CVEs

347,058 total · page 5916 of 6,942

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2012-2852	Google Chrome	0.00	—	0.01	Aug 6, 2012	The PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, does not properly handle object linkage, which allows remote attackers to cause a denial of service (use-after-free) or possibly have…
CVE-2012-2851	Google Chrome	0.00	—	0.01	Aug 6, 2012	Multiple integer overflows in the PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted…
CVE-2012-2850	Google Chrome	0.00	—	0.01	Aug 6, 2012	Multiple unspecified vulnerabilities in the PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allow remote attackers to have an unknown impact via a crafted document.
CVE-2012-2849	Google Chrome	0.00	—	0.01	Aug 6, 2012	Off-by-one error in the GIF decoder in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.
CVE-2012-2848	Google Chrome	0.00	—	0.01	Aug 6, 2012	The drag-and-drop implementation in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows user-assisted remote attackers to bypass intended file access restrictions via a crafted web site.
CVE-2012-2847	Google Chrome	0.00	—	0.01	Aug 6, 2012	Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, does not request user confirmation before continuing a large series of downloads, which allows user-assisted remote attackers to cause a denial of service (resource…
CVE-2012-2846	Google Chrome	0.00	—	0.01	Aug 6, 2012	Google Chrome before 21.0.1180.57 on Linux does not properly isolate renderer processes, which allows remote attackers to cause a denial of service (cross-process interference) via unspecified vectors.
CVE-2012-1370	Cisco Systems, Inc. Anyconnect Secure Mobility Client	0.00	—	0.01	Aug 6, 2012	Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 allows remote authenticated users to cause a denial of service (vpnagentd process crash) via a crafted packet, aka Bug ID CSCty01670.
CVE-2012-1367	Cisco Systems, Inc. Cisco iOS	0.00	—	0.02	Aug 6, 2012	The MallocLite implementation in Cisco IOS 12.0, 12.2, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (Route Processor crash) via a BGP UPDATE message with a modified local-preference (aka LOCAL_PREF) attribute length, aka Bug ID CSCtq06538.
CVE-2012-1365	Cisco Systems, Inc. Unified Computing System	0.00	—	0.01	Aug 6, 2012	Cisco Unified Computing System (UCS) 1.4 and 2.0 allows remote authenticated users to cause a denial of service (device reload) via a malformed SNMP request to a Fabric Interconnect (FI) device, aka Bug ID CSCts32463.
CVE-2012-1364	Cisco Systems, Inc. Unified Computing System	0.00	—	0.01	Aug 6, 2012	Cisco Unified Computing System (UCS) 1.4 and 2.0 allows remote authenticated users to cause a denial of service (device reload) via a malformed SNMP request to a Fabric Interconnect (FI) device, aka Bug ID CSCts32452.
CVE-2012-3444	Djangoproject Django	0.00	—	0.02	Jul 31, 2012	The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via…
CVE-2012-3443	Djangoproject Django	0.00	—	0.03	Jul 31, 2012	The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
CVE-2012-3442	Djangoproject Django	0.00	—	0.02	Jul 31, 2012	The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via…
CVE-2012-3951	SonicWall Scrutinizer	0.07	—	0.52	Jul 31, 2012	The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session.
CVE-2012-3848	SonicWall Scrutinizer	0.03	—	0.02	Jul 31, 2012	Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to d4d/exporters.php, (2) the HTTP Referer header to…
CVE-2012-3426	OpenStack Essex	0.00	—	0.02	Jul 31, 2012	OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token…
CVE-2012-3018	Iconics Bizviz	0.00	—	0.00	Jul 31, 2012	The lockout-recovery feature in the Security Configurator component in ICONICS GENESIS32 9.22 and earlier and BizViz 9.22 and earlier uses an improper encryption algorithm for generation of an authentication code, which allows local users to bypass intended access restrictions…
CVE-2012-3017	Siemens Foundation Simatic S7 400 CPU Firmware	0.00	—	0.03	Jul 31, 2012	Siemens SIMATIC S7-400 PN CPU devices with firmware 5.x allow remote attackers to cause a denial of service (defect-mode transition and service outage) via (1) malformed HTTP traffic or (2) malformed IP packets.
