unspecified vulnerability in the Views Bulk Operations module 6 before 6.x-1.10 for Drupal allows remote authenticated users with user management permissions to bypass intended access restrictions and delete anonymous users (user 0) via unspecified vectors.
CVE-2010-5276Oct 7, 2012
Drupal
Memcache
risk 0.00cvss —epss 0.01
The Memcache module 5.x before 5.x-1.10 and 6.x before 6.x-1.6 for Drupal does not properly handle the $user object in memcache_admin, which might "lead to a role change not being recognized until the user logs in again."
CVE-2010-5275Oct 7, 2012
Drupal
Memcache
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in memcache_admin in the Memcache module 5.x before 5.x-1.10 and 6.x before 6.x-1.6 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-3918Oct 7, 2012
Google
Android
risk 0.03cvss —epss 0.01
The Zygote process in Android 4.0.3 and earlier accepts fork requests from processes with arbitrary UIDs, which allows remote attackers to cause a denial of service (reboot loop) via a crafted application.
CVE-2012-5306Oct 6, 2012
Dlink
Camera Stream Client ActiveX Control
risk 0.04cvss —epss 0.12
Stack-based buffer overflow in the SelectDirectory method in DcsCliCtrl.dll in Camera Stream Client ActiveX Control, as used in D-Link DCS-5605 PTZ IP Network Camera, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long…
CVE-2012-5305Oct 6, 2012
Directadmin
Directadmin
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allows remote attackers to inject arbitrary web script or HTML via the domain parameter.
CVE-2012-5304Oct 6, 2012
YVS
Image Gallery
risk 0.00cvss —epss 0.01
Static code injection vulnerability in administration/install.php in YVS Image Gallery allows remote attackers to inject arbitrary PHP code into functions/db_connect.php via unspecified vectors. NOTE: this is only a vulnerability when the administrator does not follow…
CVE-2012-1618Oct 6, 2012
PostgreSQL
PostgreSQL
risk 0.00cvss —epss 0.03
Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows…
CVE-2012-1634Oct 6, 2012
Drupal
Video Filter
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in video_filter.codecs.inc in the Video Filter module 6.x-2.x and 7.x-2.x for Drupal allows remote attackers to inject arbitrary web script or HTML via the EMBEDLOOKUP parameter for Blip.tv links.
CVE-2012-1624Oct 6, 2012
Lingotek
Lingotek
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the Lingotek module 6.x-1.x before 6.x-1.40 for Drupal allow remote authenticated users to inject arbitrary web script or HTML when (1) creating or (2) editing page content.
CVE-2012-1623Oct 6, 2012
Drupal
Registration codes
risk 0.00cvss —epss 0.01
The Registration Codes module before 6.x-2.4 for Drupal does not restrict access to the registration code list, which might allow remote attackers to bypass intended registration restrictions.
CVE-2012-1565Oct 6, 2012
Ez
Ez Publish
risk 0.00cvss —epss 0.02
Unspecified vulnerability in ez Publish 4.1.4, 4.2, 4.3, 4.4, 4.5, and 4.6 has unknown impact and attack vectors related to an insecure direct object reference.
CVE-2012-1564Oct 6, 2012
YVS
Image Gallery
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in administration/create_album.php in YVS Image Gallery allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1153Oct 6, 2012
Apprain
Apprain
risk 0.06cvss —epss 0.32
Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads…
CVE-2012-0987Oct 6, 2012
Impresscms
Impresscms
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in edituser.php in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the icmsConfigPlugins[sanitizer_plugins][] parameter.
CVE-2012-0986Oct 6, 2012
Impresscms
Impresscms
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) notifications.php, (2) modules/system/admin/images/browser.php, and (3)…
CVE-2012-0065Oct 6, 2012
usbmuxd
usbmuxd
risk 0.00cvss —epss 0.01
Heap-based buffer overflow in the receive_packet function in libusbmuxd/libusbmuxd.c in usbmuxd 1.0.5 through 1.0.7 allows physically proximate attackers to execute arbitrary code via a long SerialNumber field in a property list.
CVE-2011-4932Oct 6, 2012
Impresspages
Impresspages CMS
risk 0.00cvss —epss 0.04
Eval injection vulnerability in ip_cms/modules/standard/content_management/actions.php in ImpressPages CMS 1.0.12 and possibly other versons before 1.0.13 allows remote attackers to execute arbitrary code via the cm_group parameter.
CVE-2012-5303Oct 5, 2012
Mw Wp Form Project
Monkey
risk 0.00cvss —epss 0.00
Monkey HTTP Daemon 0.9.3 might allow local users to overwrite arbitrary files via a symlink attack on a PID file, as demonstrated by a pathname different from the default /var/run/monkey.pid pathname.
CVE-2012-4442Oct 5, 2012
Mw Wp Form Project
Monkey
risk 0.00cvss —epss 0.00
Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effective UID, which might allow local users to bypass intended file-read restrictions by leveraging a race condition in a file-permission check.
CVE-2012-1150Oct 5, 2012
Python (programming language)
Python
risk 0.00cvss —epss 0.05
Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted…
CVE-2012-0845Oct 5, 2012
Python (programming language)
Python
risk 0.00cvss —epss 0.05
SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of…
CVE-2012-5051Oct 5, 2012
VMware
Capacityiq
risk 0.00cvss —epss 0.03
Directory traversal vulnerability in VMware CapacityIQ 1.5.x allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2012-5050Oct 5, 2012
VMware
Vcenter Operations
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the server in VMware vCenter Operations (aka vCOps) before 5.0.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4897Oct 5, 2012
VMware
Movie Decoder
risk 0.00cvss —epss 0.00
Untrusted search path vulnerability in the installer in VMware Movie Decoder before 9.0 allows local users to gain privileges via a Trojan horse executable file in the installer directory.
