CVEs

346,574 total · page 5941 of 6,932

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2012-0399	Rsa Envision	0.00	—	0.01	Mar 20, 2012	Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1236	Janetter Janetter	0.00	—	0.01	Mar 19, 2012	Multiple cross-site request forgery (CSRF) vulnerabilities in Janetter before 3.3.0.0 (aka 3.3.0) allow remote attackers to hijack the authentication of arbitrary users for requests that (1) tweet, (2) upload an image file, or (3) execute arbitrary commands.
CVE-2012-1181	Apache Mod Fcgid	0.00	—	0.05	Mar 19, 2012	fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests…
CVE-2012-0328	Janetter Janetter	0.00	—	0.02	Mar 19, 2012	Janetter before 3.3.0.0 (aka 3.3.0) allows remote attackers to obtain session information for twitter.com web sites via unspecified vectors.
CVE-2012-1498	Webfolio Webfolio CMS	0.03	—	0.01	Mar 19, 2012	Multiple cross-site request forgery (CSRF) vulnerabilities in Webfolio CMS 1.1.4 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via an add action to admin/users/add or (2) modify a web page via a save…
CVE-2012-1466	Netmechanica Netdecision	0.03	—	0.03	Mar 19, 2012	The Traffic Grapher Server for NetMechanica NetDecision before 4.6.1 allows remote attackers to obtain the source code of NtDecision script files with a .nd extension via an invalid version number in an HTTP request, as demonstrated using default.nd. NOTE: some of these details…
CVE-2012-1465	Netmechanica Netdecision	0.05	—	0.27	Mar 19, 2012	Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of service (application crash) via a long URL in an HTTP request. NOTE: some of these details are obtained from third party information.
CVE-2012-1464	Netmechanica Netdecision	0.03	—	0.03	Mar 19, 2012	Dashboard Server for NetMechanica NetDecision before 4.6.1 allows remote attackers to obtain the installation path via a request with a trailing "?" character, which causes Dashboard to attempt to access a non-existent resource. NOTE: some of these details are obtained from…
CVE-2012-1039	Dotclear Dotclear	0.03	—	0.04	Mar 19, 2012	Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) login_data parameter to admin/auth.php; (2) nb parameter to admin/blogs.php; (3) type, (4) sortby, (5) order, or (6) status…
CVE-2012-0872	Oxwall Oxwall	0.00	—	0.01	Mar 19, 2012	Multiple cross-site scripting (XSS) vulnerabilities in OxWall 1.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) captchaField, (2) email, (3) form_name, (4) password, (5) realname, (6) repeatPassword, or (7) username parameters to…
CVE-2012-0808	Bdale Garbee As31	0.00	—	0.00	Mar 19, 2012	as31 2.3.1-4 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack.
CVE-2012-0054	Golismero Golismero	0.00	—	0.00	Mar 19, 2012	libs/updater.py in GoLismero 0.6.3, and other versions before Git revision 2b3bb43d6867, as used in backtrack and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on GoLismero-controlled files, as demonstrated using Admin/changes.dat.
CVE-2012-1790	Webgrind Project Webgrind	0.03	—	0.05	Mar 19, 2012	Absolute path traversal vulnerability in Webgrind 1.0 and 1.0.2 allows remote attackers to read arbitrary files via a full pathname in the file parameter to index.php.
CVE-2012-1789	Kongreg8 Kongreg8	0.00	—	0.01	Mar 19, 2012	Multiple cross-site scripting (XSS) vulnerabilities in Kongreg8 1.7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) surname or (2) firstname parameters to modules/members/addmember.php; or (3) groupdescription or (4) groupname parameters to…
CVE-2012-1788	Wonderdesk Wonderdesk SQL	0.00	—	0.01	Mar 19, 2012	Multiple cross-site scripting (XSS) vulnerabilities in wonderdesk.cgi in WonderDesk SQL 4.14 allow remote attackers to inject arbitrary web script or HTML via the (1) cus_email parameter in a cust_lostpw action; or (2) help_name, (3) help_email, (4) help_website, or (5)…
CVE-2012-1787	Webglimpse Webglimpse	0.03	—	0.02	Mar 19, 2012	Multiple cross-site scripting (XSS) vulnerabilities in wgarcmin.cgi in Webglimpse 2.20.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) FILE, or (3) DOMAIN parameters.