CVE-2012-3016	Siemens Foundation Simatic S7 400 CPU Firmware	0.00	—	0.03	Jul 31, 2012	Siemens SIMATIC S7-400 PN CPU devices with firmware 6 before 6.0.3 allow remote attackers to cause a denial of service (defect-mode transition and service outage) via crafted ICMP packets.
CVE-2012-2647	Yahoo Toolbar	0.00	—	0.01	Jul 31, 2012	Yahoo! Toolbar 1.0.0.5 and earlier for Chrome and Safari allows remote attackers to modify the configured search URL, and intercept search terms, via a crafted web page.
CVE-2012-2627	SonicWall Scrutinizer	0.03	—	0.06	Jul 31, 2012	d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote attackers to create or overwrite arbitrary files in %PROGRAMFILES%\Scrutinizer\snmp\mibs\ via a multipart/form-data POST request.
CVE-2012-2626	SonicWall Scrutinizer	0.07	—	0.44	Jul 31, 2012	cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authentication, which allows remote attackers to add administrative accounts via a userprefs action.
CVE-2012-2962	SonicWall Scrutinizer	0.08	—	0.67	Jul 30, 2012	SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter.
CVE-2012-2163	IBM Scale Out Network Attached Storage	0.00	—	0.02	Jul 30, 2012	IBM Scale Out Network Attached Storage (SONAS) 1.1 through 1.3.1 allows remote authenticated administrators to execute arbitrary Linux commands via the (1) Command Line Interface or (2) Graphical User Interface, related to a "code injection" issue.
CVE-2012-0723	IBM Aix	0.00	—	0.00	Jul 30, 2012	The kernel in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly implement the dupmsg system call, which allows local users to cause a denial of service (system crash) via a crafted application.
CVE-2012-1969	Mozilla Corporation Bugzilla	0.00	—	0.02	Jul 30, 2012	The get_attachment_link function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before 4.2.2, and 4.3.x before 4.3.2 does not check whether an attachment is private before presenting the attachment description within a public…
CVE-2012-1968	Mozilla Corporation Bugzilla	0.00	—	0.01	Jul 30, 2012	Bugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses bug-editor privileges instead of bugmail-recipient privileges during construction of HTML bugmail documents, which allows remote attackers to obtain sensitive description information by reading the tooltip…
CVE-2012-2978	Nlnetlabs Nsd	0.01	—	0.09	Jul 27, 2012	query.c in NSD 3.0.x through 3.0.8, 3.1.x through 3.1.1, and 3.2.x before 3.2.12 allows remote attackers to cause a denial of service (NULL pointer dereference and child process crash) via a crafted DNS packet.
CVE-2012-2202	IBM Lotus Protector For Mail Security	0.03	—	0.03	Jul 27, 2012	Directory traversal vulnerability in javatester_init.php in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2.8 and IBM ISS Proventia Network Mail Security System allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the template…
CVE-2012-3888	Airdroid Airdroid	0.00	—	0.01	Jul 26, 2012	The login implementation in AirDroid 1.0.4 beta allows remote attackers to bypass a multiple-login protection mechanism by modifying a pass value within JSON data.
CVE-2012-3887	Airdroid Airdroid	0.00	—	0.01	Jul 26, 2012	AirDroid before 1.0.7 beta uses a cleartext base64 format for data transfer that is documented as an "Encrypted Transmission" feature, which allows remote attackers to obtain sensitive information by sniffing the local wireless network, as demonstrated by the SMS message content…
CVE-2012-3886	Airdroid Airdroid	0.00	—	0.01	Jul 26, 2012	AirDroid 1.0.4 beta uses the MD5 algorithm for values in the checklogin key parameter and 7bb cookie, which makes it easier for remote attackers to obtain cleartext data by sniffing the local wireless network and then conducting a (1) brute-force attack or (2) rainbow-table…
CVE-2012-3885	Airdroid Airdroid	0.00	—	0.01	Jul 26, 2012	The default configuration of AirDroid 1.0.4 beta uses a four-character alphanumeric password, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVE-2012-3884	Airdroid Airdroid	0.00	—	0.01	Jul 26, 2012	AirDroid 1.0.4 beta implements authentication through direct transmission of a password hash over HTTP, which makes it easier for remote attackers to obtain access by sniffing the local wireless network and then replaying the authentication data.
