CVEs

346,511 total · page 5948 of 6,931

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2012-0758	Adobe Inc. Shockwave Player		0.00	—	0.06	Feb 15, 2012	Heap-based buffer overflow in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2012-0757	Adobe Inc. Shockwave Player		0.00	—	0.04	Feb 15, 2012	The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0760, CVE-2012-0761, CVE-2012-0762,…
CVE-2012-0155	Microsoft Internet Explorer		0.05	—	0.66	Feb 14, 2012	Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "VML Remote Code Execution Vulnerability."
CVE-2012-0154	Microsoft Windows		0.00	—	0.02	Feb 14, 2012	Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted…
CVE-2012-0150	Microsoft Windows		0.02	—	0.24	Feb 14, 2012	Buffer overflow in msvcrt.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted media file, aka "Msvcrt.dll Buffer Overflow Vulnerability."
CVE-2012-0149	Microsoft Windows Server 2003		0.00	—	0.02	Feb 14, 2012	afd.sys in the Ancillary Function Driver in Microsoft Windows Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege…
CVE-2012-0148	Microsoft Windows		0.00	—	0.02	Feb 14, 2012	afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 on 64-bit platforms does not properly validate user-mode input passed to kernel mode, which…
CVE-2012-0145	Microsoft Sharepoint Server		0.01	—	0.18	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in wizardlist.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in…
CVE-2012-0144	Microsoft Sharepoint Server		0.01	—	0.18	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in themeweb.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in…
CVE-2012-0138	Microsoft Visio Viewer		0.02	—	0.20	Feb 14, 2012	Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability…
CVE-2012-0137	Microsoft Visio Viewer		0.02	—	0.20	Feb 14, 2012	Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability…
CVE-2012-0136	Microsoft Visio Viewer		0.02	—	0.20	Feb 14, 2012	Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability…
CVE-2012-0020	Microsoft Visio Viewer		0.02	—	0.20	Feb 14, 2012	Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability…
CVE-2012-0019	Microsoft Visio Viewer		0.02	—	0.20	Feb 14, 2012	Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability…
CVE-2012-0017	Microsoft Sharepoint Foundation		0.01	—	0.18	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in inplview.aspx in Microsoft SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in inplview.aspx Vulnerability."
CVE-2012-0015	Microsoft .net Framework		0.02	—	0.24	Feb 14, 2012	Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly calculate the length of an unspecified buffer, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET…
CVE-2012-0014	Microsoft .net Framework	Hig	0.53	7.8	0.28	Feb 14, 2012	Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.1.10111, does not properly restrict access to memory associated with unmanaged objects, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a…
CVE-2012-0012	Microsoft Internet Explorer		0.01	—	0.17	Feb 14, 2012	Microsoft Internet Explorer 9 does not properly handle the creation and initialization of string objects, which allows remote attackers to read data from arbitrary process-memory locations via a crafted web site, aka "Null Byte Information Disclosure Vulnerability."
CVE-2012-0011	Microsoft Internet Explorer		0.02	—	0.27	Feb 14, 2012	Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "HTML Layout Remote Code Execution Vulnerability."
CVE-2012-0010	Microsoft Internet Explorer		0.01	—	0.14	Feb 14, 2012	Microsoft Internet Explorer 6 through 9 does not properly perform copy-and-paste operations, which allows user-assisted remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Copy and Paste Information Disclosure Vulnerability."
CVE-2010-5085	Hulihan Amethyst		0.00	—	0.01	Feb 14, 2012	Multiple cross-site request forgery (CSRF) vulnerabilities in admin/update_user in Hulihan Amethyst 0.1.5, and possibly earlier, allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrative password or (2) change the…
CVE-2010-5084	E107 E107		0.00	—	0.01	Feb 14, 2012	The cross-site request forgery (CSRF) protection mechanism in e107 before 0.7.23 uses a predictable random token based on the creation date of the administrator account, which allows remote attackers to hijack the authentication of administrators for requests that add new users…
CVE-2010-5083	PHP-Nuke Web_Links module		0.03	—	0.01	Feb 14, 2012	SQL injection vulnerability in the Web_Links module for PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the url parameter in an Add action to modules.php.
