CVEs

347,048 total · page 5924 of 6,941

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2012-3236	GIMP Gimp		0.04	—	0.11	Jul 12, 2012	fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated using a long string.
CVE-2012-2844	Google Chrome		0.00	—	0.02	Jul 12, 2012	The PDF functionality in Google Chrome before 20.0.1132.57 does not properly handle JavaScript code, which allows remote attackers to cause a denial of service (incorrect object access) or possibly have unspecified other impact via a crafted document.
CVE-2012-2843	Google Chrome		0.00	—	0.02	Jul 12, 2012	Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to layout height tracking.
CVE-2012-2842	Google Chrome		0.00	—	0.01	Jul 12, 2012	Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to counter handling.
CVE-2012-2614	Lattice Diamond Programmer		0.03	—	0.04	Jul 12, 2012	Buffer overflow in programmer.exe in Lattice Diamond Programmer 1.4.2 allows user-assisted remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long string in a version attribute of an ispXCF element in an .xcf file.
CVE-2012-1661	Esri Arcmap		0.05	—	0.24	Jul 12, 2012	ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map (.mxd) file.
CVE-2012-3362	Extplorer Extplorer		0.00	—	0.01	Jul 12, 2012	Cross-site request forgery (CSRF) vulnerability in eXtplorer 2.1 RC3 and earlier allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an adduser admin action.
CVE-2012-2653	Lawrence Berkeley National Laboratory Arpwatch		0.00	—	0.03	Jul 12, 2012	arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.
CVE-2012-2351	Mahara (software) Mahara		0.00	—	0.02	Jul 12, 2012	The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username.
CVE-2012-1174	Linux Systemd		0.00	—	0.00	Jul 12, 2012	The rm_rf_children function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allows local users to delete arbitrary files via a symlink attack on unspecified files, related to "particular records related with user session."
CVE-2012-1163	Libzip Libzip		0.00	—	0.03	Jul 12, 2012	Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive, which triggers "improper restrictions of operations within the bounds of a…
CVE-2012-1162	Libzip Libzip		0.00	—	0.04	Jul 12, 2012	Heap-based buffer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a zip archive with the number of directories set to 0, related to an "incorrect…
CVE-2012-1037	Glpi Project Glpi		0.00	—	0.01	Jul 12, 2012	PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a URL in the sub_type parameter.
CVE-2012-0215	Tryton Trytond		0.00	—	0.02	Jul 12, 2012	model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2)…
CVE-2012-3996	Tiki Tikiwiki CMS\/groupware		0.03	—	0.05	Jul 12, 2012	TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or (3) tiki-watershed_service.php.
CVE-2012-3881	Adrian Chadd Rtg		0.00	—	0.01	Jul 12, 2012	Multiple SQL injection vulnerabilities in RTG 0.7.4 and RTG2 0.9.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) 95.php, (2) view.php, or (3) rtg.php.
CVE-2012-3805	Kajona Kajona		0.03	—	0.02	Jul 12, 2012	Multiple cross-site scripting (XSS) vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) absender_name, (2) absender_email, or (3) absender_nachricht parameter…
CVE-2012-3399	Artis.imag Basilic		0.08	—	0.65	Jul 12, 2012	Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter.
CVE-2012-3376	Apache Hadoop		0.00	—	0.03	Jul 12, 2012	DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have…
CVE-2012-2763	GIMP Gimp		0.10	—	0.82	Jul 12, 2012	Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.
CVE-2012-1620	Suckless Slock		0.00	—	0.01	Jul 12, 2012	slock 0.9 does not properly handle the XRaiseWindow event when the screen is locked, which might allow physically proximate attackers to obtain sensitive information by pressing a button, which reveals the desktop and active windows.
CVE-2012-0911	Tiki Tikiwiki CMS\/groupware	Cri	0.72	9.8	0.63	Jul 12, 2012	TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b)…
CVE-2012-3076	Cisco Systems, Inc. Telepresence Recording Server		0.00	—	0.02	Jul 12, 2012	The administrative web interface on Cisco TelePresence Recording Server before 1.8.0 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Bug ID CSCth85804.
CVE-2012-3075	Cisco Systems, Inc. Telepresence System Software		0.00	—	0.02	Jul 12, 2012	The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allows remote authenticated users to execute arbitrary commands via a malformed request on TCP port 443, aka Bug ID CSCtn99724.
CVE-2012-3074	Cisco Systems, Inc. Telepresence System Software		0.00	—	0.01	Jul 12, 2012	An unspecified API on Cisco TelePresence Immersive Endpoint Devices before 1.9.1 allows remote attackers to execute arbitrary commands by leveraging certain adjacency and sending a malformed request on TCP port 61460, aka Bug ID CSCtz38382.