CVE-2011-3174	Novell Zenworks Configuration Management	0.00	—	0.03	Jul 26, 2012	Buffer overflow in the DoFindReplace function in the ISGrid.Grid2.1 ActiveX control in InstallShield/ISGrid2.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary code via a long bstrReplaceText…
CVE-2011-2658	Novell Zenworks Configuration Management	0.00	—	0.03	Jul 26, 2012	The ISList.ISAvi ActiveX control in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 provides access to the mscomct2.ocx file, which allows remote attackers to execute arbitrary code by leveraging unspecified mscomct2 flaws.
CVE-2011-2657	Novell Zenworks Configuration Management	0.07	—	0.48	Jul 26, 2012	Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary commands via a…
CVE-2012-4068	Citrix Systems Provisioning Services	0.00	—	0.05	Jul 26, 2012	Heap-based buffer overflow in the SoapServer service in Citrix Provisioning Services 5.0, 5.1, 5.6, 5.6 SP1, 6.0, and 6.1 allows remote attackers to execute arbitrary code via a crafted string associated with date and time data.
CVE-2012-4043	Palo Alto SSL VPN	0.00	—	0.01	Jul 26, 2012	Cross-site scripting (XSS) vulnerability in global-protect/login.esp in Palo Alto Networks Global Protect Portal, Global Protect Gateway, and SSL VPN portals 3.1.x through 3.1.11 and 4.0.x through 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the…
CVE-2012-3698	Apple Inc. Xcode	0.00	—	0.01	Jul 26, 2012	Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of programs that lack bundle identifiers, which allows remote attackers to read keychain entries via a crafted app, as demonstrated by the keychain entries of a (1) helper tool or (2)…
CVE-2011-4963	Nginx Nginx	0.00	—	0.06	Jul 26, 2012	nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted files via (1) a trailing . (dot) or (2) certain "$index_allocation" sequences in a request.
CVE-2011-2503	Systemtap Systemtap	0.00	—	0.00	Jul 26, 2012	The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation…
CVE-2011-2502	Systemtap Systemtap	0.00	—	0.01	Jul 26, 2012	runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted…
CVE-2012-3015	Siemens Foundation Simatic Pcs7	0.00	—	0.00	Jul 26, 2012	Untrusted search path vulnerability in Siemens SIMATIC STEP7 before 5.5 SP1, as used in SIMATIC PCS7 7.1 SP3 and earlier and other products, allows local users to gain privileges via a Trojan horse DLL in a STEP7 project folder.
CVE-2012-3005	Invensys Wonderware Application Server	0.00	—	0.00	Jul 26, 2012	Untrusted search path vulnerability in Invensys Wonderware InTouch 2012 and earlier, as used in Wonderware Application Server, Wonderware Information Server, Foxboro Control Software, InFusion CE/FE/SCADA, InBatch, and Wonderware Historian, allows local users to gain privileges…
CVE-2012-4061	Asp Dev Xm Diary	0.00	—	0.01	Jul 25, 2012	Multiple SQL injection vulnerabilities in ASP-DEv XM Diary allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to diary_view.asp or (2) view_date parameter to default.asp.
CVE-2012-4060	Asp Dev Xm Forum	0.03	—	0.01	Jul 25, 2012	Multiple SQL injection vulnerabilities in ASP-DEv XM Forums RC3 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) profile.asp, (2) forum.asp, or (3) topic.asp.
CVE-2012-4059	Socketmail Socketmail	0.00	—	0.01	Jul 25, 2012	Cross-site request forgery (CSRF) vulnerability in home/secretqtn.php in SocketMail Pro 2.2.9 allows remote attackers to hijack the authentication of arbitrary users for requests that change user security questions and answers via an upd action.
CVE-2012-4058	Socketmail Socketmail	0.00	—	0.01	Jul 25, 2012	Cross-site scripting (XSS) vulnerability in SocketMail Pro 2.2.9 allows remote attackers to inject arbitrary web script or HTML via the subject of an email.

