CVEs

347,024 total · page 5929 of 6,941

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2012-2718	Drupal Counter Module	0.00	—	0.02	Jun 21, 2012	SQL injection vulnerability in the Counter module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "recording visits."
CVE-2012-2716	Drupal Comment Moderation	0.00	—	0.01	Jun 21, 2012	Cross-site request forgery (CSRF) vulnerability in the Comment Moderation module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to hijack the authentication of administrators for requests that publish comments.
CVE-2012-2654	OpenStack Essex	0.00	—	0.03	Jun 21, 2012	The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to…
CVE-2012-2389	W1.fi Hostapd	0.00	—	0.00	Jun 21, 2012	hostapd 0.7.3, and possibly other versions before 1.0, uses 0644 permissions for /etc/hostapd/hostapd.conf, which might allow local users to obtain sensitive information such as credentials.
CVE-2012-2149	Libwpd Libwpd	0.01	—	0.13	Jun 21, 2012	The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8, as used by OpenOffice.org (OOo) before 3.4, allows remote attackers to execute arbitrary code via a crafted Wordperfect .WPD document that causes a negative array index to be used. NOTE:…
CVE-2012-1616	Color (software) Icclib	0.00	—	0.05	Jun 21, 2012	Use-after-free vulnerability in icclib before 2.13, as used by Argyll CMS before 1.4 and possibly other programs, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted ICC profile file.
CVE-2012-1149	Libreoffice Libreoffice	0.01	—	0.14	Jun 21, 2012	Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object,…
CVE-2012-0219	Socat Socat	0.00	—	0.00	Jun 21, 2012	Heap-based buffer overflow in the xioscan_readline function in xio-readline.c in socat 1.4.0.0 through 1.7.2.0 and 2.0.0-b1 through 2.0.0-b4 allows local users to execute arbitrary code via the READLINE address.
CVE-2011-4599	Unicode International Components for Unicode	0.01	—	0.08	Jun 21, 2012	Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.
CVE-2011-2709	Libgssglue libgssglue	0.00	—	0.00	Jun 21, 2012	libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.
CVE-2011-2527	QEMU Qemu	0.00	—	0.00	Jun 21, 2012	The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.
CVE-2011-2512	QEMU Qemu	0.00	—	0.02	Jun 21, 2012	The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number, which allows guest users to cause a denial of service (guest crash) and possibly execute arbitrary code via a negative number in the Queue Notify field of the Virtio Header,…
CVE-2011-2212	QEMU Qemu	0.00	—	0.01	Jun 21, 2012	Buffer overflow in the virtio subsystem in qemu-kvm 0.14.0 and earlier allows privileged guest users to cause a denial of service (guest crash) or gain privileges via a crafted indirect descriptor related to "virtqueue in and out requests."
CVE-2011-1751	QEMU Qemu	0.00	—	0.01	Jun 21, 2012	The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute…
CVE-2011-1750	QEMU Qemu	0.00	—	0.01	Jun 21, 2012	Multiple heap-based buffer overflows in the virtio-blk driver (hw/virtio-blk.c) in qemu-kvm 0.14.0 allow local guest users to cause a denial of service (guest crash) and possibly gain privileges via a (1) write request to the virtio_blk_handle_write function or (2) read request…
CVE-2011-0011	QEMU Qemu	0.00	—	0.01	Jun 21, 2012	qemu-kvm before 0.11.0 disables VNC authentication when the password is cleared, which allows remote attackers to bypass authentication and establish VNC sessions.