CVE-2012-3073	Cisco Systems, Inc. Telepresence Manager		0.00	—	0.02	Jul 12, 2012	The IP implementation on Cisco TelePresence Multipoint Switch before 1.8.1, Cisco TelePresence Manager before 1.9.0, and Cisco TelePresence Recording Server 1.8 and earlier allows remote attackers to cause a denial of service (networking outage or process crash) via (1)…
CVE-2012-2486	Cisco Systems, Inc. Telepresence Manager		0.00	—	0.02	Jul 12, 2012	The Cisco Discovery Protocol (CDP) implementation on Cisco TelePresence Multipoint Switch before 1.9.0, Cisco TelePresence Immersive Endpoint Devices before 1.9.1, Cisco TelePresence Manager before 1.9.0, and Cisco TelePresence Recording Server before 1.8.1 allows remote…
CVE-2012-3890	Winamp Winamp		0.00	—	0.02	Jul 11, 2012	The in_mod plugin in Winamp before 5.63 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a .IT file.
CVE-2012-3889	Winamp Winamp		0.00	—	0.02	Jul 11, 2012	The in_mod plugin in Winamp before 5.63 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a .IT file.
CVE-2011-4309	Moodle Moodle		0.00	—	0.01	Jul 11, 2012	Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended access restrictions and perform global searches by leveraging the guest role and making a direct request to a URL.
CVE-2011-4308	Moodle Moodle		0.00	—	0.02	Jul 11, 2012	mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors.
CVE-2011-4307	Moodle Moodle		0.00	—	0.01	Jul 11, 2012	Cross-site scripting (XSS) vulnerability in mod/wiki/lang/en/wiki.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the section parameter.
CVE-2011-4306	Moodle Moodle		0.00	—	0.02	Jul 11, 2012	Cross-site scripting (XSS) vulnerability in course/editsection.html in Moodle 1.9.x before 1.9.14 allows remote authenticated users to inject arbitrary web script or HTML via crafted data.
CVE-2011-4305	Moodle Moodle		0.00	—	0.02	Jul 11, 2012	message/refresh.php in Moodle 1.9.x before 1.9.14 allows remote authenticated users to cause a denial of service (infinite request loop) via a URL that specifies a zero wait time for message refreshing.
CVE-2011-4304	Moodle Moodle		0.00	—	0.02	Jul 11, 2012	The chat functionality in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to discover the name of any user via a beep operation.
CVE-2011-4303	Moodle Moodle		0.00	—	0.01	Jul 11, 2012	lib/db/upgrade.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not set the correct registration_hubs.secret value during installation, which allows remote attackers to bypass intended access restrictions by leveraging the hubs feature.
CVE-2011-4302	Moodle Moodle		0.00	—	0.01	Jul 11, 2012	mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value of the openssl_verify function, which allows remote attackers to bypass validation via a crafted certificate.
CVE-2011-4301	Moodle Moodle		0.00	—	0.02	Jul 11, 2012	The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the…
CVE-2011-4300	Moodle Moodle		0.00	—	0.02	Jul 11, 2012	The file_browser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file.
CVE-2011-4299	Moodle Moodle		0.00	—	0.01	Jul 11, 2012	Cross-site scripting (XSS) vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment.
CVE-2011-4298	Moodle Moodle		0.00	—	0.01	Jul 11, 2012	Multiple cross-site request forgery (CSRF) vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data.
CVE-2012-2020	Microfocus Operations Agent		0.08	—	0.65	Jul 11, 2012	Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1326.
CVE-2012-2019	Microfocus Operations Agent		0.08	—	0.65	Jul 11, 2012	Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1325.
CVE-2012-1894	Microsoft Office		0.00	—	0.02	Jul 10, 2012	Microsoft Office for Mac 2011 uses world-writable permissions for the "Applications/Microsoft Office 2011/" directory and certain other directories, which allows local users to gain privileges by placing a Trojan horse executable file in one of these directories, aka "Office for…
CVE-2012-1893	Microsoft Windows		0.00	—	0.02	Jul 10, 2012	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate callback parameters during creation of a hook procedure, which…
CVE-2012-1891	Microsoft Data Access Components	Cri	0.66	9.8	0.29	Jul 10, 2012	Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary code via crafted XML data that triggers access to an uninitialized object in memory, aka "ADO…
CVE-2012-1890	Microsoft Windows		0.00	—	0.02	Jul 10, 2012	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle keyboard-layout files, which allows local users to gain privileges…
CVE-2012-1870	Microsoft Windows		0.01	—	0.10	Jul 10, 2012	The CBC mode in the TLS protocol, as used in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and other products, allows remote web servers to obtain plaintext data by triggering…
CVE-2012-1863	Microsoft Sharepoint Server		0.02	—	0.23	Jul 10, 2012	Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a…
CVE-2012-1862	Microsoft Sharepoint Server		0.01	—	0.11	Jul 10, 2012	Open redirect vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "SharePoint URL Redirection Vulnerability."

