CVEs

386,605 total · page 6708 of 7,733

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2012-2962	SonicWall Scrutinizer	0.08	—	0.67	Jul 30, 2012	SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter.
CVE-2012-2163	IBM Scale Out Network Attached Storage	0.00	—	0.02	Jul 30, 2012	IBM Scale Out Network Attached Storage (SONAS) 1.1 through 1.3.1 allows remote authenticated administrators to execute arbitrary Linux commands via the (1) Command Line Interface or (2) Graphical User Interface, related to a "code injection" issue.
CVE-2012-0723	IBM Aix	0.00	—	0.00	Jul 30, 2012	The kernel in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly implement the dupmsg system call, which allows local users to cause a denial of service (system crash) via a crafted application.
CVE-2012-1969	Mozilla Corporation Bugzilla	0.00	—	0.02	Jul 30, 2012	The get_attachment_link function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before 4.2.2, and 4.3.x before 4.3.2 does not check whether an attachment is private before presenting the attachment description within a public…
CVE-2012-1968	Mozilla Corporation Bugzilla	0.00	—	0.01	Jul 30, 2012	Bugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses bug-editor privileges instead of bugmail-recipient privileges during construction of HTML bugmail documents, which allows remote attackers to obtain sensitive description information by reading the tooltip…
CVE-2012-2978	Nlnetlabs Nsd	0.01	—	0.09	Jul 27, 2012	query.c in NSD 3.0.x through 3.0.8, 3.1.x through 3.1.1, and 3.2.x before 3.2.12 allows remote attackers to cause a denial of service (NULL pointer dereference and child process crash) via a crafted DNS packet.
CVE-2012-2202	IBM Lotus Protector For Mail Security	0.03	—	0.03	Jul 27, 2012	Directory traversal vulnerability in javatester_init.php in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2.8 and IBM ISS Proventia Network Mail Security System allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the template…
CVE-2012-3888	Airdroid Airdroid	0.00	—	0.01	Jul 26, 2012	The login implementation in AirDroid 1.0.4 beta allows remote attackers to bypass a multiple-login protection mechanism by modifying a pass value within JSON data.
CVE-2012-3887	Airdroid Airdroid	0.00	—	0.01	Jul 26, 2012	AirDroid before 1.0.7 beta uses a cleartext base64 format for data transfer that is documented as an "Encrypted Transmission" feature, which allows remote attackers to obtain sensitive information by sniffing the local wireless network, as demonstrated by the SMS message content…
CVE-2012-3886	Airdroid Airdroid	0.00	—	0.01	Jul 26, 2012	AirDroid 1.0.4 beta uses the MD5 algorithm for values in the checklogin key parameter and 7bb cookie, which makes it easier for remote attackers to obtain cleartext data by sniffing the local wireless network and then conducting a (1) brute-force attack or (2) rainbow-table…
CVE-2012-3885	Airdroid Airdroid	0.00	—	0.01	Jul 26, 2012	The default configuration of AirDroid 1.0.4 beta uses a four-character alphanumeric password, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVE-2012-3884	Airdroid Airdroid	0.00	—	0.01	Jul 26, 2012	AirDroid 1.0.4 beta implements authentication through direct transmission of a password hash over HTTP, which makes it easier for remote attackers to obtain access by sniffing the local wireless network and then replaying the authentication data.
CVE-2011-3174	Novell Zenworks Configuration Management	0.00	—	0.03	Jul 26, 2012	Buffer overflow in the DoFindReplace function in the ISGrid.Grid2.1 ActiveX control in InstallShield/ISGrid2.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary code via a long bstrReplaceText…
CVE-2011-2658	Novell Zenworks Configuration Management	0.00	—	0.03	Jul 26, 2012	The ISList.ISAvi ActiveX control in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 provides access to the mscomct2.ocx file, which allows remote attackers to execute arbitrary code by leveraging unspecified mscomct2 flaws.
CVE-2011-2657	Novell Zenworks Configuration Management	0.07	—	0.48	Jul 26, 2012	Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary commands via a…
CVE-2012-4068	Citrix Systems Provisioning Services	0.00	—	0.05	Jul 26, 2012	Heap-based buffer overflow in the SoapServer service in Citrix Provisioning Services 5.0, 5.1, 5.6, 5.6 SP1, 6.0, and 6.1 allows remote attackers to execute arbitrary code via a crafted string associated with date and time data.