CVE-2012-1087	TYPO3 bc_post2facebook		0.00	—	0.01	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1086	TYPO3 Aeurltool		0.00	—	0.01	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in the UrlTool (aeurltool) extension 0.1.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1085	TYPO3 Beuserswitch		0.00	—	0.01	Feb 14, 2012	Unspecified vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.
CVE-2012-1084	TYPO3 Beuserswitch		0.00	—	0.01	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1083	TYPO3 Terminal		0.00	—	0.01	Feb 14, 2012	Cross-site request forgery (CSRF) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2012-1082	TYPO3 Terminal		0.00	—	0.01	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1081	TYPO3 Yet another Google search		0.00	—	0.01	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in the Yet another Google search (ya_googlesearch) extension before 0.3.10 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1080	TYPO3 Euro Calculator (skt_eurocalc)		0.00	—	0.01	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in the Euro Calculator (skt_eurocalc) extension 0.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1079	TYPO3 typo3_webservice		0.00	—	0.02	Feb 14, 2012	Unspecified vulnerability in the Webservices for TYPO3 (typo3_webservice) extension before 0.3.8 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors.
CVE-2012-1078	TYPO3 sysutils		0.00	—	0.01	Feb 14, 2012	The System Utilities (sysutils) extension 1.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unspecified vectors related to improper "protection" of the "backup output directory."
CVE-2012-1077	TYPO3 bc_post2facebook		0.00	—	0.01	Feb 14, 2012	SQL injection vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-1076	TYPO3 rtg_files		0.00	—	0.01	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1075	TYPO3 rtg_files		0.00	—	0.01	Feb 14, 2012	SQL injection vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-1074	TYPO3 White Papers		0.00	—	0.01	Feb 14, 2012	SQL injection vulnerability in the White Papers (mm_whtppr) extension 0.0.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-1073	TYPO3 Toi Category		0.00	—	0.01	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1072	TYPO3 Category-System		0.00	—	0.01	Feb 14, 2012	SQL injection vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-1071	TYPO3 mv_cooking		0.00	—	0.01	Feb 14, 2012	SQL injection vulnerability in the Kitchen recipe (mv_cooking) extension before 0.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild as of February 2012.
CVE-2012-1070	TYPO3 irfaq		0.00	—	0.01	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the "return url parameter."
CVE-2012-1069	LknSupport lknSupport		0.03	—	0.02	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in module/kb/search_word in the search module in lknSupport allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVE-2012-1068	WordPress Wp Recentcomments		0.00	—	0.02	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.
CVE-2012-1067	WordPress Wp Recentcomments		0.00	—	0.02	Feb 14, 2012	SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained…
CVE-2012-1066	Smartycms Smartycms		0.00	—	0.01	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in the template module in SmartyCMS 0.9.4 allows remote attackers to inject arbitrary web script or HTML via the title bar.
CVE-2012-1065	—		0.03	—	0.04	Feb 14, 2012	Insecure method vulnerability in TuxScripting.dll in the TuxSystem ActiveX control in 2X ApplicationServer 10.1 Build 1224 allows remote attackers to create or overwrite arbitrary files via the ExportSettings method.
CVE-2012-1009	Netsarang Xlpd		0.03	—	0.03	Feb 14, 2012	NetSarang Xlpd 4 Build 0100 and NetSarang Xmanager Enterprise 4 Build 0186 allow remote attackers to cause a denial of service (daemon crash) via a malformed LPD request.
CVE-2011-5080	Juergen Furrer Jftcaforms		0.00	—	0.01	Feb 14, 2012	Cross-site scripting (XSS) vulnerability in lib/class.tx_jftcaforms_tceFunc.php in the Additional TCA Forms (jftcaforms) extension before 0.2.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-5079	TYPO3 irfaq		0.00	—	0.01	Feb 14, 2012	Open redirect vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL, probably in the "return url parameter."