CVE-2012-3063	Cisco Systems, Inc. Application Control Engine Software	0.00	—	0.01	Jun 20, 2012	Cisco Application Control Engine (ACE) before A4(2.3) and A5 before A5(1.1), when multicontext mode is enabled, does not properly share a management IP address among multiple contexts, which allows remote authenticated administrators to bypass intended access restrictions in…
CVE-2012-3058	Cisco Systems, Inc. Cisco Adaptive Security Appliance	0.00	—	0.02	Jun 20, 2012	Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.4 before 8.4(4.1), 8.5 before 8.5(1.11), and 8.6 before 8.6(1.3) allow remote attackers to cause a denial of service (device…
CVE-2012-2496	Cisco Systems, Inc. Anyconnect Secure Mobility Client	0.00	—	0.02	Jun 20, 2012	A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR7 on 64-bit Linux platforms does not properly restrict use of Java components, which allows remote attackers to execute arbitrary code…
CVE-2012-2495	Cisco Systems, Inc. Secure Desktop	0.00	—	0.01	Jun 20, 2012	The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a…
CVE-2012-2494	Cisco Systems, Inc. Anyconnect Secure Mobility Client	0.00	—	0.01	Jun 20, 2012	The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 and 3.x before 3.0 MR8 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a…
CVE-2012-2493	Cisco Systems, Inc. Anyconnect Secure Mobility Client	0.00	—	0.04	Jun 20, 2012	The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 on Windows, and 2.x before 2.5 MR6 and 3.x before 3.0 MR8 on Mac OS X and Linux, does not properly validate binaries that are received by the downloader…
CVE-2011-5095	OpenSSL Project OpenSSL	0.00	—	0.02	Jun 20, 2012	The Diffie-Hellman key-exchange implementation in OpenSSL 0.9.8, when FIPS mode is enabled, does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a related issue to…
CVE-2011-1923	Polarssl Polarssl	0.00	—	0.01	Jun 20, 2012	The Diffie-Hellman key-exchange implementation in dhm.c in PolarSSL before 0.14.2 does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a related issue to CVE-2011-5095.
CVE-2012-3790	Adiscon Loganalyzer	0.00	—	0.01	Jun 20, 2012	Cross-site scripting (XSS) vulnerability in index.php in Adiscon LogAnalyzer before 3.4.4 and 3.5.x before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter in a Search action.
CVE-2012-2192	IBM Aix	0.00	—	0.00	Jun 20, 2012	The socketpair function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.1.4-FP-25 SP-02 allows local users to cause a denial of service (system crash) via a crafted application that leverages the presence of a socket on the free list.
CVE-2012-2180	IBM Db2	0.00	—	0.02	Jun 20, 2012	The chaining functionality in the Distributed Relational Database Architecture (DRDA) module in IBM DB2 9.7 before FP6 and 9.8 before FP5 allows remote attackers to cause a denial of service (NULL pointer dereference, and resource consumption or daemon crash) via a crafted…
CVE-2012-2175	IBM Lotus Inotes	0.05	—	0.29	Jun 20, 2012	Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a long argument.
CVE-2012-2174	IBM Lotus Notes	0.06	—	0.38	Jun 20, 2012	The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.
CVE-2012-2173	IBM Security Appscan Source	0.00	—	0.01	Jun 20, 2012	The ODBC driver in IBM Security AppScan Source 7.x and 8.x before 8.6 sends an SHA-1 hash of the connection password during connections to a solidDB database, which allows remote attackers to obtain sensitive information by sniffing the network.
CVE-2012-2170	IBM Websphere Application Server	0.00	—	0.02	Jun 20, 2012	The Application Snoop Servlet in IBM WebSphere Application Server 7.0 before 7.0.0.23 does not properly restrict access, which allows remote attackers to obtain sensitive client and request information via a direct request.
CVE-2012-2161	IBM Spss Data Collection	0.00	—	0.02	Jun 20, 2012	Cross-site scripting (XSS) vulnerability in deferredView.jsp in IBM Eclipse Help System (IEHS), as used in IBM Security AppScan Source 7.x and 8.x before 8.6 and IBM SPSS Data Collection Developer Library 6.0 and 6.0.1, allows remote attackers to inject arbitrary web script or…
CVE-2012-2159	IBM Spss Data Collection	0.00	—	0.02	Jun 20, 2012	Open redirect vulnerability in IBM Eclipse Help System (IEHS), as used in IBM Security AppScan Source 7.x and 8.x before 8.6 and IBM SPSS Data Collection Developer Library 6.0 and 6.0.1, allows remote attackers to redirect users to arbitrary web sites and conduct phishing…
CVE-2012-0720	IBM Websphere Application Server	0.00	—	0.02	Jun 20, 2012	Cross-site scripting (XSS) vulnerability in the Integration Solution Console in the Administration Console in IBM WebSphere Application Server 7.0 before 7.0.0.23 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2012-0717	IBM Websphere Application Server	0.00	—	0.01	Jun 20, 2012	IBM WebSphere Application Server 7.0 before 7.0.0.23, when a certain SSLv2 configuration with client authentication is used, allows remote attackers to bypass X.509 client-certificate authentication via unspecified vectors.