CVE-2012-4043	Palo Alto SSL VPN	0.00	—	0.01	Jul 26, 2012	Cross-site scripting (XSS) vulnerability in global-protect/login.esp in Palo Alto Networks Global Protect Portal, Global Protect Gateway, and SSL VPN portals 3.1.x through 3.1.11 and 4.0.x through 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the…
CVE-2012-3698	Apple Inc. Xcode	0.00	—	0.01	Jul 26, 2012	Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of programs that lack bundle identifiers, which allows remote attackers to read keychain entries via a crafted app, as demonstrated by the keychain entries of a (1) helper tool or (2)…
CVE-2011-4963	Nginx Nginx	0.00	—	0.06	Jul 26, 2012	nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted files via (1) a trailing . (dot) or (2) certain "$index_allocation" sequences in a request.
CVE-2011-2503	Systemtap Systemtap	0.00	—	0.00	Jul 26, 2012	The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation…
CVE-2011-2502	Systemtap Systemtap	0.00	—	0.01	Jul 26, 2012	runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted…
CVE-2012-3015	Siemens Foundation Simatic Pcs7	0.00	—	0.00	Jul 26, 2012	Untrusted search path vulnerability in Siemens SIMATIC STEP7 before 5.5 SP1, as used in SIMATIC PCS7 7.1 SP3 and earlier and other products, allows local users to gain privileges via a Trojan horse DLL in a STEP7 project folder.
CVE-2012-3005	Invensys Wonderware Application Server	0.00	—	0.00	Jul 26, 2012	Untrusted search path vulnerability in Invensys Wonderware InTouch 2012 and earlier, as used in Wonderware Application Server, Wonderware Information Server, Foxboro Control Software, InFusion CE/FE/SCADA, InBatch, and Wonderware Historian, allows local users to gain privileges…
CVE-2012-4061	Asp Dev Xm Diary	0.00	—	0.01	Jul 25, 2012	Multiple SQL injection vulnerabilities in ASP-DEv XM Diary allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to diary_view.asp or (2) view_date parameter to default.asp.
CVE-2012-4060	Asp Dev Xm Forum	0.03	—	0.01	Jul 25, 2012	Multiple SQL injection vulnerabilities in ASP-DEv XM Forums RC3 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) profile.asp, (2) forum.asp, or (3) topic.asp.
CVE-2012-4059	Socketmail Socketmail	0.00	—	0.01	Jul 25, 2012	Cross-site request forgery (CSRF) vulnerability in home/secretqtn.php in SocketMail Pro 2.2.9 allows remote attackers to hijack the authentication of arbitrary users for requests that change user security questions and answers via an upd action.
CVE-2012-4058	Socketmail Socketmail	0.00	—	0.01	Jul 25, 2012	Cross-site scripting (XSS) vulnerability in SocketMail Pro 2.2.9 allows remote attackers to inject arbitrary web script or HTML via the subject of an email.
CVE-2012-4057	Remote Anything Player	0.04	—	0.06	Jul 25, 2012	Buffer overflow in the Player in Remote-Anything 5.60.15 allows remote attackers to execute arbitrary code via a crafted flm file.
CVE-2012-4056	Uiga Personal Portal	0.00	—	0.01	Jul 25, 2012	SQL injection vulnerability in index2.php in Uiga Personal Portal allows remote attackers to execute arbitrary SQL commands via the p parameter.
CVE-2012-4055	Uiga Fan Club	0.03	—	0.01	Jul 25, 2012	SQL injection vulnerability in index2.php in Uiga Fan Club allows remote attackers to execute arbitrary SQL commands via the p parameter.
CVE-2012-4054	—	0.03	—	0.01	Jul 25, 2012	Buffer overflow in the readfile function in CPE17 Autorun Killer 1.7.1 and earlier allows physically proximate attackers to execute arbitrary code via a crafted inf file.
CVE-2012-2442	Nokia Pc Suite	0.03	—	0.03	Jul 25, 2012	Buffer overflow in the Video Manager in Nokia PC Suite 7.1.180.64 and earlier allows remote attackers to cause a denial of service via a crafted mp4 file.