CVE-2012-1786	WordPress Video Embed Thumbnail Generator	0.00	—	0.02	Mar 19, 2012	The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.
CVE-2012-1785	WordPress Video Embed Thumbnail Generator	0.00	—	0.03	Mar 19, 2012	kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors.
CVE-2012-1784	Myjoblist Myjoblist	0.03	—	0.01	Mar 19, 2012	SQL injection vulnerability in MyJobList 0.1.3 allows remote attackers to execute arbitrary SQL commands via the eid parameter in a profile action to index.php.
CVE-2012-1783	Saurabh Gupta Tiny Server	0.03	—	0.03	Mar 19, 2012	Tiny Server 1.1.9 and earlier allows remote attackers to cause a denial of service (crash) via a long string in a GET request without an HTTP version number.
CVE-2012-1782	Osqa Osqa	0.03	—	0.02	Mar 19, 2012	Multiple cross-site scripting (XSS) vulnerabilities in questions/ask in OSQA 3b allow remote attackers to inject arbitrary web script or HTML via the (1) url bar or (2) picture bar.
CVE-2012-1781	Socialcms Socialcms	0.00	—	0.01	Mar 19, 2012	Multiple cross-site scripting (XSS) vulnerabilities in ajax/commentajax.php in SocialCMS 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) TREF_email_address or (2) TR_name parameters.
CVE-2012-1780	Socialcms Socialcms	0.00	—	0.01	Mar 19, 2012	SQL injection vulnerability in search.php in SocialCMS 1.0.5 allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVE-2012-1779	Idevspot Idev Businessdirectory	0.00	—	0.01	Mar 19, 2012	Cross-site scripting (XSS) vulnerability in IDevSpot idev-BusinessDirectory 3.0 allows remote attackers to inject arbitrary web script or HTML via the SEARCH parameter to index.php.
CVE-2012-1778	Createvision Createvision CMS	0.03	—	0.01	Mar 19, 2012	SQL injection vulnerability in artykul_print.php in CreateVision CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2012-1297	Contao CMS	0.03	—	0.01	Mar 19, 2012	Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete users via a delete action in the user module, (2) delete…
CVE-2011-5083	Dotclear Dotclear	0.00	—	0.03	Mar 19, 2012	Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a file with an executable PHP extension, then accessing it via a direct request to the file in an unspecified directory.
CVE-2011-5082	WordPress S2member Pro	0.00	—	0.02	Mar 19, 2012	Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka Coupon Code field).
CVE-2010-5086	Bitweaver Bitweaver	0.00	—	0.02	Mar 19, 2012	Directory traversal vulnerability in wiki/rankings.php in Bitweaver 2.7 and 2.8.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the style parameter.
CVE-2009-5114	Webglimpse Webglimpse	0.04	—	0.13	Mar 19, 2012	Directory traversal vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the DOC parameter.
CVE-2009-5113	Webglimpse Webglimpse	0.00	—	0.01	Mar 19, 2012	Cross-site scripting (XSS) vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the DOC parameter.
CVE-2009-5112	Webglimpse Webglimpse	0.03	—	0.05	Mar 19, 2012	wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to obtain the installation path via a crafted request.
CVE-2012-1776	VideoLAN VLC media player	0.00	—	0.05	Mar 19, 2012	Multiple heap-based buffer overflows in VideoLAN VLC media player before 2.0.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Real RTSP stream.