CVE-2012-0716	IBM Websphere Application Server	0.00	—	0.02	Jun 20, 2012	Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server 7.0 before 7.0.0.23 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-3588	WordPress Plugin Newsletter Plugin	0.04	—	0.11	Jun 19, 2012	Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.
CVE-2012-3587	Debian Advanced Package Tool	0.00	—	0.02	Jun 19, 2012	APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack.
CVE-2012-3553	Asterisk Asterisk Open Source	0.00	—	0.02	Jun 19, 2012	chan_skinny.c in the Skinny (aka SCCP) channel driver in Asterisk Open Source 10.x before 10.5.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by sending a Station Key Pad Button message and closing a connection in…
CVE-2012-2753	Checkpoint Endpoint Connect	0.00	—	0.00	Jun 19, 2012	Untrusted search path vulnerability in TrGUI.exe in the Endpoint Connect (aka EPC) GUI in Check Point Endpoint Security R73.x and E80.x on the VPN blade platform, Endpoint Security VPN R75, Endpoint Connect R73.x, and Remote Access Clients E75.x allows local users to gain…
CVE-2012-2334	Libreoffice Libreoffice	0.01	—	0.13	Jun 19, 2012	Integer overflow in filter/source/msfilter/msdffimp.cxx in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the length of an Escher…
CVE-2012-0954	Debian Advanced Package Tool	0.00	—	0.02	Jun 19, 2012	APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this…
CVE-2012-0950	Ubuntu Update Manager	0.00	—	0.02	Jun 19, 2012	The Apport hook (DistUpgradeApport.py) in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uploads the /var/log/dist-upgrade directory when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report. …
CVE-2012-0802	Spamdyke Spamdyke	0.00	—	0.05	Jun 19, 2012	Multiple buffer overflows in Spamdyke before 4.3.0 might allow remote attackers to execute arbitrary code via vectors related to "serious errors in the usage of snprintf()/vsnprintf()" in which the return values may be larger than the size of the buffer.
CVE-2009-0695	Wyse Device Manager	0.09	—	0.69	Jun 19, 2012	hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action.
CVE-2009-0693	Wyse Device Manager	0.04	—	0.13	Jun 19, 2012	Multiple buffer overflows in Wyse Device Manager (WDM) 4.7.x allow remote attackers to execute arbitrary code via (1) the User-Agent HTTP header to hserver.dll or (2) unspecified input to hagent.exe.
CVE-2012-3006	Phoenixcontact mGuard Smart HW	0.00	—	0.01	Jun 19, 2012	The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS, mGuard delta HW before HW-103060 and BD before BD-211010, mGuard PCI, mGuard blade, and EAGLE mGuard appliances with software before 7.5.0 do not use a sufficient source of entropy for…
CVE-2012-2638	SmallPICT SmallPICT	0.00	—	0.01	Jun 19, 2012	Cross-site scripting (XSS) vulnerability in SmallPICT.cgi in SmallPICT before 2.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-2637	Kent Web Web Patio	0.00	—	0.01	Jun 19, 2012	Cross-site scripting (XSS) vulnerability in KENT-WEB WEB PATIO 4.04 and earlier might allow remote attackers to inject arbitrary web script or HTML via a crafted cookie.
CVE-2012-2636	Kent Web Web Patio	0.00	—	0.01	Jun 19, 2012	Cross-site scripting (XSS) vulnerability in KENT-WEB WEB PATIO 4.04 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2012-2718Jun 21, 2012
Drupal
Counter Module
risk 0.00cvss —epss 0.02
SQL injection vulnerability in the Counter module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "recording visits."