CVE-2012-2310	Drupal cctags	0.00	—	0.01	Jul 25, 2012	Cross-site scripting (XSS) vulnerability in the cctags module for Drupal 6.x-1.x before 6.x-1.10 and 7.x-1.x before 7.x-1.10 allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-2309	Drupal Glossify Internal Links Auto SEO	0.00	—	0.01	Jul 25, 2012	Cross-site scripting (XSS) vulnerability in the Glossify Internal Links Auto SEO module for Drupal 6.x-2.5 and earlier allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-2308	Drupal Taxonomy Grid : Catalog	0.00	—	0.01	Jul 25, 2012	Cross-site scripting (XSS) vulnerability in the Taxonomy Grid : Catalog module for Drupal 6.x-1.6 and earlier allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-2307	Drupal Addressbook	0.00	—	0.01	Jul 25, 2012	Cross-site request forgery (CSRF) vulnerability in the Addressbook module for Drupal 6.x-4.2 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2012-2306	Drupal Drupal	0.00	—	0.01	Jul 25, 2012	SQL injection vulnerability in the Addressbook module for Drupal 6.x-4.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-2305	Drupal Node Gallery	0.00	—	0.01	Jul 25, 2012	Cross-site request forgery (CSRF) vulnerability in the Node Gallery module for Drupal 6.x-3.1 and earlier allows remote attackers to hijack the authentication of certain users for requests that create node galleries.
CVE-2012-2302	Drupal Sitedoc	0.00	—	0.02	Jul 25, 2012	Site Documentation (Sitedoc) module for Drupal 6.x-1.x before 6.x-1.4 does not properly check the save location when archiving, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2012-2296	Janrain Rpx	0.00	—	0.02	Jul 25, 2012	The Janrain Engage (formerly RPX) module for Drupal 6.x-1.x. 6.x-2.x before 6.x-2.2, and 7.x-2.x before 7.x-2.2 stores user profile data from Engage in session tables, which might allow remote attackers to obtain sensitive information by leveraging a separate vulnerability.
CVE-2012-2152	Dhcpcd Project Dhcpcd	0.00	—	0.04	Jul 25, 2012	Stack-based buffer overflow in the get_packet method in socket.c in dhcpcd 3.2.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long packet.
CVE-2012-3686	Apple Inc. Safari	0.00	—	0.04	Jul 25, 2012	WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3683	Apple Inc. Safari	0.00	—	0.03	Jul 25, 2012	WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3682	Apple Inc. Safari	0.00	—	0.04	Jul 25, 2012	WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3681	Apple Inc. Safari	0.00	—	0.04	Jul 25, 2012	WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3680	Apple Inc. Safari	0.00	—	0.04	Jul 25, 2012	WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3679	Apple Inc. Safari	0.00	—	0.04	Jul 25, 2012	WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3678	Apple Inc. Safari	0.00	—	0.04	Jul 25, 2012	WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3674	Apple Inc. Safari	0.00	—	0.04	Jul 25, 2012	WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3670	Apple Inc. Safari	0.00	—	0.04	Jul 25, 2012	WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.

CVE-2012-2962Jul 30, 2012
SonicWall
Scrutinizer
risk 0.08cvss —epss 0.67
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter.
CVE-2012-2163Jul 30, 2012
IBM
Scale Out Network Attached Storage
risk 0.00cvss —epss 0.02
IBM Scale Out Network Attached Storage (SONAS) 1.1 through 1.3.1 allows remote authenticated administrators to execute arbitrary Linux commands via the (1) Command Line Interface or (2) Graphical User Interface, related to a "code injection" issue.
CVE-2012-0723Jul 30, 2012
IBM
Aix
risk 0.00cvss —epss 0.00
The kernel in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly implement the dupmsg system call, which allows local users to cause a denial of service (system crash) via a crafted application.
CVE-2012-1969Jul 30, 2012
Mozilla Corporation
Bugzilla
risk 0.00cvss —epss 0.02
The get_attachment_link function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before 4.2.2, and 4.3.x before 4.3.2 does not check whether an attachment is private before presenting the attachment description within a public…
CVE-2012-1968Jul 30, 2012
Mozilla Corporation
Bugzilla
risk 0.00cvss —epss 0.01
Bugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses bug-editor privileges instead of bugmail-recipient privileges during construction of HTML bugmail documents, which allows remote attackers to obtain sensitive description information by reading the tooltip…
CVE-2012-2978Jul 27, 2012
Nlnetlabs
Nsd
risk 0.01cvss —epss 0.09
query.c in NSD 3.0.x through 3.0.8, 3.1.x through 3.1.1, and 3.2.x before 3.2.12 allows remote attackers to cause a denial of service (NULL pointer dereference and child process crash) via a crafted DNS packet.
CVE-2012-2202Jul 27, 2012
IBM
Lotus Protector For Mail Security
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in javatester_init.php in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2.8 and IBM ISS Proventia Network Mail Security System allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the template…
CVE-2012-3888Jul 26, 2012
Airdroid
Airdroid
risk 0.00cvss —epss 0.01
The login implementation in AirDroid 1.0.4 beta allows remote attackers to bypass a multiple-login protection mechanism by modifying a pass value within JSON data.