CVE-2012-1775	VideoLAN VLC media player	0.07	—	0.44	Mar 19, 2012	Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code via a crafted MMS:// stream.
CVE-2012-1774	Gretech GOM Player	0.04	—	0.07	Mar 18, 2012	Unspecified vulnerability in the Open URL feature in Gretech GOM Media Player before 2.1.39.5101 has unknown impact and attack vectors, a different vulnerability than CVE-2007-5779 and CVE-2012-1264.
CVE-2012-1264	Gretech GOM Player	0.00	—	0.04	Mar 18, 2012	Unspecified vulnerability in Gretech GOM Media Player before 2.1.37.5091 allows remote attackers to execute arbitrary code via a crafted AVI file.
CVE-2012-0326	Tetsuya Aoyama Twicca	0.00	—	0.02	Mar 17, 2012	The twicca application 0.7.0 through 0.9.30 for Android does not properly restrict the use of network privileges, which allows remote attackers to read media files on an SD card via a crafted application.
CVE-2012-0293	Symantec Altiris Wise Package Studio	0.00	—	0.01	Mar 17, 2012	Multiple SQL injection vulnerabilities in Symantec Altiris WISE Package Studio before 8.0MR1 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-1514	VMware Vshield Manager	0.00	—	0.01	Mar 16, 2012	Cross-site request forgery (CSRF) vulnerability in VMware vShield Manager (vSM) 1.0.1 before Update 2 and 4.1.0 before Update 2 allows remote attackers to hijack the authentication of arbitrary users.
CVE-2012-1513	VMware Vcenter Orchestrator	0.00	—	0.01	Mar 16, 2012	The Web Configuration tool in VMware vCenter Orchestrator (vCO) 4.0 before Update 4, 4.1 before Update 2, and 4.2 before Update 1 places the vCenter Server password in an HTML document, which allows remote authenticated administrators to obtain sensitive information by reading…
CVE-2012-1512	VMware Vsphere	0.00	—	0.02	Mar 16, 2012	Cross-site scripting (XSS) vulnerability in the internal browser in vSphere Client in VMware vSphere 4.1 before Update 2 and 5.0 before Update 1 allows remote attackers to inject arbitrary web script or HTML via a crafted log-file entry.
CVE-2012-1511	VMware View	0.00	—	0.02	Mar 16, 2012	Cross-site scripting (XSS) vulnerability in View Manager Portal in VMware View before 4.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2012-1510	VMware Esx	0.00	—	0.00	Mar 16, 2012	Buffer overflow in the WDDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to gain guest OS privileges via unspecified vectors.
CVE-2012-1509	VMware View	0.00	—	0.00	Mar 16, 2012	Buffer overflow in the XPDM display driver in VMware View before 4.6.1 allows guest OS users to gain guest OS privileges via unspecified vectors.
CVE-2012-1508	VMware Esx	0.00	—	0.00	Mar 16, 2012	The XPDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to gain guest OS privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVE-2012-0232	GE Intelligent Platforms Proficy Real-Time Information Portal	0.00	—	0.02	Mar 15, 2012	Directory traversal vulnerability in rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6, 3.0, 3.0 SP1, and 3.5 allows remote attackers to modify the configuration via crafted strings.
CVE-2012-0231	Ge Intelligent Platforms Proficy Plant Applications	0.01	—	0.07	Mar 15, 2012	PRLicenseMgr.exe in the Proficy Server License Manager in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TCP session on port 12401.
CVE-2012-0230	Ge Intelligent Platforms Proficy Plant Applications	0.01	—	0.09	Mar 15, 2012	PRRDS.exe in the Proficy Remote Data Service in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TCP session on port 12299.