CVE-2012-2852Aug 6, 2012
Google
Chrome
risk 0.00cvss —epss 0.01
The PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, does not properly handle object linkage, which allows remote attackers to cause a denial of service (use-after-free) or possibly have…
CVE-2012-2851Aug 6, 2012
Google
Chrome
risk 0.00cvss —epss 0.01
Multiple integer overflows in the PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted…
CVE-2012-2850Aug 6, 2012
Google
Chrome
risk 0.00cvss —epss 0.01
Multiple unspecified vulnerabilities in the PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allow remote attackers to have an unknown impact via a crafted document.
CVE-2012-2849Aug 6, 2012
Google
Chrome
risk 0.00cvss —epss 0.01
Off-by-one error in the GIF decoder in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.
CVE-2012-2848Aug 6, 2012
Google
Chrome
risk 0.00cvss —epss 0.01
The drag-and-drop implementation in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows user-assisted remote attackers to bypass intended file access restrictions via a crafted web site.
CVE-2012-2847Aug 6, 2012
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, does not request user confirmation before continuing a large series of downloads, which allows user-assisted remote attackers to cause a denial of service (resource…
CVE-2012-2846Aug 6, 2012
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 21.0.1180.57 on Linux does not properly isolate renderer processes, which allows remote attackers to cause a denial of service (cross-process interference) via unspecified vectors.
CVE-2012-1370Aug 6, 2012
Cisco Systems, Inc.
Anyconnect Secure Mobility Client
risk 0.00cvss —epss 0.01
Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 allows remote authenticated users to cause a denial of service (vpnagentd process crash) via a crafted packet, aka Bug ID CSCty01670.
CVE-2012-1367Aug 6, 2012
Cisco Systems, Inc.
Cisco iOS
risk 0.00cvss —epss 0.02
The MallocLite implementation in Cisco IOS 12.0, 12.2, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (Route Processor crash) via a BGP UPDATE message with a modified local-preference (aka LOCAL_PREF) attribute length, aka Bug ID CSCtq06538.
CVE-2012-1365Aug 6, 2012
Cisco Systems, Inc.
Unified Computing System
risk 0.00cvss —epss 0.01
Cisco Unified Computing System (UCS) 1.4 and 2.0 allows remote authenticated users to cause a denial of service (device reload) via a malformed SNMP request to a Fabric Interconnect (FI) device, aka Bug ID CSCts32463.
CVE-2012-1364Aug 6, 2012
Cisco Systems, Inc.
Unified Computing System
risk 0.00cvss —epss 0.01
Cisco Unified Computing System (UCS) 1.4 and 2.0 allows remote authenticated users to cause a denial of service (device reload) via a malformed SNMP request to a Fabric Interconnect (FI) device, aka Bug ID CSCts32452.
CVE-2012-3444Jul 31, 2012
Djangoproject
Django
risk 0.00cvss —epss 0.02
The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via…
CVE-2012-3443Jul 31, 2012
Djangoproject
Django
risk 0.00cvss —epss 0.03
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
CVE-2012-3442Jul 31, 2012
Djangoproject
Django
risk 0.00cvss —epss 0.02
The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via…
CVE-2012-3951Jul 31, 2012
SonicWall
Scrutinizer
risk 0.07cvss —epss 0.52
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session.
CVE-2012-3848Jul 31, 2012
SonicWall
Scrutinizer
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to d4d/exporters.php, (2) the HTTP Referer header to…
CVE-2012-3426Jul 31, 2012
OpenStack
Essex
risk 0.00cvss —epss 0.02
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token…
CVE-2012-3018Jul 31, 2012
Iconics
Bizviz
risk 0.00cvss —epss 0.00
The lockout-recovery feature in the Security Configurator component in ICONICS GENESIS32 9.22 and earlier and BizViz 9.22 and earlier uses an improper encryption algorithm for generation of an authentication code, which allows local users to bypass intended access restrictions…
CVE-2012-3017Jul 31, 2012
Siemens Foundation
Simatic S7 400 CPU Firmware
risk 0.00cvss —epss 0.03
Siemens SIMATIC S7-400 PN CPU devices with firmware 5.x allow remote attackers to cause a denial of service (defect-mode transition and service outage) via (1) malformed HTTP traffic or (2) malformed IP packets.