CVE-2012-3236Jul 12, 2012
GIMP
Gimp
risk 0.04cvss —epss 0.11
fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated using a long string.
CVE-2012-2844Jul 12, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
The PDF functionality in Google Chrome before 20.0.1132.57 does not properly handle JavaScript code, which allows remote attackers to cause a denial of service (incorrect object access) or possibly have unspecified other impact via a crafted document.
CVE-2012-2843Jul 12, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to layout height tracking.
CVE-2012-2842Jul 12, 2012
Google
Chrome
risk 0.00cvss —epss 0.01
Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to counter handling.
CVE-2012-2614Jul 12, 2012
Lattice
Diamond Programmer
risk 0.03cvss —epss 0.04
Buffer overflow in programmer.exe in Lattice Diamond Programmer 1.4.2 allows user-assisted remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long string in a version attribute of an ispXCF element in an .xcf file.
CVE-2012-1661Jul 12, 2012
Esri
Arcmap
risk 0.05cvss —epss 0.24
ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map (.mxd) file.
CVE-2012-3362Jul 12, 2012
Extplorer
Extplorer
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in eXtplorer 2.1 RC3 and earlier allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an adduser admin action.
CVE-2012-2653Jul 12, 2012
Lawrence Berkeley National Laboratory
Arpwatch
risk 0.00cvss —epss 0.03
arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.
CVE-2012-2351Jul 12, 2012
Mahara (software)
Mahara
risk 0.00cvss —epss 0.02
The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username.
CVE-2012-1174Jul 12, 2012
Linux
Systemd
risk 0.00cvss —epss 0.00
The rm_rf_children function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allows local users to delete arbitrary files via a symlink attack on unspecified files, related to "particular records related with user session."
CVE-2012-1163Jul 12, 2012
Libzip
Libzip
risk 0.00cvss —epss 0.03
Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive, which triggers "improper restrictions of operations within the bounds of a…
CVE-2012-1162Jul 12, 2012
Libzip
Libzip
risk 0.00cvss —epss 0.04
Heap-based buffer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a zip archive with the number of directories set to 0, related to an "incorrect…
CVE-2012-1037Jul 12, 2012
Glpi Project
Glpi
risk 0.00cvss —epss 0.01
PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a URL in the sub_type parameter.
CVE-2012-0215Jul 12, 2012
Tryton
Trytond
risk 0.00cvss —epss 0.02
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2)…
CVE-2012-3996Jul 12, 2012
Tiki
Tikiwiki CMS\/groupware
risk 0.03cvss —epss 0.05
TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or (3) tiki-watershed_service.php.
CVE-2012-3881Jul 12, 2012
Adrian Chadd
Rtg
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in RTG 0.7.4 and RTG2 0.9.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) 95.php, (2) view.php, or (3) rtg.php.
CVE-2012-3805Jul 12, 2012
Kajona
Kajona
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) absender_name, (2) absender_email, or (3) absender_nachricht parameter…
CVE-2012-3399Jul 12, 2012
Artis.imag
Basilic
risk 0.08cvss —epss 0.65
Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter.
CVE-2012-3376Jul 12, 2012
Apache
Hadoop
risk 0.00cvss —epss 0.03
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have…
CVE-2012-2763Jul 12, 2012
GIMP
Gimp
risk 0.10cvss —epss 0.82
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.
CVE-2012-1620Jul 12, 2012
Suckless
Slock
risk 0.00cvss —epss 0.01
slock 0.9 does not properly handle the XRaiseWindow event when the screen is locked, which might allow physically proximate attackers to obtain sensitive information by pressing a button, which reveals the desktop and active windows.
CVE-2012-0911CriJul 12, 2012
Tiki
Tikiwiki CMS\/groupware
risk 0.72cvss 9.8epss 0.63
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b)…
CVE-2012-3076Jul 12, 2012
Cisco Systems, Inc.
Telepresence Recording Server
risk 0.00cvss —epss 0.02
The administrative web interface on Cisco TelePresence Recording Server before 1.8.0 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Bug ID CSCth85804.
CVE-2012-3075Jul 12, 2012
Cisco Systems, Inc.
Telepresence System Software
risk 0.00cvss —epss 0.02
The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allows remote authenticated users to execute arbitrary commands via a malformed request on TCP port 443, aka Bug ID CSCtn99724.