CVE-2012-3887Jul 26, 2012
Airdroid
Airdroid
risk 0.00cvss —epss 0.01
AirDroid before 1.0.7 beta uses a cleartext base64 format for data transfer that is documented as an "Encrypted Transmission" feature, which allows remote attackers to obtain sensitive information by sniffing the local wireless network, as demonstrated by the SMS message content…
CVE-2012-3886Jul 26, 2012
Airdroid
Airdroid
risk 0.00cvss —epss 0.01
AirDroid 1.0.4 beta uses the MD5 algorithm for values in the checklogin key parameter and 7bb cookie, which makes it easier for remote attackers to obtain cleartext data by sniffing the local wireless network and then conducting a (1) brute-force attack or (2) rainbow-table…
CVE-2012-3885Jul 26, 2012
Airdroid
Airdroid
risk 0.00cvss —epss 0.01
The default configuration of AirDroid 1.0.4 beta uses a four-character alphanumeric password, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVE-2012-3884Jul 26, 2012
Airdroid
Airdroid
risk 0.00cvss —epss 0.01
AirDroid 1.0.4 beta implements authentication through direct transmission of a password hash over HTTP, which makes it easier for remote attackers to obtain access by sniffing the local wireless network and then replaying the authentication data.
CVE-2011-3174Jul 26, 2012
Novell
Zenworks Configuration Management
risk 0.00cvss —epss 0.03
Buffer overflow in the DoFindReplace function in the ISGrid.Grid2.1 ActiveX control in InstallShield/ISGrid2.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary code via a long bstrReplaceText…
CVE-2011-2658Jul 26, 2012
Novell
Zenworks Configuration Management
risk 0.00cvss —epss 0.03
The ISList.ISAvi ActiveX control in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 provides access to the mscomct2.ocx file, which allows remote attackers to execute arbitrary code by leveraging unspecified mscomct2 flaws.
CVE-2011-2657Jul 26, 2012
Novell
Zenworks Configuration Management
risk 0.07cvss —epss 0.48
Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary commands via a…
CVE-2012-4068Jul 26, 2012
Citrix Systems
Provisioning Services
risk 0.00cvss —epss 0.05
Heap-based buffer overflow in the SoapServer service in Citrix Provisioning Services 5.0, 5.1, 5.6, 5.6 SP1, 6.0, and 6.1 allows remote attackers to execute arbitrary code via a crafted string associated with date and time data.
CVE-2012-4043Jul 26, 2012
Palo Alto
SSL VPN
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in global-protect/login.esp in Palo Alto Networks Global Protect Portal, Global Protect Gateway, and SSL VPN portals 3.1.x through 3.1.11 and 4.0.x through 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the…
CVE-2012-3698Jul 26, 2012
Apple Inc.
Xcode
risk 0.00cvss —epss 0.01
Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of programs that lack bundle identifiers, which allows remote attackers to read keychain entries via a crafted app, as demonstrated by the keychain entries of a (1) helper tool or (2)…
CVE-2011-4963Jul 26, 2012
Nginx
Nginx
risk 0.00cvss —epss 0.06
nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted files via (1) a trailing . (dot) or (2) certain "$index_allocation" sequences in a request.
CVE-2011-2503Jul 26, 2012
Systemtap
Systemtap
risk 0.00cvss —epss 0.00
The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation…
CVE-2011-2502Jul 26, 2012
Systemtap
Systemtap
risk 0.00cvss —epss 0.01
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted…
CVE-2012-3015Jul 26, 2012
Siemens Foundation
Simatic Pcs7
risk 0.00cvss —epss 0.00
Untrusted search path vulnerability in Siemens SIMATIC STEP7 before 5.5 SP1, as used in SIMATIC PCS7 7.1 SP3 and earlier and other products, allows local users to gain privileges via a Trojan horse DLL in a STEP7 project folder.
CVE-2012-3005Jul 26, 2012
Invensys
Wonderware Application Server
risk 0.00cvss —epss 0.00
Untrusted search path vulnerability in Invensys Wonderware InTouch 2012 and earlier, as used in Wonderware Application Server, Wonderware Information Server, Foxboro Control Software, InFusion CE/FE/SCADA, InBatch, and Wonderware Historian, allows local users to gain privileges…
CVE-2012-4061Jul 25, 2012
Asp Dev
Xm Diary
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in ASP-DEv XM Diary allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to diary_view.asp or (2) view_date parameter to default.asp.
CVE-2012-4060Jul 25, 2012
Asp Dev
Xm Forum
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in ASP-DEv XM Forums RC3 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) profile.asp, (2) forum.asp, or (3) topic.asp.