CVE-2012-0789	PHP PHP		0.04	—	0.08	Feb 14, 2012	Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache.

CVE-2012-0758Feb 15, 2012
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.06
Heap-based buffer overflow in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2012-0757Feb 15, 2012
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0760, CVE-2012-0761, CVE-2012-0762,…
CVE-2012-0155Feb 14, 2012
Microsoft
Internet Explorer
risk 0.05cvss —epss 0.66
Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "VML Remote Code Execution Vulnerability."
CVE-2012-0154Feb 14, 2012
Microsoft
Windows
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted…
CVE-2012-0150Feb 14, 2012
Microsoft
Windows
risk 0.02cvss —epss 0.24
Buffer overflow in msvcrt.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted media file, aka "Msvcrt.dll Buffer Overflow Vulnerability."
CVE-2012-0149Feb 14, 2012
Microsoft
Windows Server 2003
risk 0.00cvss —epss 0.02
afd.sys in the Ancillary Function Driver in Microsoft Windows Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege…
CVE-2012-0148Feb 14, 2012
Microsoft
Windows
risk 0.00cvss —epss 0.02
afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 on 64-bit platforms does not properly validate user-mode input passed to kernel mode, which…
CVE-2012-0145Feb 14, 2012
Microsoft
Sharepoint Server
risk 0.01cvss —epss 0.18
Cross-site scripting (XSS) vulnerability in wizardlist.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in…
CVE-2012-0144Feb 14, 2012
Microsoft
Sharepoint Server
risk 0.01cvss —epss 0.18
Cross-site scripting (XSS) vulnerability in themeweb.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in…
CVE-2012-0138Feb 14, 2012
Microsoft
Visio Viewer
risk 0.02cvss —epss 0.20
Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability…
CVE-2012-0137Feb 14, 2012
Microsoft
Visio Viewer
risk 0.02cvss —epss 0.20
Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability…
CVE-2012-0136Feb 14, 2012
Microsoft
Visio Viewer
risk 0.02cvss —epss 0.20
Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability…
CVE-2012-0020Feb 14, 2012
Microsoft
Visio Viewer
risk 0.02cvss —epss 0.20
Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability…
CVE-2012-0019Feb 14, 2012
Microsoft
Visio Viewer
risk 0.02cvss —epss 0.20
Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability…
CVE-2012-0017Feb 14, 2012
Microsoft
Sharepoint Foundation
risk 0.01cvss —epss 0.18
Cross-site scripting (XSS) vulnerability in inplview.aspx in Microsoft SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in inplview.aspx Vulnerability."
CVE-2012-0015Feb 14, 2012
Microsoft
.net Framework
risk 0.02cvss —epss 0.24
Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly calculate the length of an unspecified buffer, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET…
CVE-2012-0014HigFeb 14, 2012
Microsoft
.net Framework
risk 0.53cvss 7.8epss 0.28
Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.1.10111, does not properly restrict access to memory associated with unmanaged objects, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a…
CVE-2012-0012Feb 14, 2012
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.17
Microsoft Internet Explorer 9 does not properly handle the creation and initialization of string objects, which allows remote attackers to read data from arbitrary process-memory locations via a crafted web site, aka "Null Byte Information Disclosure Vulnerability."
CVE-2012-0011Feb 14, 2012
Microsoft
Internet Explorer
risk 0.02cvss —epss 0.27
Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "HTML Layout Remote Code Execution Vulnerability."
CVE-2012-0010Feb 14, 2012
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.14
Microsoft Internet Explorer 6 through 9 does not properly perform copy-and-paste operations, which allows user-assisted remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Copy and Paste Information Disclosure Vulnerability."
CVE-2010-5085Feb 14, 2012
Hulihan
Amethyst
risk 0.00cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in admin/update_user in Hulihan Amethyst 0.1.5, and possibly earlier, allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrative password or (2) change the…
CVE-2010-5084Feb 14, 2012
E107
E107
risk 0.00cvss —epss 0.01
The cross-site request forgery (CSRF) protection mechanism in e107 before 0.7.23 uses a predictable random token based on the creation date of the administrator account, which allows remote attackers to hijack the authentication of administrators for requests that add new users…
CVE-2010-5083Feb 14, 2012
PHP-Nuke
Web_Links module
risk 0.03cvss —epss 0.01
SQL injection vulnerability in the Web_Links module for PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the url parameter in an Add action to modules.php.