CVE-2012-2716Jun 21, 2012
Drupal
Comment Moderation
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in the Comment Moderation module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to hijack the authentication of administrators for requests that publish comments.
CVE-2012-2654Jun 21, 2012
OpenStack
Essex
risk 0.00cvss —epss 0.03
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to…
CVE-2012-2389Jun 21, 2012
W1.fi
Hostapd
risk 0.00cvss —epss 0.00
hostapd 0.7.3, and possibly other versions before 1.0, uses 0644 permissions for /etc/hostapd/hostapd.conf, which might allow local users to obtain sensitive information such as credentials.
CVE-2012-2149Jun 21, 2012
Libwpd
Libwpd
risk 0.01cvss —epss 0.13
The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8, as used by OpenOffice.org (OOo) before 3.4, allows remote attackers to execute arbitrary code via a crafted Wordperfect .WPD document that causes a negative array index to be used. NOTE:…
CVE-2012-1616Jun 21, 2012
Color (software)
Icclib
risk 0.00cvss —epss 0.05
Use-after-free vulnerability in icclib before 2.13, as used by Argyll CMS before 1.4 and possibly other programs, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted ICC profile file.
CVE-2012-1149Jun 21, 2012
Libreoffice
Libreoffice
risk 0.01cvss —epss 0.14
Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object,…
CVE-2012-0219Jun 21, 2012
Socat
Socat
risk 0.00cvss —epss 0.00
Heap-based buffer overflow in the xioscan_readline function in xio-readline.c in socat 1.4.0.0 through 1.7.2.0 and 2.0.0-b1 through 2.0.0-b4 allows local users to execute arbitrary code via the READLINE address.
CVE-2011-4599Jun 21, 2012
Unicode
International Components for Unicode
risk 0.01cvss —epss 0.08
Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.
CVE-2011-2709Jun 21, 2012
Libgssglue
libgssglue
risk 0.00cvss —epss 0.00
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.
CVE-2011-2527Jun 21, 2012
QEMU
Qemu
risk 0.00cvss —epss 0.00
The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.
CVE-2011-2512Jun 21, 2012
QEMU
Qemu
risk 0.00cvss —epss 0.02
The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number, which allows guest users to cause a denial of service (guest crash) and possibly execute arbitrary code via a negative number in the Queue Notify field of the Virtio Header,…
CVE-2011-2212Jun 21, 2012
QEMU
Qemu
risk 0.00cvss —epss 0.01
Buffer overflow in the virtio subsystem in qemu-kvm 0.14.0 and earlier allows privileged guest users to cause a denial of service (guest crash) or gain privileges via a crafted indirect descriptor related to "virtqueue in and out requests."
CVE-2011-1751Jun 21, 2012
QEMU
Qemu
risk 0.00cvss —epss 0.01
The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute…
CVE-2011-1750Jun 21, 2012
QEMU
Qemu
risk 0.00cvss —epss 0.01
Multiple heap-based buffer overflows in the virtio-blk driver (hw/virtio-blk.c) in qemu-kvm 0.14.0 allow local guest users to cause a denial of service (guest crash) and possibly gain privileges via a (1) write request to the virtio_blk_handle_write function or (2) read request…
CVE-2011-0011Jun 21, 2012
QEMU
Qemu
risk 0.00cvss —epss 0.01
qemu-kvm before 0.11.0 disables VNC authentication when the password is cleared, which allows remote attackers to bypass authentication and establish VNC sessions.
CVE-2012-3063Jun 20, 2012
Cisco Systems, Inc.
Application Control Engine Software
risk 0.00cvss —epss 0.01
Cisco Application Control Engine (ACE) before A4(2.3) and A5 before A5(1.1), when multicontext mode is enabled, does not properly share a management IP address among multiple contexts, which allows remote authenticated administrators to bypass intended access restrictions in…
CVE-2012-3058Jun 20, 2012
Cisco Systems, Inc.