CVE-2012-4443Oct 5, 2012
Mw Wp Form Project
Monkey
risk 0.00cvss —epss 0.00
Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access.
CVE-2012-4896Oct 5, 2012
Sumatrapdfreader
Sumatrapdf
risk 0.00cvss —epss 0.05
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2012-4895.
CVE-2012-4895Oct 5, 2012
Sumatrapdfreader
Sumatrapdf
risk 0.00cvss —epss 0.05
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2012-4896.
CVE-2012-4894Oct 5, 2012
Google
Sketchup
risk 0.00cvss —epss 0.05
Google SketchUp before 8.0.14346 (aka 8 Maintenance 3) allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted SKP file.
CVE-2012-4018Oct 5, 2012
Final Beta Laboratory
MyWebSearch
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Final Beta Laboratory MyWebSearch before 1.23 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.
CVE-2012-5301Oct 4, 2012
Cerberus
FTP Server
risk 0.00cvss —epss 0.01
The default configuration of Cerberus FTP Server before 5.0.4.0 supports the DES cipher for SSH sessions, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and performing a brute-force attack on the encrypted data.
CVE-2012-5240Oct 4, 2012
Wireshark
Wireshark
risk 0.00cvss —epss 0.01
Buffer overflow in the dissect_tlv function in epan/dissectors/packet-ldp.c in the LDP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malformed packet.
CVE-2012-5238Oct 4, 2012
Wireshark
Wireshark
risk 0.00cvss —epss 0.01
epan/dissectors/packet-ppp.c in the PPP dissector in Wireshark 1.8.x before 1.8.3 uses incorrect OUI data structures during the decoding of (1) PPP and (2) LCP data, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a…
CVE-2012-5237Oct 4, 2012
Wireshark
Wireshark
risk 0.00cvss —epss 0.01
The dissect_hsrp function in epan/dissectors/packet-hsrp.c in the HSRP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
CVE-2012-2999Oct 4, 2012
Cerberus
FTP Server
risk 0.00cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in Cerberus FTP Server before 5.0.5.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user account or (2) reconfigure the state of the FTP service,…
CVE-2012-5300Oct 4, 2012
Mystorexpress
Tienda Virtual
risk 0.00cvss —epss 0.01
SQL injection vulnerability in art_catalogo.php in MyStore Xpress Tienda Virtual 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2012-5299Oct 4, 2012
Mavili Guestbook Project
Mavili Guestbook
risk 0.00cvss —epss 0.02
Mavili Guestbook, as released in November 2007, allows remote attackers to edit, delete, and approve arbitrary messages via a direct request to (1) edit.asp, (2) delete.asp, or (3) approve.asp.
CVE-2012-5298Oct 4, 2012
Mavili Guestbook Project
Mavili Guestbook
risk 0.00cvss —epss 0.01
Mavili Guestbook, as released in November 2007, stores guestbook.mdb under the web root with insufficient access control, which allows remote attackers to read the database via a direct request.
CVE-2012-5297Oct 4, 2012
Mavili Guestbook Project
Mavili Guestbook
risk 0.00cvss —epss 0.01
SQL injection vulnerability in edit.asp in Mavili Guestbook, as released in November 2007, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2012-5296Oct 4, 2012
Mavili Guestbook Project
Mavili Guestbook
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Mavili Guestbook, as released in November 2007, allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) approve.asp, (2) delete.asp, (3) edit.asp, or (4) edit2.asp.
CVE-2012-5295Oct 4, 2012
Fusetalk.
Fusetalk
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in login.cfm in FuseTalk Forums 3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the windowed parameter.
CVE-2012-5294Oct 4, 2012
Mystorexpress
Tienda Virtual
risk 0.03cvss —epss 0.01
SQL injection vulnerability in art_detalle.php in MyStore Xpress Tienda Virtual allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2011-5207Oct 4, 2012
Thecartpress
Thecartpress
risk 0.00cvss —epss 0.05
Cross-site scripting (XSS) vulnerability in admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31 allows remote attackers to inject arbitrary web script or HTML via the tcp_name_post_XXXXX parameter.
CVE-2011-5206Oct 4, 2012
Rapidleech
Rapidleech
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in notes.php in Rapidleech before 2.3 rev42 SVN r399 allows remote attackers to inject arbitrary web script or HTML via the notes parameter.
CVE-2011-5205Oct 4, 2012
Rapidleech
Rapidleech
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in audl.php in Rapidleech 2.3 rev42 SVN r358, rev43 SVN r397, and earlier allows remote attackers to inject arbitrary web script or HTML via the links parameter.
CVE-2011-5204Oct 4, 2012
Akiva
Webboard
risk 0.03cvss —epss 0.01
Akiva WebBoard 8.x stores passwords in plaintext, which allows local users to obtain sensitive information by reading from the database.
CVE-2011-5203Oct 4, 2012
Akiva
Webboard
risk 0.03cvss —epss 0.01
SQL injection vulnerability in WB/Default.asp in Akiva WebBoard before 8 SR 1 allows remote attackers to execute arbitrary SQL commands via the name parameter. NOTE: some of these details are obtained from third party information.
CVE-2012-5293Oct 4, 2012
Redgraphic
Sapid CMS
risk 0.03cvss —epss 0.03
Multiple PHP remote file inclusion vulnerabilities in SAPID CMS 1.2.3 Stable allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[root_path] parameter to usr/extensions/get_tree.inc.php or (2) root_path parameter to…
CVE-2012-5292Oct 4, 2012
Atar2b
Atar2b CMS
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in Atar2b CMS 4.0.1 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) gallery_e.php, (2) pageE.php, or (3) pageH.php.