CVE-2012-4059Jul 25, 2012
Socketmail
Socketmail
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in home/secretqtn.php in SocketMail Pro 2.2.9 allows remote attackers to hijack the authentication of arbitrary users for requests that change user security questions and answers via an upd action.
CVE-2012-4058Jul 25, 2012
Socketmail
Socketmail
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in SocketMail Pro 2.2.9 allows remote attackers to inject arbitrary web script or HTML via the subject of an email.
CVE-2012-4057Jul 25, 2012
Remote Anything
Player
risk 0.04cvss —epss 0.06
Buffer overflow in the Player in Remote-Anything 5.60.15 allows remote attackers to execute arbitrary code via a crafted flm file.
CVE-2012-4056Jul 25, 2012
Uiga
Personal Portal
risk 0.00cvss —epss 0.01
SQL injection vulnerability in index2.php in Uiga Personal Portal allows remote attackers to execute arbitrary SQL commands via the p parameter.
CVE-2012-4055Jul 25, 2012
Uiga
Fan Club
risk 0.03cvss —epss 0.01
SQL injection vulnerability in index2.php in Uiga Fan Club allows remote attackers to execute arbitrary SQL commands via the p parameter.
CVE-2012-4054Jul 25, 2012
risk 0.03cvss —epss 0.01
Buffer overflow in the readfile function in CPE17 Autorun Killer 1.7.1 and earlier allows physically proximate attackers to execute arbitrary code via a crafted inf file.
CVE-2012-2442Jul 25, 2012
Nokia
Pc Suite
risk 0.03cvss —epss 0.03
Buffer overflow in the Video Manager in Nokia PC Suite 7.1.180.64 and earlier allows remote attackers to cause a denial of service via a crafted mp4 file.
CVE-2012-2310Jul 25, 2012
Drupal
cctags
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the cctags module for Drupal 6.x-1.x before 6.x-1.10 and 7.x-1.x before 7.x-1.10 allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-2309Jul 25, 2012
Drupal
Glossify Internal Links Auto SEO
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Glossify Internal Links Auto SEO module for Drupal 6.x-2.5 and earlier allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-2308Jul 25, 2012
Drupal
Taxonomy Grid : Catalog
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Taxonomy Grid : Catalog module for Drupal 6.x-1.6 and earlier allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-2307Jul 25, 2012
Drupal
Addressbook
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in the Addressbook module for Drupal 6.x-4.2 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2012-2306Jul 25, 2012
Drupal
Drupal
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the Addressbook module for Drupal 6.x-4.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-2305Jul 25, 2012
Drupal
Node Gallery
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in the Node Gallery module for Drupal 6.x-3.1 and earlier allows remote attackers to hijack the authentication of certain users for requests that create node galleries.
CVE-2012-2302Jul 25, 2012
Drupal
Sitedoc
risk 0.00cvss —epss 0.02
Site Documentation (Sitedoc) module for Drupal 6.x-1.x before 6.x-1.4 does not properly check the save location when archiving, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2012-2296Jul 25, 2012
Janrain
Rpx
risk 0.00cvss —epss 0.02
The Janrain Engage (formerly RPX) module for Drupal 6.x-1.x. 6.x-2.x before 6.x-2.2, and 7.x-2.x before 7.x-2.2 stores user profile data from Engage in session tables, which might allow remote attackers to obtain sensitive information by leveraging a separate vulnerability.
CVE-2012-2152Jul 25, 2012
Dhcpcd Project
Dhcpcd
risk 0.00cvss —epss 0.04
Stack-based buffer overflow in the get_packet method in socket.c in dhcpcd 3.2.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long packet.
CVE-2012-3686Jul 25, 2012
Apple Inc.
Safari
risk 0.00cvss —epss 0.04
WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3683Jul 25, 2012
Apple Inc.
Safari
risk 0.00cvss —epss 0.03
WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3682Jul 25, 2012
Apple Inc.
Safari
risk 0.00cvss —epss 0.04
WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3681Jul 25, 2012
Apple Inc.
Safari
risk 0.00cvss —epss 0.04
WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3680Jul 25, 2012
Apple Inc.
Safari
risk 0.00cvss —epss 0.04
WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3679Jul 25, 2012
Apple Inc.
Safari
risk 0.00cvss —epss 0.04
WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3678Jul 25, 2012
Apple Inc.
Safari
risk 0.00cvss —epss 0.04
WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3674Jul 25, 2012
Apple Inc.
Safari
risk 0.00cvss —epss 0.04
WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.
CVE-2012-3670Jul 25, 2012
Apple Inc.
Safari
risk 0.00cvss —epss 0.04
WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.