Cisco Adaptive Security Appliance
risk 0.00cvss —epss 0.02
Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.4 before 8.4(4.1), 8.5 before 8.5(1.11), and 8.6 before 8.6(1.3) allow remote attackers to cause a denial of service (device…
CVE-2012-2496Jun 20, 2012
Cisco Systems, Inc.
Anyconnect Secure Mobility Client
risk 0.00cvss —epss 0.02
A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR7 on 64-bit Linux platforms does not properly restrict use of Java components, which allows remote attackers to execute arbitrary code…
CVE-2012-2495Jun 20, 2012
Cisco Systems, Inc.
Secure Desktop
risk 0.00cvss —epss 0.01
The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a…
CVE-2012-2494Jun 20, 2012
Cisco Systems, Inc.
Anyconnect Secure Mobility Client
risk 0.00cvss —epss 0.01
The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 and 3.x before 3.0 MR8 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a…
CVE-2012-2493Jun 20, 2012
Cisco Systems, Inc.
Anyconnect Secure Mobility Client
risk 0.00cvss —epss 0.04
The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 on Windows, and 2.x before 2.5 MR6 and 3.x before 3.0 MR8 on Mac OS X and Linux, does not properly validate binaries that are received by the downloader…
CVE-2011-5095Jun 20, 2012
OpenSSL Project
OpenSSL
risk 0.00cvss —epss 0.02
The Diffie-Hellman key-exchange implementation in OpenSSL 0.9.8, when FIPS mode is enabled, does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a related issue to…
CVE-2011-1923Jun 20, 2012
Polarssl
Polarssl
risk 0.00cvss —epss 0.01
The Diffie-Hellman key-exchange implementation in dhm.c in PolarSSL before 0.14.2 does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a related issue to CVE-2011-5095.
CVE-2012-3790Jun 20, 2012
Adiscon
Loganalyzer
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.php in Adiscon LogAnalyzer before 3.4.4 and 3.5.x before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter in a Search action.
CVE-2012-2192Jun 20, 2012
IBM
Aix
risk 0.00cvss —epss 0.00
The socketpair function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.1.4-FP-25 SP-02 allows local users to cause a denial of service (system crash) via a crafted application that leverages the presence of a socket on the free list.
CVE-2012-2180Jun 20, 2012
IBM
Db2
risk 0.00cvss —epss 0.02
The chaining functionality in the Distributed Relational Database Architecture (DRDA) module in IBM DB2 9.7 before FP6 and 9.8 before FP5 allows remote attackers to cause a denial of service (NULL pointer dereference, and resource consumption or daemon crash) via a crafted…
CVE-2012-2175Jun 20, 2012
IBM
Lotus Inotes
risk 0.05cvss —epss 0.29
Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a long argument.
CVE-2012-2174Jun 20, 2012
IBM
Lotus Notes
risk 0.06cvss —epss 0.38
The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.
CVE-2012-2173Jun 20, 2012
IBM
Security Appscan Source
risk 0.00cvss —epss 0.01
The ODBC driver in IBM Security AppScan Source 7.x and 8.x before 8.6 sends an SHA-1 hash of the connection password during connections to a solidDB database, which allows remote attackers to obtain sensitive information by sniffing the network.
CVE-2012-2170Jun 20, 2012
IBM
Websphere Application Server
risk 0.00cvss —epss 0.02
The Application Snoop Servlet in IBM WebSphere Application Server 7.0 before 7.0.0.23 does not properly restrict access, which allows remote attackers to obtain sensitive client and request information via a direct request.
CVE-2012-2161Jun 20, 2012
IBM
Spss Data Collection
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in deferredView.jsp in IBM Eclipse Help System (IEHS), as used in IBM Security AppScan Source 7.x and 8.x before 8.6 and IBM SPSS Data Collection Developer Library 6.0 and 6.0.1, allows remote attackers to inject arbitrary web script or…
CVE-2012-2159Jun 20, 2012
IBM
Spss Data Collection
risk 0.00cvss —epss 0.02
Open redirect vulnerability in IBM Eclipse Help System (IEHS), as used in IBM Security AppScan Source 7.x and 8.x before 8.6 and IBM SPSS Data Collection Developer Library 6.0 and 6.0.1, allows remote attackers to redirect users to arbitrary web sites and conduct phishing…
CVE-2012-0720Jun 20, 2012
IBM
Websphere Application Server
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the Integration Solution Console in the Administration Console in IBM WebSphere Application Server 7.0 before 7.0.0.23 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2012-0717Jun 20, 2012
IBM
Websphere Application Server
risk 0.00cvss —epss 0.01
IBM WebSphere Application Server 7.0 before 7.0.0.23, when a certain SSLv2 configuration with client authentication is used, allows remote attackers to bypass X.509 client-certificate authentication via unspecified vectors.
CVE-2012-0716Jun 20, 2012
IBM
Websphere Application Server
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server 7.0 before 7.0.0.23 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-3588Jun 19, 2012
WordPress
Plugin Newsletter Plugin
risk 0.04cvss —epss 0.11
Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.
CVE-2012-3587Jun 19, 2012
Debian
Advanced Package Tool
risk 0.00cvss —epss 0.02
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack.
CVE-2012-3553Jun 19, 2012
Asterisk
Asterisk Open Source
risk 0.00cvss —epss 0.02
chan_skinny.c in the Skinny (aka SCCP) channel driver in Asterisk Open Source 10.x before 10.5.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by sending a Station Key Pad Button message and closing a connection in…
CVE-2012-2753Jun 19, 2012
Checkpoint
Endpoint Connect
risk 0.00cvss —epss 0.00
Untrusted search path vulnerability in TrGUI.exe in the Endpoint Connect (aka EPC) GUI in Check Point Endpoint Security R73.x and E80.x on the VPN blade platform, Endpoint Security VPN R75, Endpoint Connect R73.x, and Remote Access Clients E75.x allows local users to gain…
CVE-2012-2334Jun 19, 2012
Libreoffice
Libreoffice
risk 0.01cvss —epss 0.13
Integer overflow in filter/source/msfilter/msdffimp.cxx in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the length of an Escher…
CVE-2012-0954Jun 19, 2012
Debian
Advanced Package Tool
risk 0.00cvss —epss 0.02
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this…
CVE-2012-0950Jun 19, 2012
Ubuntu
Update Manager
risk 0.00cvss —epss 0.02
The Apport hook (DistUpgradeApport.py) in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uploads the /var/log/dist-upgrade directory when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report. …
CVE-2012-0802Jun 19, 2012
Spamdyke
Spamdyke
risk 0.00cvss —epss 0.05
Multiple buffer overflows in Spamdyke before 4.3.0 might allow remote attackers to execute arbitrary code via vectors related to "serious errors in the usage of snprintf()/vsnprintf()" in which the return values may be larger than the size of the buffer.
CVE-2009-0695Jun 19, 2012
Wyse
Device Manager
risk 0.09cvss —epss 0.69
hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action.
CVE-2009-0693Jun 19, 2012
Wyse
Device Manager
risk 0.04cvss —epss 0.13
Multiple buffer overflows in Wyse Device Manager (WDM) 4.7.x allow remote attackers to execute arbitrary code via (1) the User-Agent HTTP header to hserver.dll or (2) unspecified input to hagent.exe.
CVE-2012-3006Jun 19, 2012
Phoenixcontact
mGuard Smart HW
risk 0.00cvss —epss 0.01
The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS, mGuard delta HW before HW-103060 and BD before BD-211010, mGuard PCI, mGuard blade, and EAGLE mGuard appliances with software before 7.5.0 do not use a sufficient source of entropy for…
CVE-2012-2638Jun 19, 2012
SmallPICT
SmallPICT
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in SmallPICT.cgi in SmallPICT before 2.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-2637Jun 19, 2012
Kent Web
Web Patio
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in KENT-WEB WEB PATIO 4.04 and earlier might allow remote attackers to inject arbitrary web script or HTML via a crafted cookie.
CVE-2012-2636Jun 19, 2012
Kent Web
Web Patio
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in KENT-WEB WEB PATIO 4.04 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.