CVE-2012-0229	Ge Intelligent Platforms Proficy Historian	0.00	—	0.05	Mar 15, 2012	The Data Archiver service in GE Intelligent Platforms Proficy Historian 4.5 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted session on TCP port 14000 to (1) ihDataArchiver.exe or (2)…
CVE-2012-1485	Netfrontlife Netfront Life Browser	0.00	—	0.02	Mar 15, 2012	Unspecified vulnerability in the NetFront Life Browser (com.access_company.android.nflifebrowser.lite) application 2.2.0 and 2.3.0 for Android has unknown impact and attack vectors.

CVE-2012-0399Mar 20, 2012
Rsa
Envision
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1236Mar 19, 2012
Janetter
Janetter
risk 0.00cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in Janetter before 3.3.0.0 (aka 3.3.0) allow remote attackers to hijack the authentication of arbitrary users for requests that (1) tweet, (2) upload an image file, or (3) execute arbitrary commands.
CVE-2012-1181Mar 19, 2012
Apache
Mod Fcgid
risk 0.00cvss —epss 0.05
fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests…
CVE-2012-0328Mar 19, 2012
Janetter
Janetter
risk 0.00cvss —epss 0.02
Janetter before 3.3.0.0 (aka 3.3.0) allows remote attackers to obtain session information for twitter.com web sites via unspecified vectors.
CVE-2012-1498Mar 19, 2012
Webfolio
Webfolio CMS
risk 0.03cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in Webfolio CMS 1.1.4 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via an add action to admin/users/add or (2) modify a web page via a save…
CVE-2012-1466Mar 19, 2012
Netmechanica
Netdecision
risk 0.03cvss —epss 0.03
The Traffic Grapher Server for NetMechanica NetDecision before 4.6.1 allows remote attackers to obtain the source code of NtDecision script files with a .nd extension via an invalid version number in an HTTP request, as demonstrated using default.nd. NOTE: some of these details…
CVE-2012-1465Mar 19, 2012
Netmechanica
Netdecision
risk 0.05cvss —epss 0.27
Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of service (application crash) via a long URL in an HTTP request. NOTE: some of these details are obtained from third party information.
CVE-2012-1464Mar 19, 2012
Netmechanica
Netdecision
risk 0.03cvss —epss 0.03
Dashboard Server for NetMechanica NetDecision before 4.6.1 allows remote attackers to obtain the installation path via a request with a trailing "?" character, which causes Dashboard to attempt to access a non-existent resource. NOTE: some of these details are obtained from…
CVE-2012-1039Mar 19, 2012
Dotclear
Dotclear
risk 0.03cvss —epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) login_data parameter to admin/auth.php; (2) nb parameter to admin/blogs.php; (3) type, (4) sortby, (5) order, or (6) status…
CVE-2012-0872Mar 19, 2012
Oxwall
Oxwall
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in OxWall 1.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) captchaField, (2) email, (3) form_name, (4) password, (5) realname, (6) repeatPassword, or (7) username parameters to…
CVE-2012-0808Mar 19, 2012
Bdale Garbee
As31
risk 0.00cvss —epss 0.00
as31 2.3.1-4 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack.
CVE-2012-0054Mar 19, 2012
Golismero
Golismero
risk 0.00cvss —epss 0.00
libs/updater.py in GoLismero 0.6.3, and other versions before Git revision 2b3bb43d6867, as used in backtrack and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on GoLismero-controlled files, as demonstrated using Admin/changes.dat.
CVE-2012-1790Mar 19, 2012
Webgrind Project
Webgrind
risk 0.03cvss —epss 0.05
Absolute path traversal vulnerability in Webgrind 1.0 and 1.0.2 allows remote attackers to read arbitrary files via a full pathname in the file parameter to index.php.
CVE-2012-1789Mar 19, 2012
Kongreg8
Kongreg8
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Kongreg8 1.7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) surname or (2) firstname parameters to modules/members/addmember.php; or (3) groupdescription or (4) groupname parameters to…
CVE-2012-1788Mar 19, 2012
Wonderdesk
Wonderdesk SQL
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in wonderdesk.cgi in WonderDesk SQL 4.14 allow remote attackers to inject arbitrary web script or HTML via the (1) cus_email parameter in a cust_lostpw action; or (2) help_name, (3) help_email, (4) help_website, or (5)…
CVE-2012-1787Mar 19, 2012
Webglimpse
Webglimpse
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in wgarcmin.cgi in Webglimpse 2.20.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) FILE, or (3) DOMAIN parameters.
CVE-2012-1786Mar 19, 2012
WordPress
Video Embed Thumbnail Generator
risk 0.00cvss —epss 0.02
The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.
CVE-2012-1785Mar 19, 2012
WordPress
Video Embed Thumbnail Generator
risk 0.00cvss —epss 0.03
kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors.
CVE-2012-1784Mar 19, 2012
Myjoblist
Myjoblist
risk 0.03cvss —epss 0.01
SQL injection vulnerability in MyJobList 0.1.3 allows remote attackers to execute arbitrary SQL commands via the eid parameter in a profile action to index.php.
CVE-2012-1783Mar 19, 2012
Saurabh Gupta
Tiny Server
risk 0.03cvss —epss 0.03
Tiny Server 1.1.9 and earlier allows remote attackers to cause a denial of service (crash) via a long string in a GET request without an HTTP version number.
CVE-2012-1782Mar 19, 2012
Osqa
Osqa
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in questions/ask in OSQA 3b allow remote attackers to inject arbitrary web script or HTML via the (1) url bar or (2) picture bar.
CVE-2012-1781Mar 19, 2012
Socialcms
Socialcms
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in ajax/commentajax.php in SocialCMS 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) TREF_email_address or (2) TR_name parameters.
CVE-2012-1780Mar 19, 2012
Socialcms
Socialcms
risk 0.00cvss —epss 0.01
SQL injection vulnerability in search.php in SocialCMS 1.0.5 allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVE-2012-1779Mar 19, 2012
Idevspot
Idev Businessdirectory
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in IDevSpot idev-BusinessDirectory 3.0 allows remote attackers to inject arbitrary web script or HTML via the SEARCH parameter to index.php.
CVE-2012-1778Mar 19, 2012
Createvision
Createvision CMS
risk 0.03cvss —epss 0.01
SQL injection vulnerability in artykul_print.php in CreateVision CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2012-1297Mar 19, 2012
Contao
CMS
risk 0.03cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete users via a delete action in the user module, (2) delete…
CVE-2011-5083Mar 19, 2012
Dotclear
Dotclear
risk 0.00cvss —epss 0.03
Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a file with an executable PHP extension, then accessing it via a direct request to the file in an unspecified directory.
CVE-2011-5082Mar 19, 2012
WordPress
S2member Pro
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka Coupon Code field).
CVE-2010-5086Mar 19, 2012
Bitweaver
Bitweaver
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in wiki/rankings.php in Bitweaver 2.7 and 2.8.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the style parameter.
CVE-2009-5114Mar 19, 2012
Webglimpse
Webglimpse
risk 0.04cvss —epss 0.13
Directory traversal vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the DOC parameter.
CVE-2009-5113Mar 19, 2012
Webglimpse
Webglimpse
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the DOC parameter.
CVE-2009-5112Mar 19, 2012
Webglimpse
Webglimpse
risk 0.03cvss —epss 0.05
wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to obtain the installation path via a crafted request.
CVE-2012-1776Mar 19, 2012
VideoLAN
VLC media player
risk 0.00cvss —epss 0.05
Multiple heap-based buffer overflows in VideoLAN VLC media player before 2.0.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Real RTSP stream.
CVE-2012-1775Mar 19, 2012
VideoLAN
VLC media player
risk 0.07cvss —epss 0.44
Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code via a crafted MMS:// stream.