CVE-2012-3016Jul 31, 2012
Siemens Foundation
Simatic S7 400 CPU Firmware
risk 0.00cvss —epss 0.03
Siemens SIMATIC S7-400 PN CPU devices with firmware 6 before 6.0.3 allow remote attackers to cause a denial of service (defect-mode transition and service outage) via crafted ICMP packets.
CVE-2012-2647Jul 31, 2012
Yahoo
Toolbar
risk 0.00cvss —epss 0.01
Yahoo! Toolbar 1.0.0.5 and earlier for Chrome and Safari allows remote attackers to modify the configured search URL, and intercept search terms, via a crafted web page.
CVE-2012-2627Jul 31, 2012
SonicWall
Scrutinizer
risk 0.03cvss —epss 0.06
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote attackers to create or overwrite arbitrary files in %PROGRAMFILES%\Scrutinizer\snmp\mibs\ via a multipart/form-data POST request.
CVE-2012-2626Jul 31, 2012
SonicWall
Scrutinizer
risk 0.07cvss —epss 0.44
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authentication, which allows remote attackers to add administrative accounts via a userprefs action.
CVE-2012-2962Jul 30, 2012
SonicWall
Scrutinizer
risk 0.08cvss —epss 0.67
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter.
CVE-2012-2163Jul 30, 2012
IBM
Scale Out Network Attached Storage
risk 0.00cvss —epss 0.02
IBM Scale Out Network Attached Storage (SONAS) 1.1 through 1.3.1 allows remote authenticated administrators to execute arbitrary Linux commands via the (1) Command Line Interface or (2) Graphical User Interface, related to a "code injection" issue.
CVE-2012-0723Jul 30, 2012
IBM
Aix
risk 0.00cvss —epss 0.00
The kernel in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly implement the dupmsg system call, which allows local users to cause a denial of service (system crash) via a crafted application.
CVE-2012-1969Jul 30, 2012
Mozilla Corporation
Bugzilla
risk 0.00cvss —epss 0.02
The get_attachment_link function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before 4.2.2, and 4.3.x before 4.3.2 does not check whether an attachment is private before presenting the attachment description within a public…
CVE-2012-1968Jul 30, 2012
Mozilla Corporation
Bugzilla
risk 0.00cvss —epss 0.01
Bugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses bug-editor privileges instead of bugmail-recipient privileges during construction of HTML bugmail documents, which allows remote attackers to obtain sensitive description information by reading the tooltip…
CVE-2012-2978Jul 27, 2012
Nlnetlabs
Nsd
risk 0.01cvss —epss 0.09
query.c in NSD 3.0.x through 3.0.8, 3.1.x through 3.1.1, and 3.2.x before 3.2.12 allows remote attackers to cause a denial of service (NULL pointer dereference and child process crash) via a crafted DNS packet.
CVE-2012-2202Jul 27, 2012
IBM
Lotus Protector For Mail Security
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in javatester_init.php in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2.8 and IBM ISS Proventia Network Mail Security System allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the template…
CVE-2012-3888Jul 26, 2012
Airdroid
Airdroid
risk 0.00cvss —epss 0.01
The login implementation in AirDroid 1.0.4 beta allows remote attackers to bypass a multiple-login protection mechanism by modifying a pass value within JSON data.
CVE-2012-3887Jul 26, 2012
Airdroid
Airdroid
risk 0.00cvss —epss 0.01
AirDroid before 1.0.7 beta uses a cleartext base64 format for data transfer that is documented as an "Encrypted Transmission" feature, which allows remote attackers to obtain sensitive information by sniffing the local wireless network, as demonstrated by the SMS message content…
CVE-2012-3886Jul 26, 2012
Airdroid
Airdroid
risk 0.00cvss —epss 0.01
AirDroid 1.0.4 beta uses the MD5 algorithm for values in the checklogin key parameter and 7bb cookie, which makes it easier for remote attackers to obtain cleartext data by sniffing the local wireless network and then conducting a (1) brute-force attack or (2) rainbow-table…
CVE-2012-3885Jul 26, 2012
Airdroid
Airdroid
risk 0.00cvss —epss 0.01
The default configuration of AirDroid 1.0.4 beta uses a four-character alphanumeric password, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVE-2012-3884Jul 26, 2012
Airdroid
Airdroid
risk 0.00cvss —epss 0.01
AirDroid 1.0.4 beta implements authentication through direct transmission of a password hash over HTTP, which makes it easier for remote attackers to obtain access by sniffing the local wireless network and then replaying the authentication data.