CVE-2012-3074Jul 12, 2012
Cisco Systems, Inc.
Telepresence System Software
risk 0.00cvss —epss 0.01
An unspecified API on Cisco TelePresence Immersive Endpoint Devices before 1.9.1 allows remote attackers to execute arbitrary commands by leveraging certain adjacency and sending a malformed request on TCP port 61460, aka Bug ID CSCtz38382.
CVE-2012-3073Jul 12, 2012
Cisco Systems, Inc.
Telepresence Manager
risk 0.00cvss —epss 0.02
The IP implementation on Cisco TelePresence Multipoint Switch before 1.8.1, Cisco TelePresence Manager before 1.9.0, and Cisco TelePresence Recording Server 1.8 and earlier allows remote attackers to cause a denial of service (networking outage or process crash) via (1)…
CVE-2012-2486Jul 12, 2012
Cisco Systems, Inc.
Telepresence Manager
risk 0.00cvss —epss 0.02
The Cisco Discovery Protocol (CDP) implementation on Cisco TelePresence Multipoint Switch before 1.9.0, Cisco TelePresence Immersive Endpoint Devices before 1.9.1, Cisco TelePresence Manager before 1.9.0, and Cisco TelePresence Recording Server before 1.8.1 allows remote…
CVE-2012-3890Jul 11, 2012
Winamp
Winamp
risk 0.00cvss —epss 0.02
The in_mod plugin in Winamp before 5.63 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a .IT file.
CVE-2012-3889Jul 11, 2012
Winamp
Winamp
risk 0.00cvss —epss 0.02
The in_mod plugin in Winamp before 5.63 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a .IT file.
CVE-2011-4309Jul 11, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended access restrictions and perform global searches by leveraging the guest role and making a direct request to a URL.
CVE-2011-4308Jul 11, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors.
CVE-2011-4307Jul 11, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in mod/wiki/lang/en/wiki.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the section parameter.
CVE-2011-4306Jul 11, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in course/editsection.html in Moodle 1.9.x before 1.9.14 allows remote authenticated users to inject arbitrary web script or HTML via crafted data.
CVE-2011-4305Jul 11, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
message/refresh.php in Moodle 1.9.x before 1.9.14 allows remote authenticated users to cause a denial of service (infinite request loop) via a URL that specifies a zero wait time for message refreshing.
CVE-2011-4304Jul 11, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
The chat functionality in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to discover the name of any user via a beep operation.
CVE-2011-4303Jul 11, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
lib/db/upgrade.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not set the correct registration_hubs.secret value during installation, which allows remote attackers to bypass intended access restrictions by leveraging the hubs feature.
CVE-2011-4302Jul 11, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value of the openssl_verify function, which allows remote attackers to bypass validation via a crafted certificate.
CVE-2011-4301Jul 11, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the…
CVE-2011-4300Jul 11, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
The file_browser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file.
CVE-2011-4299Jul 11, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment.
CVE-2011-4298Jul 11, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data.
CVE-2012-2020Jul 11, 2012
Microfocus
Operations Agent
risk 0.08cvss —epss 0.65
Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1326.
CVE-2012-2019Jul 11, 2012
Microfocus
Operations Agent
risk 0.08cvss —epss 0.65
Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1325.
CVE-2012-1894Jul 10, 2012
Microsoft
Office
risk 0.00cvss —epss 0.02
Microsoft Office for Mac 2011 uses world-writable permissions for the "Applications/Microsoft Office 2011/" directory and certain other directories, which allows local users to gain privileges by placing a Trojan horse executable file in one of these directories, aka "Office for…
CVE-2012-1893Jul 10, 2012
Microsoft
Windows
risk 0.00cvss —epss 0.02
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate callback parameters during creation of a hook procedure, which…
CVE-2012-1891CriJul 10, 2012
Microsoft
Data Access Components
risk 0.66cvss 9.8epss 0.29
Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary code via crafted XML data that triggers access to an uninitialized object in memory, aka "ADO…
CVE-2012-1890Jul 10, 2012
Microsoft
Windows
risk 0.00cvss —epss 0.02
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle keyboard-layout files, which allows local users to gain privileges…
CVE-2012-1870Jul 10, 2012
Microsoft
Windows
risk 0.01cvss —epss 0.10
The CBC mode in the TLS protocol, as used in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and other products, allows remote web servers to obtain plaintext data by triggering…
CVE-2012-1863Jul 10, 2012
Microsoft
Sharepoint Server
risk 0.02cvss —epss 0.23
Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a…
CVE-2012-1862Jul 10, 2012
Microsoft
Sharepoint Server
risk 0.01cvss —epss 0.11
Open redirect vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "SharePoint URL Redirection Vulnerability."