CVE-2012-1774Mar 18, 2012
Gretech
GOM Player
risk 0.04cvss —epss 0.07
Unspecified vulnerability in the Open URL feature in Gretech GOM Media Player before 2.1.39.5101 has unknown impact and attack vectors, a different vulnerability than CVE-2007-5779 and CVE-2012-1264.
CVE-2012-1264Mar 18, 2012
Gretech
GOM Player
risk 0.00cvss —epss 0.04
Unspecified vulnerability in Gretech GOM Media Player before 2.1.37.5091 allows remote attackers to execute arbitrary code via a crafted AVI file.
CVE-2012-0326Mar 17, 2012
Tetsuya Aoyama
Twicca
risk 0.00cvss —epss 0.02
The twicca application 0.7.0 through 0.9.30 for Android does not properly restrict the use of network privileges, which allows remote attackers to read media files on an SD card via a crafted application.
CVE-2012-0293Mar 17, 2012
Symantec
Altiris Wise Package Studio
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in Symantec Altiris WISE Package Studio before 8.0MR1 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-1514Mar 16, 2012
VMware
Vshield Manager
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in VMware vShield Manager (vSM) 1.0.1 before Update 2 and 4.1.0 before Update 2 allows remote attackers to hijack the authentication of arbitrary users.
CVE-2012-1513Mar 16, 2012
VMware
Vcenter Orchestrator
risk 0.00cvss —epss 0.01
The Web Configuration tool in VMware vCenter Orchestrator (vCO) 4.0 before Update 4, 4.1 before Update 2, and 4.2 before Update 1 places the vCenter Server password in an HTML document, which allows remote authenticated administrators to obtain sensitive information by reading…
CVE-2012-1512Mar 16, 2012
VMware
Vsphere
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the internal browser in vSphere Client in VMware vSphere 4.1 before Update 2 and 5.0 before Update 1 allows remote attackers to inject arbitrary web script or HTML via a crafted log-file entry.
CVE-2012-1511Mar 16, 2012
VMware
View
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in View Manager Portal in VMware View before 4.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2012-1510Mar 16, 2012
VMware
Esx
risk 0.00cvss —epss 0.00
Buffer overflow in the WDDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to gain guest OS privileges via unspecified vectors.
CVE-2012-1509Mar 16, 2012
VMware
View
risk 0.00cvss —epss 0.00
Buffer overflow in the XPDM display driver in VMware View before 4.6.1 allows guest OS users to gain guest OS privileges via unspecified vectors.
CVE-2012-1508Mar 16, 2012
VMware
Esx
risk 0.00cvss —epss 0.00
The XPDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to gain guest OS privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVE-2012-0232Mar 15, 2012
GE Intelligent Platforms
Proficy Real-Time Information Portal
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6, 3.0, 3.0 SP1, and 3.5 allows remote attackers to modify the configuration via crafted strings.
CVE-2012-0231Mar 15, 2012
Ge
Intelligent Platforms Proficy Plant Applications
risk 0.01cvss —epss 0.07
PRLicenseMgr.exe in the Proficy Server License Manager in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TCP session on port 12401.
CVE-2012-0230Mar 15, 2012
Ge
Intelligent Platforms Proficy Plant Applications
risk 0.01cvss —epss 0.09
PRRDS.exe in the Proficy Remote Data Service in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TCP session on port 12299.
CVE-2012-0229Mar 15, 2012
Ge
Intelligent Platforms Proficy Historian
risk 0.00cvss —epss 0.05
The Data Archiver service in GE Intelligent Platforms Proficy Historian 4.5 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted session on TCP port 14000 to (1) ihDataArchiver.exe or (2)…
CVE-2012-1485Mar 15, 2012
Netfrontlife
Netfront Life Browser
risk 0.00cvss —epss 0.02
Unspecified vulnerability in the NetFront Life Browser (com.access_company.android.nflifebrowser.lite) application 2.2.0 and 2.3.0 for Android has unknown impact and attack vectors.