CVE-2011-3174Jul 26, 2012
Novell
Zenworks Configuration Management
risk 0.00cvss —epss 0.03
Buffer overflow in the DoFindReplace function in the ISGrid.Grid2.1 ActiveX control in InstallShield/ISGrid2.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary code via a long bstrReplaceText…
CVE-2011-2658Jul 26, 2012
Novell
Zenworks Configuration Management
risk 0.00cvss —epss 0.03
The ISList.ISAvi ActiveX control in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 provides access to the mscomct2.ocx file, which allows remote attackers to execute arbitrary code by leveraging unspecified mscomct2 flaws.
CVE-2011-2657Jul 26, 2012
Novell
Zenworks Configuration Management
risk 0.07cvss —epss 0.48
Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary commands via a…
CVE-2012-4068Jul 26, 2012
Citrix Systems
Provisioning Services
risk 0.00cvss —epss 0.05
Heap-based buffer overflow in the SoapServer service in Citrix Provisioning Services 5.0, 5.1, 5.6, 5.6 SP1, 6.0, and 6.1 allows remote attackers to execute arbitrary code via a crafted string associated with date and time data.
CVE-2012-4043Jul 26, 2012
Palo Alto
SSL VPN
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in global-protect/login.esp in Palo Alto Networks Global Protect Portal, Global Protect Gateway, and SSL VPN portals 3.1.x through 3.1.11 and 4.0.x through 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the…
CVE-2012-3698Jul 26, 2012
Apple Inc.
Xcode
risk 0.00cvss —epss 0.01
Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of programs that lack bundle identifiers, which allows remote attackers to read keychain entries via a crafted app, as demonstrated by the keychain entries of a (1) helper tool or (2)…
CVE-2011-4963Jul 26, 2012
Nginx
Nginx
risk 0.00cvss —epss 0.06
nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted files via (1) a trailing . (dot) or (2) certain "$index_allocation" sequences in a request.
CVE-2011-2503Jul 26, 2012
Systemtap
Systemtap
risk 0.00cvss —epss 0.00
The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation…
CVE-2011-2502Jul 26, 2012
Systemtap
Systemtap
risk 0.00cvss —epss 0.01
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted…
CVE-2012-3015Jul 26, 2012
Siemens Foundation
Simatic Pcs7
risk 0.00cvss —epss 0.00
Untrusted search path vulnerability in Siemens SIMATIC STEP7 before 5.5 SP1, as used in SIMATIC PCS7 7.1 SP3 and earlier and other products, allows local users to gain privileges via a Trojan horse DLL in a STEP7 project folder.
CVE-2012-3005Jul 26, 2012
Invensys
Wonderware Application Server
risk 0.00cvss —epss 0.00
Untrusted search path vulnerability in Invensys Wonderware InTouch 2012 and earlier, as used in Wonderware Application Server, Wonderware Information Server, Foxboro Control Software, InFusion CE/FE/SCADA, InBatch, and Wonderware Historian, allows local users to gain privileges…
CVE-2012-4061Jul 25, 2012
Asp Dev
Xm Diary
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in ASP-DEv XM Diary allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to diary_view.asp or (2) view_date parameter to default.asp.
CVE-2012-4060Jul 25, 2012
Asp Dev
Xm Forum
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in ASP-DEv XM Forums RC3 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) profile.asp, (2) forum.asp, or (3) topic.asp.
CVE-2012-4059Jul 25, 2012
Socketmail
Socketmail
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in home/secretqtn.php in SocketMail Pro 2.2.9 allows remote attackers to hijack the authentication of arbitrary users for requests that change user security questions and answers via an upd action.
CVE-2012-4058Jul 25, 2012
Socketmail
Socketmail
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in SocketMail Pro 2.2.9 allows remote attackers to inject arbitrary web script or HTML via the subject of an email.