CVE-2012-1087Feb 14, 2012
TYPO3
bc_post2facebook
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1086Feb 14, 2012
TYPO3
Aeurltool
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the UrlTool (aeurltool) extension 0.1.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1085Feb 14, 2012
TYPO3
Beuserswitch
risk 0.00cvss —epss 0.01
Unspecified vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.
CVE-2012-1084Feb 14, 2012
TYPO3
Beuserswitch
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1083Feb 14, 2012
TYPO3
Terminal
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2012-1082Feb 14, 2012
TYPO3
Terminal
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1081Feb 14, 2012
TYPO3
Yet another Google search
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Yet another Google search (ya_googlesearch) extension before 0.3.10 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1080Feb 14, 2012
TYPO3
Euro Calculator (skt_eurocalc)
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Euro Calculator (skt_eurocalc) extension 0.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1079Feb 14, 2012
TYPO3
typo3_webservice
risk 0.00cvss —epss 0.02
Unspecified vulnerability in the Webservices for TYPO3 (typo3_webservice) extension before 0.3.8 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors.
CVE-2012-1078Feb 14, 2012
TYPO3
sysutils
risk 0.00cvss —epss 0.01
The System Utilities (sysutils) extension 1.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unspecified vectors related to improper "protection" of the "backup output directory."
CVE-2012-1077Feb 14, 2012
TYPO3
bc_post2facebook
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-1076Feb 14, 2012
TYPO3
rtg_files
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1075Feb 14, 2012
TYPO3
rtg_files
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-1074Feb 14, 2012
TYPO3
White Papers
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the White Papers (mm_whtppr) extension 0.0.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-1073Feb 14, 2012
TYPO3
Toi Category
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-1072Feb 14, 2012
TYPO3
Category-System
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-1071Feb 14, 2012
TYPO3
mv_cooking
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the Kitchen recipe (mv_cooking) extension before 0.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild as of February 2012.
CVE-2012-1070Feb 14, 2012
TYPO3
irfaq
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the "return url parameter."
CVE-2012-1069Feb 14, 2012
LknSupport
lknSupport
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in module/kb/search_word in the search module in lknSupport allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVE-2012-1068Feb 14, 2012
WordPress
Wp Recentcomments
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.
CVE-2012-1067Feb 14, 2012
WordPress
Wp Recentcomments
risk 0.00cvss —epss 0.02
SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained…
CVE-2012-1066Feb 14, 2012
Smartycms
Smartycms
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the template module in SmartyCMS 0.9.4 allows remote attackers to inject arbitrary web script or HTML via the title bar.
CVE-2012-1065Feb 14, 2012
risk 0.03cvss —epss 0.04
Insecure method vulnerability in TuxScripting.dll in the TuxSystem ActiveX control in 2X ApplicationServer 10.1 Build 1224 allows remote attackers to create or overwrite arbitrary files via the ExportSettings method.
CVE-2012-1009Feb 14, 2012
Netsarang
Xlpd
risk 0.03cvss —epss 0.03
NetSarang Xlpd 4 Build 0100 and NetSarang Xmanager Enterprise 4 Build 0186 allow remote attackers to cause a denial of service (daemon crash) via a malformed LPD request.
CVE-2011-5080Feb 14, 2012
Juergen Furrer
Jftcaforms
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in lib/class.tx_jftcaforms_tceFunc.php in the Additional TCA Forms (jftcaforms) extension before 0.2.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-5079Feb 14, 2012
TYPO3
irfaq
risk 0.00cvss —epss 0.01
Open redirect vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL, probably in the "return url parameter."
CVE-2012-0789Feb 14, 2012
PHP
PHP
risk 0.04cvss —epss 0.08
Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache.